Privacy, Surveillance, and the Cloud: One Year Later

3 September 2014 - A Workshop on Other in Istanbul, Turkey

Brief substantive summary of the workshop and presentation of the main issues that were raised during the discussions

Focus on Government Surveillance Activities: The debate about government surveillance of Internet activities has garnered more attention than ever before - the issue is now being widely discussed. There has been a recognition in many countries that surveillance capabilities tipped too far in favor of the state, and away from individual rights.

Data Localization as a Response: A problematic response to the surveillance revelations was the tendency for some governments to implement data localization requirements, mandating that cloud providers store information within a particular jurisdiction.

Data Localization is Unscalable and Increases Risk of Surveillance: Data localization is difficult to implement, since theoretically it would require cloud providers to build data centers in every country that has implemented data-localization requirements. Data localization would increase the risk of potential government surveillance, since data would be duplicated in multiple countries.

Brazil’s Legislative Response: Brazil served as an interesting example of the evolution of legislation in response to surveillance revelations. While Marco Civil legislation initially involved data localization, the requirements shifted to allow for Brazilian government access to data about Brazilian citizens regardless of the location of the data.

Data Retention Legislation: Surveillance revelations have focused attention on existing data retention legislation, such as that passed pursuant to the EU Data Retention Directive, where telecommunication providers are required to maintain transactional information.

Some Muted Reactions: There was little reaction to surveillance revelations in Japan and other parts of Eastern Asia, such as Korea. There was some sentiment that surveillance was a US domestic issue that it didn’t directly affect individuals in those countries. There was little response from developing economies regarding the surveillance revelations.

Private Sector Principles: Private sector technology companies collectively called for reform of surveillance activities, and adopted a set of principles to highlight the need to address surveillance issues.

Transparency Reporting: Since the surveillance revelations, there has been a significant rise in the number of private sector companies reporting government access requests.
Governments, under pressure from the public, have begun to provide more insight into surveillance activities.

Role of the Multilateral-Multistakeholder Process: There is a role for multilateral organizations in the field of data protection. For example, in Europe, the European Court of Justice and the European Parliament are addressing surveillance matters. In Japan, there has been a new push to leverage a multi-stakeholder approach to improving privacy legislation.

Conclusions drawn from the workshop and possible follow up actions

Governments should not pursue data localization, but rather, focus on transnational, multi-jurisdictional due-process mechanisms. Further, the Mutual Legal Assistance Treaty (MLAT) process needs to be reformed. There must be a functional system whereby governments can cooperate to obtain information. While conflicts may arise between governments regarding access to data, a framework must be established to resolve these conflicts. Multilateral organizations should help extend the debate regarding government surveillance to the governments of developing economies, including a push for rule-of-law and judicial oversight. The linking of funding to developing economies with surveillance reforms may serve as a catalyst for change. The private sector should continue the trend towards transparency reporting. There must be greater government transparency.

Estimation of the overall number of participants present at the workshop

200

Estimation of the overall number of women present at the workshop

about half of the participants were women

Extent to that the workshop discuss gender equality and/or women’s empowerment

it was not seen as related to the workshop’s theme and was not raised

A brief summary of the discussions in case that the workshop addressed issues related to gender equality and/or women’s empowerment

No information provided

Reported by

No information provided