La versione definitiva arriverà a fine mese, ma già circolano le bozze (http://goo.gl/W5hpx). A sostituire la direttiva (salvo che per la parte inerente l'ambito "police and criminal justice"), sarà però non una nuova direttiva, ma un regolamento (quindi immediatamente efficace in tutta l'Unione senza attuazione locale da parte di ogni singolo legislatore). Quest'ultimo, nel draft noto prevede la seguente norma: Article 15 Right to be forgotten and to erasure 1. The data subject shall have the right to obtain from the controller the erasure of personal data relating to them and the abstention from further dissemination of such data where: (a) the data are no longer necessary in relation to the purposes for which the data are collected or otherwise processed; or (b) the data subject withdraws consent on which the processing is based according to Article 5(1)(a), or when the storage period consented to has expired; or (c) the data subject objects to the processing of personal data pursuant to Article 17; or (d) their processing otherwise does not comply with this Regulation. This right shall apply especially in relation to personal data which are made available by the data subject while he or she was a child. 2. Where the controller referred to in paragraph 1 has made the data public, it shall in particular ensure the erasure of any public Internet link to, copy of, or replication of the personal data relating to the data subject contained in any publicly available communication service which allows or facilitates the search of or access to this personal data. 3. The controller shall carry out the erasure without delay, except to the extent that the retention of the personal data is necessary: (a) for exercising the right of freedom of expression in accordance with Article 79; or (b) for historical, statistical and scientific research purposes in accordance with Article 83; or (c) for compliance with a legal obligation to retain the data by Union or Member State law to which the controller is subject; this law shall meet an objective of public interest, respect the essence of the right to the protection of personal data and be proportionate to the legitimate aim pursued; or (d) in the cases referred to in paragraph 4. 4. Instead of erasure, the controller shall restrict processing of personal data where: (a) their accuracy is contested by the data subject, for a period enabling the controller to verify the accuracy of the data; (b) the controller no longer needs them for the accomplishment of its task but they have to be maintained for purposes of proof; (c) the processing is unlawful and the data subject opposes their erasure and requests the restriction of their use instead; (d) the data subject requests to transmit the personal data into another automated processing system in accordance with Article 16(2). 5. Personal data referred to in paragraph 4 may, with the exception of storage, only be processed for purposes of proof, or with the data subject's consent, or for the protection of the rights of another natural or legal person or for an objective of public interest. 6. Where processing of personal data is restricted pursuant to paragraph 4, the controller shall inform the data subject before lifting the restriction on processing. 7. The controller shall implement mechanisms to ensure that the time limits established for the erasure of personal data and for a periodic review of the need for the storage of the data are observed. 8. Where the erasure is carried out, the controller shall not otherwise process such personal data. 9. The Commission shall be empowered to adopt delegated acts in accordance with Article 86 for the purpose of further specifying: (a) the criteria and requirements for the application of paragraph 1 for specific sectors and in specific data processing situations; (b) the criteria for deleting public Internet links, copies or replications of personal data from publicly available communication service as referred to in paragraph 2; (c) the criteria and conditions as regards personal data identified for the purpose of restricting its processing as referred to in paragraph 4. La norma in questione pare meno critica rispetto alla versione del "right to be forgotten" divulgata nei discorsi ufficiali degli ultimi mesi. Risulta infatti collegata ai principi di finalità e liceità ed al consenso. In ogni caso trattasi di una posizione soggettiva diversa dal diritto all'oblio (http://goo.gl/u4InW). La norma poi rivela alcune criticità sia sotto il profilo tecnico ("it shall in particular ensure the erasure of any public Internet link to, copy of, or replication of the personal data relating to the data subject contained in any publicly available communication service which allows or facilitates the search of or access to this personal data"), sia sotto quello inerente i rapporti internazionali, nello specifico gli US e le loro imprese (dominanti nel trattamento dati connessi ad internet) paiono assai critici e distanti da una posizione simile). A giorni un breve commento sulla bozza di regolamento su http://www.medialaws.eu/. AM -- Avv. Alessandro Mantelero, PhD Confirmed Assistant Professor http://staff.polito.it/alessandro.mantelero Department of Production Systems and Business Economics Politecnico di Torino Corso Duca degli Abruzzi, 24 10129 Torino - Italy On Wed, 4 Jan 2012 13:07:46 +0100 Federico Guerrini <federicogue@gmail.com> wrote:
Questo mese la Commissione Europea dovrebbe presentare la proposta di revisione dellla direttiva del 1995 sulla protezione dei dati personali. In arrivo anche il diritto all'oblio?
http://www.publico.es/ciencias/414864/bruselas-contra-la-memoria-de-internet
Buona giornata,
Federico
-- www.federicoguerrini.com
Il mio ultimo libro: Vivere Social
http://www.bol.it/libri/Vivere-social.-Manuale/Federico-Guerrini/ea978889713... _______________________________________________ nexa mailing list nexa@server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa