 We're going to start the session. First of all, I'd like to thank the organization and the technical team, their efforts to make this event possible. Now this afternoon we're going to discuss issues to do with data protection, legislation and regulation on the subject. We'll also touch upon technical issues like the limits and potentials. These are all essential matters when it comes to creating databases which might include delicate, sensitive information and there is discussion about how to proceed with these personal details. For this we have three experts on the matter and of course we have limited time. The idea for the session is that each of the speakers will have about 15 minutes and then I'm sure we'll have an interesting Q&A session at the end so that we can hear everybody's voice. So I'm going to give the floor first to Arish Raver. Let me introduce him. He's a lawyer, he's an expert on data protection, he's got a degree in law from the University of Cambridge in London, also studied a master's degree at Stanford. Through Mike Booth, he's responsible for data protection for many organizations amongst which advertising companies, biomedical companies, tourism companies or governmental organizations, universities, historical institutions amongst others. I'm sure he can tell us more about it. Ari also has several certifications on data protection and privacy and he's published in journals such as Oaks for Data Protection Journal or Journal of Data Protection Policies amongst others. Ari, whenever you want. Thank you. That's better. Thank you all very much. Thank you Celeste. I'd like to start with a little personal dimension. The man in the picture is my great-grandfather, his name was David Weinstock. He was taken to Buchenwald in September 1939. He was a denaturalized Polish citizen living in Austria, meaning he had lost his citizenship, he had it rescinded. His citizenship was taken away and together with 1,050 other Polish men living in Vienna, he was taken to Buchenwald. Of that group, 440 were taken to the Austrian Museum of Anthropology and there they were photographed and measured. And what you see here in the picture is his skull being measured. It's painful to look at, just to think of a dignified man, an educated man, a human. He's being measured here for posterity, for history, for pseudoscience. Why do I share this picture? Of the 440 men taken to the, it was actually in the stadium, that's where they were held while they were measured and photographed, 26 survived. So that's 5% of that group survived the Holocaust. He wasn't among them. He died two weeks after this picture was taken, he was murdered in Buchenwald. Now why do I mention this? First of all, I have some skin in the game. Memory and history and justice is live for me. My father is named for him. But more importantly, it goes to my first general point that I would like to make, and that is data that enables atrocity and that enables genocide and murder and imprisonment and all the terrible things that we're thinking about here today is also a part, often, as you all know, of the memory and the history and the justice and the healing. And what we see many times, the same data becomes a double-edged sword. It is used as part of their trustee, and it can be re-used, recaptured, re-owned, taken control of and used as part of the healing. This is very emotional for me, for my whole family, for a lot of people. He has about 300 descendants alive today. Okay, I'm not here to talk about healing. I'm here to talk about data protection, so I'm going to get to that. So the first point I want to make, and I'm going to elaborate on that presently, is the dual use of data. Okay, thank you. I'm happy to share the slides. Welcome to take pictures. I'm happy to share the slides with whoever's interested off to it. In 2016, maybe 2017, the Irish Data Protection Commission undertook a project to try and educate youth children about data protection. Why is it important? Children didn't really understand what that's about, what's privacy, what's data protection, who cares? And the Irish DPC, the Data Protection Commission, produced a brochure, a kind of material for teachers to teach in schools why is data protection important? This is one of the materials that they shared. It's a screenshot, as you can see, for those who can't read. How did the Holocaust occur on such a massive scale? How did the Nazi authorities know exactly who was Jewish? How were the Jews captured? How did the Third Reich identify popular Jewish residential areas? So they're presenting the importance of all these questions, and the answer is data. Excuse me, data. Now that's true in a sense. The fuller answer is because Dutch people delivered them, betrayed them, arrested them, put them in Dutch in Amersfoort and Westerbork, which were built by Dutch companies, on Dutch trains driven by Dutch drivers, Dutch police rounded up almost everyone, 89% of Dutch jury. But for now, it's very convenient, of course, to blame the data. That's what David Fraser calls masking. Dutch people didn't kill Dutch Jews. Even Germans didn't kill Dutch Jews. It was data that killed Dutch Jews, right? That's what this looks like. Okay, so it is scary. This educates Irish children about data. I get that. That makes sense. And of course, the most famous face of Dutch jury, probably the most famous victim of the Holocaust at all, is Anne Frank. The data cutting two ways, though, is, and this is kind of really a prefatory remark about why we have this tension between data protection and my colleagues here on the panel will be speaking later about the tension between forgetting and remembering. When we look at the data being systematically destroyed in the Holocaust, this was a part of the atrocity. Rudolf Hess, commandant of Auschwitz, details in his autobiographical, I don't know what to call it, autobiography diary before he was hanged, he details the systematic destruction of data after every big action to prevent memory, to prevent justice. They would systematically destroy all the data that they could. That's why it's so hard to get an exact number, or even something approximating an exact number of victims or their names. We heard from professor, from Alexander Mohammed Yad Vashem. Yad Vashem has today, I'll just give you the example of my own great-grandfather whom we saw a picture of. He has three entries in Yad Vashem as far as we can tell. It's impossible to triangulate names, it's impossible to triangulate data. We don't know. Another extreme example of the difficulty of justice and memory when there is no data, when the data is not reclaimed is Belzec. 600,000 people were murdered at Belzec, approximately. There were two survivors. Rudolf Redder was killed, murdered in 1946. Chaim Hilschmann was the only survivor who could testify at any trials for Belzec. And that's why Joseph Oberhauser, the commandant of Belzec, he was tried in the 1960s. There was one person, 600,000 people slaughtered. One person was ever convicted of anything there, and I was assisted to murder. So I'm going to finish this kind of chapter, this notion of data being a double-edged sword with this picture. I'll stay with Dutch Jewry for now. What you see here is the following. This is Carl Groger. He's in Wehrmacht uniform here, as you see. He was discovered to have been to be one quarter Jewish, so he was released from the Wehrmacht, and then he promptly became a Dutch resistance fighter. 27th of March, 1943, he and 11 friends from the resistance did this. What you see is a room in the Dutch municipality data section, the registry, the population registry, and they destroyed the room. You see, they burnt it, they firebombed it, and they actually paid off the firefighters to flood it, afterwards to ruin it, because Dutch Jewry was being slaughtered based on data. It was the easiest thing in the world to go and find Jews, because Jacob Lentz, the wrong story, whoever's interested, the registry was full and included details of who's Jewish, so the Germans didn't actually have to go looking for anyone, they just gave a list to the municipality and said deliver these people, and it was done. They bombed this room, and that was very effective, except it was not effective at all, because a few rooms down, there was a backup of everything. Yeah, it's almost funny, we tell our clients today, back up your data, everyone had back up your phone, it might get pig-pocketed, and then you'll start back up everything. The Germans were ahead of the curve, and in this case, the Dutch were ahead of the curve, they had everything backed up, so it was useless. The 12 of them were killed, including Carl, who is one of the few people in Wehrmacht uniform to be recognized by Yad Vashem as a righteous among the Gentiles, so fascinating story. Okay, time is short, so we're going to go on to the next point I want to make, which is justice and memory and the sensitivity with data, which I just tried to highlight in just a couple of minutes. I want to go to the second message here, which is, justice and memory should always trump data protection, and that's hard, and I'm going to justify it, and my third part is going to be to explain how we do that technically, legally, how that can be done, you know, GDPR, we've all heard of GDPR, how do we do that? For now I'm going to say justice and memory, I'm putting them together for now, because this is 15 minutes, not three hours, we're good on time. Okay, they always trump memory, they always have to trump privacy, and now this is a famous case, I presume most of you recognize this as being vaguely familiar, this is from Abu Ghraib, 2008, the American prison in Abu Ghraib, Iraq, there was a whistleblower who produced evidence that prisoners were being tortured unlawfully in Abu Ghraib, that in itself is terrible, there's a great movie, you should watch it. This is one of the pictures, this guy is actually a completely innocent Iraqi civilian, and what happened was the following, the whistleblower, a member of the US Armed Forces, produced evidence that this was going on and that was published, but then there were pictures, I think maybe 40 or so pictures, and the Department of Defense in the United States tried to block the publication of the pictures, the ACLU went to the, got all the way to the appeals court, said we have to publish them, that has to be known to the world. The Department of Defense said what about the privacy of the victims, what about this guy's privacy, to which the court said did he claim his privacy, he didn't claim his privacy, why are you claiming it for him? Don't claim it for him, let him claim his privacy, they made another very important point which is privacy, that's de minimis, there's an elephant in the room, okay, there's an elephant in the room, the elephant in the room is your torturing prisoners, innocent people, privacy is dwarfed, it's dwarfed by the issue here, and the issue is in this case unlawful torture, and third, they made an interesting point as well which is that it's, here they quoted Brandeis, I think I have a picture of Brandeis here, Louis Brandeis, he was the author of the most important law paper ever called the Right to Privacy in 1890, so he kind of invented with Warren, he invented privacy in the modern era, and he's also most famous for saying, he was actually quoting someone else that quote, sunlight is the best disinfectant, he was, he got to the Supreme Court in the United States, he was there for many years, and he was the champion of transparency, of letting everything out, he said that's what brings justice and that's what brings, that's what brings truth, truth brings justice, Louis Brandeis, really important guy, so he was quoted, now I'm going to put up some disturbing pictures here, okay, the court said to the Department of Defense, don't claim their privacy, but by the way, in 1945, when the American armed forces, you, the Department of Defense, liberated Buchenwald, you took pictures, and when you took pictures, you published them, so the whole world should see, and you were right to do that, and you weren't concerned for their privacy, because the issue was so big and so important, it trumped, it completely crushed, crushed any importance of privacy, this is a picture from Buchenwald, from liberation, on the day of liberation, this man is completely naked, and of course, the Department of Defense published this picture, because it doesn't matter, so we see him naked, this guy just spent years in concentration camps, you see he's actually taken off his trousers, he was even, he was dressed, he has taken off his clothes for the pictures, because it's so important to see how emaciated and starving he is, here on the left is a very, it's disturbing picture, you see naked ladies here, this is from the few very rare pictures that we have from the Sonderkommando in Auschwitz, 1944, we have pictures of women being walking towards the gas chamber, people died in order to be able to smuggle a camera in and out of the Sonderkommando division in Auschwitz, one of the few pictures that we have, these pictures are of epic importance for justice and memory and healing and truth, and data privacy is just completely unimportant in that context, that's the second, that's the second point I'd like to make, now last couple of minutes I just speak to the notion of how how do we get there with GDPR, I'm not sure that we're all GDPR practitioners, this is my specialization and that of others on the panel here as well, and I know that they'll be speaking to that a little too, so I'll focus just on one point here, which is, I'm going to suggest there's what's called the legitimate interest, article 61F for whoever's interested in GDPR says that where there's an interest in publishing what's called the legitimate interest in their cases, the regush case and others that explain what does a legitimate interest mean, so whoever really wants to get into the legalities and technicalities I'm happy to elaborate, I'll just say here for now, there is a legitimate interest in publishing this data, now this step, what I've just said now is kind of mind-blowing in some contexts and people some will not agree, many archives, many institutions, many many collections of important data found that impossible to believe, they feel that data has to be protected unless someone consents to the data being published, I argue and I have argued and I will continue to argue like the, in this case the American Supreme Court that that is dwarfed, the legitimate interest in, or the interest in protecting the privacy of individuals is dwarfed by the importance and the legitimate interest in publishing this information, now just to illustrate that a little, to me it's obvious, I assume that everyone in the room kind of agrees because we're here because we care about memory so that seems intuitive to us, to the Arleson Archives for tens of years this was not accepted at all for example and to this day we were just discussing before the panel, many institutions do not agree with it at all, so I'm gonna share some anecdotal evidence, I've discussed with the U.S. Holocaust Moral Museum, with Arleson Archives, with Yad Vashem, with Wiener Library in the UK, with many other institutions and I have anecdotally spoken with many Holocaust survivors, how would you feel about this data being published, about your records being published, about your photos being published, they have had zero complaints, Yad Vashem put its entire archive online, Arleson archive has gone 100% online, all of it is being put online, how many complaints do you think they've received? Not one, not one, no one cares, it's not that they don't care, let me take that back, they care very much that it should be published as widely and as extensively as possible, so I could demonstrate that, I had a quote here that no, I had a quote here that made, no I didn't, okay here, this is from Elie Wiesel, he needs no introduction and the sentence is a good one and with this I'm gonna end, the survivors wanted to communicate everything to the living, it is the legitimate interest of survivors, of their families, of heirs, of society as a whole that as much of this data should be published and as widely as possible, how exactly we do that I can get into the details with whoever's interested, with that I thank you. Thank you Wari, thank you. Now I'm going to give the floor to Antoni Gonzalez-Quintana and to introduce him, he is got a degree in history, degree in public economy and document, he's a member of the archivist of the state history, so general director of archives of the Obamatric community during the year 2010, 2018, previously amongst previous professional positions, he's been the head of the unit of coordination of military archives of the Ministry of Defense and the director of the civil war archive in Salamanca, he's a member of the executive world of directors of the International Council of Archives and he is also an associate teacher at the University of Salamanca and he's got, he's published several articles on the right to access to information amongst others, he's the author of the archivist policies for the defense of human rights and he's also the co-author and co-editor of archives and human rights published in rollets last year, you have the floor. Thank you, good afternoon. I am very happy to participate in this meeting and I have to be thankful to the observatory of European Policies of Memories and the University of Lonay and the Secretary of State of Democratic Memory for having invited me to participate here, to speak into the microphone because a bit even more, okay, good, thank you. The right to truth and the right to knowing on the one hand and respect to the privacy, private life on the other, in that apparent dichotomy we can summarize a conflict that is present and that has been present for many years in the daily practice of a documentalist work, the work that we are facing from the need of combining the right to access to information with the data protection, a collision between two fundamental rights and gathered in the universal statement of human rights, article 19, freedom of expression and therefore the freedom to ask for and receive correct information, true information, also article number 12, respect to the private life of people inviolability of male correspondence that would be further expanded to go beyond postal correspondence and to include email. Archivists and documentalists that have worked with materials related relative to the recent past, traumatic past, historic memory, well we always liked article number 19 versus number 12. We understood that the data protection was an obstacle in the multiple obstacles that we had observed during our lives to have access to information about the systematic violation of human rights in Spain and that the very same perception exists in countries that have had a similar transition to ours, two hours in that ensemble of obstacles the appearance of law of data protection of personal character of 1999 remembered when this protection was expanded to the whole life of people well that meant a total collapse of our famous article of a historic heritage and that meant that if the person was a public person you could not publish any information for the for 20 years after he or she was dead but now we can skip that hurdle the so-called right to forgiveness for to oblivion many archivists interpreted mainly in Spain as the final hit to have full access to information for the knowledge of truth we now can eliminate the documents alacard because article 17 talks about the data suppression the elimination of data quote-unquote the right to forget or to forgetting or the right to oblivion corresponds to or the right to be forgotten in english which is not one thing is the right to be forgotten the other is the right to forget which is completely different i want to forget that i belonged to falange espanol and i was a candidate as someone pretended to to do is not a joke it's a real example which is which was the belong to the fascist party i will try to present the apparent dichotomy if we analyze this totally and seriously both rights can be totally compatible and the european legislation which is an advancing human rights does not involve what some intend to see the capacity of showing personal biography alacard forgetting what i want to forget about whatever i want to be known about myself and then strengthening the positive aspects of my uh cv the evolution of article number 12 of the universal statement of human rights talking about the respect to human and private human life is further expanded in the international framework of human rights i would start by talking about the terra conference that took place in 1968 20 years after the approval of the universal statement of human rights declaration of human rights to make a balance of these 20 past years and also to observe new challenges in for the future in the protection of human rights and one of the challenges is precisely the right to limit the use of technologies or in the intervention so that the use of technologies which were you know beginning to appear in the by the end of 1960s could so that this technology could not be used against human rights okay the the end of that movement that started in terra was the general regulation of data protection of the european union of the year 2016 that was enacted in the year 2018 and we should understand it as such we should limit the use the capacity that new technologies have to go against citizens with yeah with evidence through evidencing their own data with paraplegic police or police activities in that respect i believe this is a real advance the european regulation and to simplify that we don't have such a contradiction i would speak of louis joanné was the father of the first reports that were appeared in the un and in the conference of terra one speaking about limiting the use of computers in the access of personal information that can use against people and he prepared a report in 1983 about this but he's the father of 90 in 1978 of the french legislation about freedom of computer science and the access of information in in his country with a law of 1978 between 78 and 1980 in france several very important laws were created affecting the access of to information and the protection of personal data versus the computer abuse louis joanné was also the reporter about the right to truth the right to to knowing and the struggle against impunity the principle is called louis joanné to fight against impunity are essential in the promotion of knowledge of truth and are the first official document of a body of a rapporteur of the union of the union speaking about the importance of keeping records and using the records to know the truth and to know what happened with my relative my friend with my father my mother which was a generalized demand knowing the truth in societies that were traumatized particularly by these events i believe that joanné having been the rapporteur of the union for the struggle against impunity and having been the rapporteur of the union against the abuse of computers in the use of personal data exemplifies that these are two perfectly compatible rights that add on not to subtract and they are sometimes facing one with the other maybe in the sphere of societies that had a traumatic past maybe we will have to underscore the fact of of you know the fight to have access to information while relegating the aspect of of data personal the access to personal data protection but we have to rescue the names of the victims of repression and the violations of human rights as arie mentioned just a few minutes ago very particularly in the case of forceful disappearance of the people who were killed and buried in a common graves with no identification whatsoever have been demanded that my name is not erased from history this is sentenced was gathered a of the letter written by julio conesa just before she was executed in madrid that was used as the title of a documentary and as the motto of the 13 roses and the 13 young communist women that were shot to death in the almodena cemetery in the post-war period so that their names cannot be erased from history that was a revocation that my name is not lost in history that is the motto of the project called all the names proposed by the creation proposing a creation of a database of people who suffered the effects of a friend caused dictatorship in the north of africa in spain in the year 2001 and similar expressions can be found in countries that suffered or went through similar situations after in 1954 and in the javasen museum that we heard so much about guided us to try to find the names of the victims of the holocaust and the dissemination of these names of crimes of lesser humanity has characterized the public policies of memory the hall of the names of javasen with over four million testimonies are a clear proof of this and the wall of the names in villa grimaldi in argentina well i'm sorry in chili paying how much the people that were retained killed or arrested through the torture of that clandestine center 241 names of the people that died there one of the goals of the numerous commissions of the truth in latin america generally was in the clearance there is example are the shambales commissions in chili is to build a complete list of all victims silvia mentioned it this morning this has been the goal they have in argentina followed by sabato paying how much to them creating a single registry in columbia with over a million and a half names is one of the goals for the piece and that was present in the law of victims and the restitution of land in of the year 2011 all the names is the portal as i said all the the lucian association working to achieve recognition and so the ministry of culture created the portal of victims of the several war in spain with multiple lists of victims in essence to give to shed some light to these names is considered something positive that victims wanted as we could here in the previous intervention i would like to use this opportunity that i have to mention the importance of institutions such as memorial in russia that was the beneficiary of the a Nobel prize of peace of the year 2018 together with alex biecksky from balleros and the centuries of civil freedom in ukraine a memorial that recuperate the names of people i think that by the Stalinist repression the repression of communism this is the clearest example of an aggression to the archives of an NGO in the last years from the russian government this institution was prosecuted and has been limited in all its actions well the attitude of the of legislatures in europe after the tera and conference on data protection well ends with the article that i was used to to finish my intervention the reaction of archivists considering the right to be forgotten in europe is extraordinary when the year 2012 the first draft of this european regulation of data protection was presented and the french archivist realized that there is an article that speaks about the possibility of eliminating the names and personal data at the request of those that were interested well said that it was impossible because they thought that we could eliminate from history practically all the data that people wanted to voluntarily array arrays and the erection of archivists in these two associations you can see on the screen and that we will see now the french association of archivists and the national association for archivists of italy echoing the recommendations that the international association of archives made as we could see in the previous slide if you could analyze it in its basic principles on access in its ethical code from Beijing and the basic and several of principles about the role of archivists in the defense of human rights considering the protection of privacy and also the free access tried to balance both issues the mobilization of archivists remember a campaign in change.org that got over 150 000 signatures mobilized the french authorities that asked in the european council of national directors of archives they called a meeting to express a joint position and that action that lobby that was created achieved the approval of the archivistic exception which i believe is extremely important the regulation of data protection of the european union in fact in its article number 17 states that those that are interested will have the right to eliminate the data they consider under the following circumstances data that are not necessary the interest withdraws his or her consent and the treatment is not according to the regulation but finally that very same regulation introduces the exception the archivistic exception which presents the fact that as we can see in the next slide chapters one and two of article 17 that i just read and they will not be implemented when the treatment is necessary for public interest and scientific or historical research or statistical work according to article 1891 which presents how we have to do all this work but i let me let me point out it 1158 which gathers to the principles that are very important the right to archiving and the possibility of knowing the truth of severe violations of human rights that element that that whereas should be also applied to personally considering that it should not be implemented on people dead people public or private organizations that manage documents of interest have to be services that are forced according to the rules of the european you need to maintain the value and organize describes communicate promote and disseminate documents of durable interest while facilitating access to these documents this is what i call the duty of archivists this is the obligation of states to make these documents accessible about on the second paragraph in states that the member states also have to be authorized to establish the further treatment of personal data in order to use them in the archival practice to know this passive behavior on their totalitarian states and political well not only victim census but also the possible the possibility of creating a list of perpetrators we've seen that in poland in romania in other countries mainly those that use the archives of the state security with a greater capacity or the greater severity i believe that the debate about the right to be forgotten if we analyze the rules makes not very much sense unless the famous sentence of google against spain or spain against google i'm sorry i'll hear more about this and this was implemented right before the regulation had been approved in the year 2000 i'm sorry 2019 the right to be forgotten was used differently so eliminating from information about a person from internet that he disappears from the lists when googling it or when using other search drives which is not exactly the same as we analyzed with respect to article number 17 the right to elimination of data and this is something that really worries me let me finish by quickly saying that all the element of suppression in google there's the form and the data the data suppression agency also offers another form that you can use to to request the erasing of that information from the search engines google or any other search engine can do that and this is allowing a business that poses some ethical considerations here i have a quick search two websites in spain the first one google clean let's say it's change your future leave the president without being conditioned by your past the other is we erase you we erase it dot yes tevorobos dot yes we erase your google results disappearing from the internet is your right and i'll stop here thank you thank you very much thank you antonio and thank you antonio and now give the floor to jesus ruby navarrete who's a lawyer he's the department of law the ministry of justice he's also been a member in the court for competition between 99 and 2002 he was deputy for the head of data protection of spain and general sub directorate for data protection for the same institution he is now working on institutional relations for the spanish data protection agency he's also offered several articles on administrative procedure procedures and data protection he works at different spanish universities and he works at international projects in cooperation with other european and world authorities for example in the cheque republic vulgaria israel croatia etc whenever you want so thank you thank you for your invitation this is a thrilling subject democratic memory from the point of view of data protection the law on democratic memory is an absolute innovation within the gdpr which has already been mentioned why because the gdpr demands that the rules on processing private data means that they have to analyze that content in order to treat it to process it which means that the reports of the spanish authorities of data protection emanda there is an article or an added clause which contemplates the provisions of the rule and translates it into the categories of the gdpr identifying who is responsible for processing data what for what are the legal foundations how can rights be exercised whether there are limitations etc the first law which incorporates a clause on this has been precisely the law of democratic memory i cooperated with the ministry for presidency to work on this clause because they had no idea but none really this is a clause which is uh fascinating and it gives us legal precedent and it responds to many of the risks and implications that have been mentioned when talking about the gdpr this tends added clause to the law well there is a very simple way of saying that the gdpr needs to be complied with and it says in all of this the gdpr will be applied but this contributes no legal certainty and no clarification on the practical consequences of each of the rules and which are very varied so in this law there was this exercise of actually developing the whole thing so general references made saying yeah the gdpr needs to be complied with and then they analyze the implications of the gdpr on all that is established in this norm so there is this added clause which is really long and it starts by analyzing the registry of victims they identify the goal of the processing which is to handle the public policies of moral reparation and the recuperation of the memory of the victims which allows for wide processing of the data they identify the processor and the person responsible for the processing which has been identified not for this law but before so public interest for archive purposes or statistic goals this is one of the legal basis and the public policies for the recognition of victims and reparation and no repetition of these circumstances so there is a clear identification so there is a clear identification of the legal basis and they identify how data processing can be done according to this legislation then there is legal habilitation for the publication of data for historical and scientific research and there is a principle of data minimization and description of the data which is to be processed there was somebody who's who went to court saying asking for his right to be forgotten and his right was denied in this case precisely for this for public interest linked to the legislation of archival use and then talking about sources they mentioned the different sources where data can be obtained they cover the obligation of the processors of all these data they have the obligation of making sure the data is accurate in compliance with the peculiarities and specificities and restrictions of the sectorial regulation of archival data which is a specific regulation within the GDPR there is a demand to facilitate information on private details compliant with articles 13 and 14 of GDPR article 13 is the information provided when data is obtained directly from somebody which is very simple to provide information and 14 when they are not obtained directly from the person in order to facilitate compliance with article 14 they enumerate the measures that are suitable to facilitate this non-personalized information when it is not nominal it is information which appears on a website or something where you can obtain that information and then on data preservation once again the specific law is applied which is the Spanish historical heritage law as for safety measures just as for anything else to do with public administration this is the general safety diagram which is applied the GDPR does not contemplate the exercise of this right by relatives of the deceased by national institutions can and Spanish legislation actually says that some relatives in some circumstances can exercise these rights and in particular in these regulation they limit the exercise of the right to be forgotten to facilitate the rules that we mentioned before in order to guarantee public interest the right of the victims and the right of society in general for rehabilitation and the rights of the victims so data protection regulation is not applied to the victims for this then there is also a mention of the victim's census in article 23 and four nine two and three they established the legal basis for processing then it says that it is basically public interest in order to do scientific statistic and historic research for everything covered under the law the recognition of victims and recovery of historic memory so it is a social function it's not even linked to the people directly related to victims public access is established and the person in charge of processing apparently it wasn't clear time who which ministry was going to be and it said just the ministry who has the competence on the matter and on the exercise of right to be forgotten the same procedures as before as for the dna data bank they also identify the person in charge of the processing which is the national institute for toxicology and forensic science legal basis public interest for historic research and and uh quests for disappeared people the goal of the treatment and the goal of processing of data processing is to receive and store dna profiles to compare them with the genetic identification of the big teams and in order to do that cross-referencing of data the minimum possible data has to be used to obtain an efficient cross-reference so biological samples from relatives is specifically admitted the legal foundation in this case is different this is informed consent it is the relatives who themselves who had to consent to have in dna samples taken for this cross-referencing processing data processing goal is the same as before and preservation there is no time limit it is indefinite as long as it takes to carry out the required procedures this is a very generic description of the purpose there is no time limit data can be preserved widely as long as it takes and as for data session they identify who can see the data the labs here the legal foundation is not public interest but something which is reinforced which is the compliance with legal obligation you have you need to have this fiscal identification and the exercise of rights is in compliance with gdpr in this case also taken into account historical heritage requirements so this is the first additional clause which is truly innovative because it describes all the implications of the gdpr the data which is to be processed the who is going to process it what for in a particular matter which is very delicate and which contains sensitive information and which has to serve as a model and as an example so that these added clauses can be widely incorporated to gdpr but as a conclusion let me finish by saying that in this case the right to be forgotten from the google ruling is absolutely redundant it is not relevant because this is right to be forgotten what we call the right to be suppressed for the suppression of links to have access to websites where there might be personal information through searches based on the person's name only without eliminating the information on the websites and allowing the search engine to be used with other search criteria other than the name but this is not to the point for this because this is absolutely something completely different this is not to do with the google ruling which also has limitations for public interest but it is completely different from what we are discussing here with these databases and with this i finish thank you thank you jesus let me once again repeat my thanks to the speakers for being so clear and so respectful with your time management we do have some minutes for questions from the audience so the floor is open we want to hear you ah well first of all congratulations this is a very complicated subject and nevertheless your passion has been clear most inspiring today we are at the model prison in bafalana in this prison there were many victims of dictatorship or repression many of the victims i don't know whether we have anybody here from the catalan association of political prisoners they were here with us this morning i don't know if they're still around but some of them who were victims of the dictatorship they're still alive therefore my question is for jesus and for harry so what happens with the recently approved law of democratic memory in relation to the victims who are still alive but they are victims of the dictatorship can we or can we not publish their names this is a question for jesus for the law that has been passed and my other question is for harry i'd like to know your opinion harry about what should be done with the rights of these victims we're still alive thank you let's cover a few couple of more questions i think there were other hands yes thank you thank you for your presentations i was saying this morning that when we research into sexual dissidents so repression we looked into for a spanish law that was used to attack homosexuals then in the register in the canary islands where we have the court cases for people who were taken to court under that law there is quite quite open access to those files you can really go all the way to 78 1978 that's in the canary islands whereas in valencia in another part of spain all the files are anonymized all the personal details are removed and there are some access limitations as well there are other cases in spain for example in bilbao where access is directly forbidden so there is huge discrepancy between archives in spain and supposedly we're all compliant with the same regulation so i don't know whether these added clauses we can give us wider access also bearing in mind that we researchers we're not going to name names we're just going to take data information about how homosexual people were repressed for example so i want to know how this new legislation can give us wider access to archives and registers i mean do we need specific regulation to give us simpler more open access precisely to fight for historical truth perhaps putting truth before privacy as we heard before any further questions if i may because i need to catch a train at 6 25 less than an hour i'm i'm really sorry because i was i was late but i was told that i had to go to the university which is where you were yesterday so i went to the wrong place i mean luckily there was another meeting there and somebody looked at me and said hey you shouldn't be here and then wow i found out that i should have been here so i got here late and i apologize and i'm going to have to leave early and i apologize for that but at any rate please let me give my comments um this new law has a wide array covers different types of data and for different purposes as i have mentioned it is to do with the law on archive and documentation it is those specific rules which take priority over the rules that appear on the gdpr so within that you can definitely have access to all that information by virtue of that added clause now about that frankest law idler san melphisans there is actually a restrictive added clause that said that you cannot gain access to information on that but that was something that happened in 1991-92 so that's completely different from the current situation right now the legal categories that have to be applied are purely those that come from the gdpr with the adaptations which is the true gdpr in the european union i mean the new one for it data that's not the one i mean i mean it's the spanish adaptation of it so we have to apply the categories that come from the gdpr for this as we can see in this law of historical memory which is a controversial law yeah we all know that but from the point of view of data protection it's quite complex and it was difficult for us to uh fit things in and to make sure that we covered all the implications bearing in mind the kind of data that was going to be revealed and who could have access and blah blah so this added clause opens new possibilities related to data processing for let me give you the right word data processing for i wanted to share it with you i can't oh here you are data processing with quite a wide range of purposes it says public interest in historical research which is what you are talking about also historical uh statistic purposes and the recognition of victims and recovery of memory but there are there's also hang on it says uh purpose of the data processing to gather victims data in all those in order to manage public policies for moral preparation and recovery of the victims memory so this is really wide i mean you cannot put everything in this but it's a wide array of uh purposes and it is adapted to the historical purpose of the regulation and it makes it possible to gain access to the data and also to verify it so i don't understand why there should be specific limitations within the law and within everything that is established in the clauses i i don't see why there should be any more limitations to gain access to data for cases to do with the law of idlers and malfeasance and with this i'm going to beat you very well and uh thank you no problem thank you for your effort this has truly been treat for you yeah i do apologize i'm going to teach lorne to antonio and then to ari so that they can answer the first chance to give us their final comments so apart from jesus's comments i'd like to be a little bit less optimistic about our possibility to gain access to those files files for those idlers and malfeasance you mentioned before that the ticket the new law of democratic memory in the three articles the files it just says yeah everything will be accessible yeah it will be open yeah for everybody but those generic statements i'm not quite convinced by them because also in 2007 the historical memory law also said yeah now everything to do with the civil war will be open according to current regulation yeah but that is it we have you know current regulation so this is limited to state held data not under state level health data so that to start with and then even with this application of historical heritage law we have problems and i think many archives would still hold on to the personal data protection law and gdpr they would still close the doors on those files at least for as long as the people involved so i'm really sorry but i think that's how it's going to be there is a final clause number eight on the historical memory law that tries to save the day but i'm quite skeptical on whether we are going to be able to implement that final clause number eight says that section c point one article 57 of the historical memory law in spain which is the one that is discussing that article that section c says that documents which are to do with people's privacy will be opened 25 years after people's deaths for 50 years after the emergence of the document and the new clause says that yeah no no section c we're going to forget it if we're talking about historical archives and that's the clue historical what is a historical archive if we don't even have a state common definition of a historical archive that's why archivists associations and memory institutions associations have presented a series of amendments to the law and we wanted to have all the funds interrelated and to have all the information from the law of ideas and malfeasance and more trials to have everything covered not just to have a common census for everything because i'll be useless but also because if you have a census you have to say that everything is everything that's in that census can be open to everybody or else what's the point if you're just going to say that it is just going to be to digitize it and post it on internet well come off it i've been hearing that for 40 years that's just not going to happen thank you arie thank you um a couple of comments that address both these questions uh juror thank you first um the the the discrepancies and the wide variation of the way different institutions are going i'm just prefatory remark i'll try not to repeat anything that was said here before and just add to it um the the the wide discrepancy between the way the different institutions will relate to data protection risks arises i think in large part uh because of different risk tolerance different approaches and and how willing they are to take a risk the culture of the organization so if you look at how the u.s holocaust memorial museum works for example they have um how do we say thoracis they they're not scared of anyone they have unlimited budget they're they're very bold they've been very very bold and they have uh they have very powerful kind of lobbying um strength behind them just as an illustration where yad vashem in israel is for example is um is backed by law which as antonio discussed that actually changes its status and therefore they can be very very bold right who's going to sue that if someone wanted to they could try but they can be very bold so a certain cultural shift has to occur among the different organizations they have to go from feeling oh we're holding very precious uh delicate personal data which which we have to be scared of being sued and uh around gdpr there's been a lot of fear mongering a lot of uh fear development uh it's good for business 20 million euros four percent of revenues criminal uh sanctions okay forget all of that uh we had a representative of the a pd here before but the fines are reserved basically for like google and facebook and you know uh big actors in bad faith there's there's been almost there's been very little in terms of fines and enforcement against institutions acting in good faith so there has to be a bit of a cultural shift among organizations they have to be less afraid and have to be willing to take a little risk and so now i'll go to kind of practical steps you say what could be done with the data of people who are still alive so many holocaust victims are still alive and a lot of their data is being put out there here's here's my suggestion something to this isn't legal advice let's say we can okay here's a suggestion a thought exercise if we're looking at gdpr specifically because i'm not going to comment on the spanish law you have six one f which is a legitimate interest and when you publish data based on the legitimate interest you balance the legitimate interest in publication which in this case as we heard is institutional it's national it's a lot of very important values on one side and on the other side we have a person who is alive and what is that what is the harm in his in publishing the data so i said as far as i can tell in the case of the holocaust there's there's no question in you know 99.999 percent of cases there's an interest in publishing the data i will give you an illustration one or two cases that i've heard of in which people wanted data taken down okay i know of a holocaust survivor who was afraid of holocaust deniers and neo-nazis in northern england and he asked for his testimony to be taken offline okay but not erased and not deleted just taken offline um i know of a case of the family not the survivor the family of a survivor the descendants of a survivor tragic story she was raped by russian soldiers after liberation and that was in her testimony iad vashem from the 50s 60s and when it was published online they asked for it to be taken offline now these are good illustrations of where in that balancing game suddenly you discover that there's something on the side of of of publication that is very harmful for the uh let's say for argument's sake for the person themselves for the data subject so if you have some kind of takedown mechanism something to say well in 99.99 of cases the interest is in publication but actually in this specific case we we ought not to publish we need to take it down so be sensitive and take it down so now i'll give you two more illustrations that i'm aware of from holocaust research one involves a doctor in new york who was part of the team reviewing holocaust survivor claims and when he passed away all his files were were given to a holocaust research institution now that included a lot of very personal details about psychiatric harm about physical harm to holocaust survivors if that would have been published that would be very very sensitive data it's not this person was in buchenwald in these years it's much more sensitive than that it's the you know personal ramifications for their you know bodies and souls another example is very similar to what you were discussing is a database of people that nazis germans had put in camps for on suspicion of being homosexual that was also kind of recovered and now he had a question can we publish it so the outcome would be that i don't know let's just say for given sake 10 000 people 10 000 people who are suspected by the nazis of being homosexuals are now basically outed okay some of them may have been homosexual some may not be some may be already out of the closet so to speak some may not be but is it right for holocaust research institution to publish such data okay it may be in this case we're looking at something that flips the other way but in general now how would you find how would you prove that the general case is you know uh 99.999 you know one in 10 000 cases is is is inverted but the other uh the other cases are all in favor of publication you could do a survey so if you know that you have say 10 000 victims alive that you want to you know survey survey them survey a hundred of them go ask them a phone call i don't know i don't know how you do a you know good survey of that kind ask them and then you have evidence that 99 percent maybe it's 99 put 9 percent whatever it is i'm in favor of publication well i'm done i can i can go on forever okay so i think that's a way to actually to prove that you have a legitimate interest and document it and with that you can also change culture now can i i'm gonna add one comment okay i'm gonna use that minute to say the following thing i suggested this years ago um maybe hence banal be taken up pull the risk okay if you have a few institutions who are doing this put a few million euro in a pool somewhere okay maybe have the government uh i don't know who it is someone should indemnify the institutions taking a risk what is going to happen what's the worst that can happen someone sues for saying oh i i was put in a panopticon uh in in in la modella i i was incarcerated there for x months and and you published it and i didn't want anyone to know okay let's do a little thought exercise go to some lawyers and say what is our liability here what is the damage what can someone sue me for i don't know was it five thousand euros ten thousand euros a hundred thousand euros how many of those are there there's a hundred of them okay now we know what our risk is we can pull our risk and we can take the risk together and we can we can quantify it and now we change our our attitude we say okay we have our insurance and we have indemnification or we have whatever we need is pulled now we know what our risk is now we can publish it online and see what happens we don't have to publish everything we can start with a bit okay done