Big Data Analytics. Fifth Munich Data Protection Day, March 23, Dr. Stefan Krätschmer, Data Privacy Officer, Europe, IBM

Transkript

1 Big Data Analytics Fifth Munich Data Protection Day, March 23, 2017 C Dr. Stefan Krätschmer, Data Privacy Officer, Europe, IBM

2 Big Data Use Cases Customer focused - Targeted advertising / banners - Analysis of customer needs, e.g. developments of new products Risk focused - Supply chain monitoring - Real time pricing Business process focused - Product and process monitoring (quality management) - IT security threats Societal aspects - Health - Traffic - Societal threats understand learn protect individuals 2

3 Technical aspects Make it available Develop new information Learn from it Find the data needed Structure it Anonymization? 3

4 Legal aspects Consent Legitimate interest Further processing Anonymization People can say no or withdraw it Opinion of German DPAs about validity of former consents under GDPR More balanced than consent Information of individuals in case of compatibility When is data anonymized? Is a legal basis needed for the anonymization process? 4

5 Anonymization - When is data anonymized? Impossible? No US approaches (HIPAA): deleting certain elements or likelihood threshold EU law: all the means likely reasonably to be used either by the controller or by any other person German Federal DP Act: no longer or only with a disproportionate amount of time, expense and labour be attributed to an identified or identifiable individual. ECJ Breyer case: Mixture between German Federal DP Act and EU law How can a practical solution looks like? 5

6 Anonymization - legal basis needed for the anonymization process? Article 29 Data Working Party Opinion 05/2014 (WP216): Yes no consistency between DPAs in Europe What would be the consequences of a Yes? 6

7 Anonymization - legal basis needed for the anonymization process? simply personal data legitimate interest further processing compatibility check, but information requirement Consequences of a Yes Telco area according to WP216 legal basis exists Traffic data must be erased or made anonymous Where location data may only be processed when they are made anonymous, or. special categories of personal data no legitimate interest available as legal basis other solutions? 7

8 Conclusion Big Data and Data Protection are not in contradiction But Data Protection needs to find practical solutions for use cases that are legitimate, balanced and in general interest in an EU-wide harmonized way 8

9 Supporter : Angela Merkel Wir müssen die Stelle finden, wo die Daten in anonymer Form mit Big Data neue sinnvolle Produkte möglich machen. faz.net, 21/10/2014, IT Gipfel 2014 (source: Merkel auf dem IT-Gipfel: Datenschutz darf Big Data nicht verhindern. heise online, 19/11/2015, IT Gipfel 2015 (source: Merkel-auf-dem-IT-Gipfel-Datenschutz-darf-Big-Data-nicht-verhindern html) Kanzlerin Merkel sagt, dass Deutschland bei der Digitalisierung abgehängt werde, wenn es sich "Big Data" nicht zunutze mache. Süddeutsche Zeitung online, 09/01/2017, Tagung Deutscher Beamtenbund Köln (source: /politik/digitalisierung-merkel-deutschland-droht-digitalesentwicklungsland-zu-werden ) 9

10 Supporter : Angela Merkel We need to find a place where anonymous data together with Big Data can make new meaningful products possible. faz.net, 21/10/2014, IT Gipfel 2014 (source: Merkel at the IT-summit: Data privacy must not prevent Big Data. heise online, 19/11/2015, IT Gipfel 2015 (source: Merkel-auf-dem-IT-Gipfel-Datenschutz-darf-Big-Data-nicht-verhindern html) Merkel says that Germany will be left behind in the process of digitization if it does not take advantage of Big Data. Süddeutsche Zeitung online, 09/01/2017, Tagung Deutscher Beamtenbund Köln (source: /politik/digitalisierung-merkel-deutschland-droht-digitalesentwicklungsland-zu-werden ) 10