Professor Joel R. ReidenbergStanley D. and Nikki Waxberg Chair

Academic Director, Center on Law & Information PolicyFordham University School of Law

New York, NY

2

Overview

• Basic rules for data retention and access in the US and Europe

• Intractable Conflicts

• The Privacy Turning Point

3

Basic Rules: U.S. Data Retention

47 C.F.R. 42.6

Corporate practice

4

Basic Rules: EU Data Retention

• Directive 95/46/EC (Data Protection)• Directive 2002/58/EC

(E-Privacy)• Directive 2006/24/EC

(Data Retention)

5

Basic Rules: U.S. Data Access

Constitutional limits 4th Amendment3rd Party Doctrine Contents/Traffic

ECPA (1986)Warrant, SubpoenaAdmin Subpoena

6

Basic Rules: EU Data Access

Directive 95/46/EC : General limit

Directive 2002/58/EC Law = necessary + proportionate

Directive 2006/24/EC Law + procedures =

necessity + proportionality in EU law,international law, & ECHR

7

Intractable Conflicts

Context

Source: Google Transparency Report

(as of 12/31/2012)

8

Intractable Conflicts

• Elusive Linkage between

Retention and AccessUS: Emphasis on regulation of access

Statutory weakness

EU: Emphasis on regulation of retention

Blurry access controls

‘Constitutional’ limits (e.g. Germany)

9

Intractable Conflicts

• Enforcement BurdenContradictions

Sheriff Role of Private Sector

Directive 1995/46/EC vs.

data retention

Proportionality Problem

Function creep (e.g. French LCEN)

10

The Privacy Turning Point: An impossible dilemma

Transparent citizensReversal of presumption of innocence

Reduction of zone of individual freedom

Diffusion of state police powerExpansion to private matters (e.g. IP)

11

Conclusion

Couple1) Collection/storage limits

2) Strict, specific access limits