The Civil Society Madrid Declaration

November 2009

Affirming that privacy is a fundamental human right set out in the Universal
Declaration of Human Rights, the International Covenant on Civil and
Political Rights, and other human rights instruments and national
constitutions;

Reminding the EU member countries of their obligations to enforce the
provisions of the 1995 Data Protection Directive and the 2002 Electronic
Communications Directive;

Reminding other OECD member countries of their obligations to uphold the
principles set out in the 1980 OECD Privacy Guidelines;

Reminding all countries of their obligations to safeguard the civil rights
of their citizens and residents under the provisions of their own national
constitutions and laws as well as the human rights instruments they have
ratified;

Anticipating the entry into force of provisions giving greater
Constitutional force to the rights to privacy and data protection in the
European Union;

Noting with alarm the growing expansion of secretive and unaccountable data
surveillance by both the public and private sector, as well as the growing
ties between domestic law enforcement and vendors of surveillance
technologies intended for the military;

Further noting that new strategies to pursue copyright and unlawful content
investigations pose substantial threats to communications privacy,
intellectual freedom, and due process of law;

Further noting the growing consolidation of Internet-based services and the
fact that some firms are currently acquiring vast amounts of personal data
without independent oversight;

Warning that privacy law and privacy institutions have failed to take
account of new surveillance practices, including behavioral targeting,
databases of DNA and other biometric identifiers, the merging of databases
between the public and private sector, and the particular risks to
vulnerable groups, including children, migrants, and minorities;

Warning that the failure to safeguard privacy jeopardizes associated
freedoms, including freedom of expression, freedom of assembly, freedom of
access to information and ultimately the stability of constitutional
democracies;

Civil Society takes the occasion of the 31st annual meeting of the
International Conference of Privacy and Data Protection Commissioners in
Madrid to:

(1) Reaffirm support for a global framework of Fair Information Practices
that places obligations on those who collect and process personal
information and gives rights to those whose personal information is
collected

(2) Reaffirm support for independent data protection authorities that make
determinations, in the context of a legal framework, transparently and
without commercial advantage or political influence

(3) Reaffirm support for genuine Privacy Enhancing Techniques that minimize
or eliminate the collection of personally identifiable information and for
meaningful Privacy Impact Assessments that require consideration of privacy
requirements

(4) Urge countries that have not ratified Council of Europe Convention
108 and the Protocol of 2001 to do so as expeditiously as possible

(5) Urge countries that have not yet established a comprehensive framework
for privacy protection and an independent data protection authority to do so
as expeditiously as possible

(6) Urge those countries that have established legal frameworks for privacy
protection to ensure effective implementation and enforcement and cooperate
at the international and regional level

(7) Urge countries to ensure that individuals are promptly notified when
their personal information is improperly disclosed or used in a manner
inconsistent with its collection

(8) Call for a moratorium on the development and implementation of new
systems of mass surveillance, including facial recognition, whole body
imaging, biometric identifiers, and embedded RFID tags, subject to a full
and transparent evaluation by independent authorities

(9) Recommend comprehensive research into the adequacy of techniques
that purport to deidentify data to determine whether in fact such methods
safeguard privacy

Call for the establishment of a new international framework for
privacy protection that is based on the rule of law, respect for fundamental
human rights, and support for democratic institutions

3 November 2009

Madrid, Spain