Salo and Liyanage
402
4) Foster interoperability and data portability; endorse technology neutrality and promote competition; avoid mandated standards or preferences that could frustrate,
rather than promote, on‐going interoperability efforts of the industry at large and
among the vendors providing services and solutions;
5) The applicable law must be easy to define; A single set of rules on data protection,
valid across the EU, shall be set up; A legal framework is needed that can be applied
across borders, which gives users the means to exercise their rights across borders,
which is based on the concept of accountability and draws on technological controls
and self‐regulatory codes and mechanisms as supported by Articles 17 and 27 of the
Directive 95/46/EC;
6) The right to be forgotten, i.e. the right for the individual to request the deletion of
his/her personal data;
7) Increased responsibility and accountability for those processing personal data.
17.3 Legal Framework for Security and Privacy
In the following sub‐sections, the details of the legal framework for Security and Privacy,
the Security and Privacy issues in the context of new network technologies, and their
relevance assessment against the specific regulatory objectives, are presented.
17.3.1 General Framework
The networks today are in general more open than in the past and one weak link
affects the integrity of the whole system. The growth of spam, viruses, spyware and
other forms of malware, which is undermining users’ confidence in electronic communications, is partly due to that openness. To ensure the security of these critical
infrastructures and to protect the citizens’ privacy, the EU has taken several measures
for ensuring the security of these critical infrastructures and to protect the privacy of
its citizens.
In the EU’s: 1) Privacy Directive (EC Directive 2002/58/EC) [11]; and 2) Data
Protection Directive (Directive 95/46/EC) [12], Privacy in the processing of personal
data and the confidentiality of communications are recognized as fundamental rights
that should be protected:
1) The Privacy Directive requires the Member States to harmonize and ensure an equivalent level of protection of the right to privacy with respect to personal data in the
electronic communication sector. Regarding the confidentiality of communications,
the Privacy Directive says that EU member states shall ensure the confidentiality of
communications and the related data traffic through the national legislation. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or
surveillance of communications and the related traffic data by persons other than
users, without the consent of the users concerned.
2) The Data Protection Directive prohibits the transfer of personal information to any
country that does not have adequate privacy laws. As a result, EU member states
402
4) Foster interoperability and data portability; endorse technology neutrality and promote competition; avoid mandated standards or preferences that could frustrate,
rather than promote, on‐going interoperability efforts of the industry at large and
among the vendors providing services and solutions;
5) The applicable law must be easy to define; A single set of rules on data protection,
valid across the EU, shall be set up; A legal framework is needed that can be applied
across borders, which gives users the means to exercise their rights across borders,
which is based on the concept of accountability and draws on technological controls
and self‐regulatory codes and mechanisms as supported by Articles 17 and 27 of the
Directive 95/46/EC;
6) The right to be forgotten, i.e. the right for the individual to request the deletion of
his/her personal data;
7) Increased responsibility and accountability for those processing personal data.
17.3 Legal Framework for Security and Privacy
In the following sub‐sections, the details of the legal framework for Security and Privacy,
the Security and Privacy issues in the context of new network technologies, and their
relevance assessment against the specific regulatory objectives, are presented.
17.3.1 General Framework
The networks today are in general more open than in the past and one weak link
affects the integrity of the whole system. The growth of spam, viruses, spyware and
other forms of malware, which is undermining users’ confidence in electronic communications, is partly due to that openness. To ensure the security of these critical
infrastructures and to protect the citizens’ privacy, the EU has taken several measures
for ensuring the security of these critical infrastructures and to protect the privacy of
its citizens.
In the EU’s: 1) Privacy Directive (EC Directive 2002/58/EC) [11]; and 2) Data
Protection Directive (Directive 95/46/EC) [12], Privacy in the processing of personal
data and the confidentiality of communications are recognized as fundamental rights
that should be protected:
1) The Privacy Directive requires the Member States to harmonize and ensure an equivalent level of protection of the right to privacy with respect to personal data in the
electronic communication sector. Regarding the confidentiality of communications,
the Privacy Directive says that EU member states shall ensure the confidentiality of
communications and the related data traffic through the national legislation. In particular, they shall prohibit listening, tapping, storage or other kinds of interception or
surveillance of communications and the related traffic data by persons other than
users, without the consent of the users concerned.
2) The Data Protection Directive prohibits the transfer of personal information to any
country that does not have adequate privacy laws. As a result, EU member states