The European Privacy Officers Network (EPON) meeting with
Italy’s Garante (Data Protection Commissioner), Professor Stafano Rodota,
Secretary General, Dr. Giovanni Buttarelli and their Senior Staff
Thursday, November 27th, 2003
Rome
Venue details will be provided to companies which register for the meeting.
Simultaneous translation will be provided. Priority booking for EPON full members.
Agenda
18.00h. Wednesday, November 26th: Drinks reception
Sponsored by Covington & Burling
Venue: Albergo del Senato, Piazza della Rotonda 73, 00186, Roma
19.30h. Dinner: A restaurant (to be announced): Not included in EPON registration fee
9.00h. Thursday, November 27th: Registration
9.30h. 1. Welcome and Introduction to EPON meeting
Melanie Shillito, JPMorgan Chase, EPON chair and
Stewart Dresner, Privacy Laws & Business, EPON secretariat
The format of the meeting is that each subject should be introduced by the Garante, the Secretary
General or a member of their senior staff, followed by questions and answers on that subject.
EPON members are also invited to make short statements on areas where they wish to share their
experience with other EPON members, the Garante, the Secretary General and their senior staff.
9.40h. 2. Garante’s role, structure and staffing
How are decisions taken? How to make formal and informal enquiries?
10.00h. 3. The Personal Data Protection Code - distributed in English in advance of the
meeting
See the code for the detailed provisions under each of the following sections:
3.1. General principles
3.2. Data subjects’ rights
3.3 General data processing rules
3.4 Additional rules applying to private sector organisations
3.5 The role of data controllers, data processors, and persons in charge of the processing
3.6 Data and system security
3.7 Notification and authorisation requests
11.0
Coffee
11.15
3.8 Transborder data flows in the EU, outside the EU and prohibited data transfers. View
of the Garante on the Binding Corporate Rules option
3.9 Data on Children
3.10 Processing of health data by companies provided as a service to clients
(if detailed discussion needed, this could be handled in a parallel session)
3.11 Genetic data
(if detailed discussion needed, this could be handled in a parallel session)
3.12 Employee data: Code of conduct, job advertisements, ban on distance monitoring,
telework and home-based work
3.13 Banking and financial services
13.00h. Lunch
Restaurant near to the meeting venue. Included in the EPON registration fee.
14.15. 3.14 Electronic Communications, Internet and electronic networks, videosurveillance
3.15 Direct marketing and Italy’s implementation of the EU E-communications Privacy
Directive – the implications for consumer marketing and business to business marketing
3.16 Administrative and judicial remedies available to data subjects, sanctions and
criminal offences, and civil suits for compensation
3.16.1 In what circumstances does the Garante investigate a company? Describe a typical
case.
3.16.2 Does the Garante conduct audits or have plans to do so? If so, how does the
Commissioner choose sectoral targets for audits? Is there a formal audit methodology? If
so, please describe it. If not, any plans to adopt a formal audit methodology so that
organisations will understand the Garante’s’s approach and what the audit team are
looking for?
3.16.3 Any change on policy toward prosecutions and fines? Prosecution trends in terms
of number and types of cases?
3.16.3 Policy on use of other approaches towards encouraging compliance, such as
arbitration, mediation, or codes of practice
16.00h. 4. European issues
4.1. EU Data Protection Directive: What are the views of the Garante on the European
Commission’s review of the EU Data Protection Directive?
4.2. Workers’ Personal Data? What are the views of the Garante on the EU’s proposed
framework directive on Workers’ Personal Data?
4.3. Article 29 Data Protection Working Party: Update on the work programme
4.4. Other: What else on the Garante’s agenda is relevant to multinational companies doing
business in Italy?
17.00h. Close
Note 1: Timings are approximate.
Note 2: EPON members wishing to put detailed questions to the Commissioner on issues not
covered on the above agenda should send them to Stewart Dresner, Chief Executive, Privacy
Laws & Business (stewart@privacylaws.com) by close of business on November 21st. This
deadline will enable him to group them and consolidate them, if necessary, and forward them to
the Garante and his staff to enable them to prepare a response.