On-line services and data protection and the protection of privacy : annex to the Annual Report 1998 of the Working Party established by Article 29 of Directive 95/46/EC; Volume I: Description of the general situation and case studies

This publication is the first part of a study carried out for the European Commission by ARETE, a Paris-based informatics cooperative, on the data protection problems raised in the context of on-line services and the information society. The study is composed of two major parts: the first is essentially factual. It seeks to present a global overview of the development of on-line services and to analyse the strategies of the different actors involved in the architecture of the network, in the light of data protection and privacy considerations. The second part is a collection of case studies which illustrate the various channels of data flows and the different types of personal data processing operations which are carried out in different places on the network. This study comprises two main parts: the first part is essentially descriptive and was drafted in early 1997; it provides an overall view of the development of on line services; analyses the strategies of operators involved at various levels in the network architecture (standardization organizations, software publishers, service designers and access providers) and the strategies of content providers; and it is concerned in particular with those operators who offer electronic commercial services to consumers at large, issues relating to the security of transactions and issues that can arise in different fields of application of Internet technology (press and magazines, medicine and pharmaceuticals, identification of individuals, games and pornography). This overview of technology and services is provided in the light of data protection and the protection of privacy, both as regards the issues raised by them and the protective provisions that are already in force. The second part of this document comprises a set of case studies of large-scale site operators of on line networks: DoubleClick, a new kind of New York advertising agency; a large daily newspaper, the New York Times On the Web; America On Line (AOL), the main service provider whose activities have been studied both in the United States and Europe; the 2"d World, a virtual world; and a large French store, Fnac, which is diversifying its distribution techniques via a site dedicated to electronic commerce. These sites were chosen with care; the main concern was to be able to use a sample of empirical data to show the various channels for the circulation of personal data that could exist and the various forms of processing to which they could be subject at various points in a network, and this set of companies satisfies these requirements fairly well. It was necessary to provide commercial and technical data relating to Internet strategies for each of these case studies; each case study then goes on to examine the procedures for collecting and processing personal data in different contexts and in view of particular purposes. Light is finally cast on the ways in which problems relating to the protection of privacy on these Internet sites have been or are being formulated.