59
Проблемы и перспективы правового регулирования цифрового профилирования
ПРОБЛЕМЫ И ПЕРСПЕКТИВЫ ПРАВОВОГО
РЕГУЛИРОВАНИЯ ЦИФРОВОГО ПРОФИЛИРОВАНИЯ
Alain Duflot,
почетный консул Гватемалы,
практик международного класса в области права,
основатель адвокатского бюро «Дюфло и Партнеры»,
Университет Леон III имени Жана Мулена
DIGITAL IDENTITY AND ITS PROTECTION IN FRANCE
Abstract.
Digital technologies have opened up new perspectives, freeing a person
from the limitations of reality, allowing him to create an identity for his personal
development. Thus, technological advances have increased a person’s ability to change
his personality in the virtual space, form a digital profile, digital personality, etc. The
article discusses the legal aspects of a digital person and a digital personality. At the
same time, special attention is paid to the issues of digital identity, considered as a part
(continuation) of individual identity, the problem of digital identification and the means
of its legal protection and protection, which are constantly evolving.
Keywords
:
Digital identification (identity), Digital identity, Digital person, Law,
Legal protection, Legal protection.
ЦИФРОВАЯ ИДЕНТИФИКАЦИЯ И ЕЕ ЗАЩИТА ВО ФРАНЦИИ
Аннотация:
Цифровые технологии открыли новые перспективы, освободив
человека от ограничений реальности, позволив ему создать идентичность в целях
своего личного развития. Тем самым, технологические достижения увеличили
возможности человека по изменению своей личности в виртуальном пространстве,
формированию цифрового профиля, цифровой личности и др. В статье рассматри-
ваются юридические аспекты цифрового человека и цифровой личности. При этом
особое внимание уделяется вопросам цифровой идентичности, рассматриваемой
как часть (продолжение) индивидуальной идентичности, проблеме цифровой
идентификации и средствам ее юридической охраны и защиты, которые постоянно
развиваются.
Ключевые слова
: цифровая идентификация (идентичность), цифровая лич-
ность, цифровой человек, право, юридическая охрана, юридическая защита.
Digital identity is and remains an elusive and above all constantly evolving concept for
the law. There is currently no satisfactory legal definition of digital identity to understand
the richness of the concept, indeed, the few legislative or regulatory texts that refer to
digital identity ultimately deal only with the notion of «personal data», and only with this
notion. For example, the French law called «Law for a Digital Republic» of 7 October 2016
is limited in its final version to linking this concept to that of the «digital safe», without
60
Проблемы и перспективы правового регулирования цифрового профилирования
providing the precise contours of this identity. The evolution of digital techniques and
their integration into positive law goes beyond the sole question of digital identity or more
precisely digital identity leads to the recognition of a true digital personality. (I) Given
the challenges of the digital revolution, the need to guarantee the protection of digital
identity conditions the trust of the economic and social relations that are developing in
the digital sphere. Among these guarantees of protection, three bodies of law stand out.
First of all, there is the protection of personal data, then banking secrecy which is an
interesting and recognized element of the protection of the identity of customers and
third parties and finally criminal law with the crime of digital identity theft. Given the
limited time allotted to me today and which I am desperately trying to respect, but also
and above all the general theme of banking law of our conference, I will limit myself to
mentioning in a second part the role of the banking system in the protection of identity
and digital personality thanks in particular to banking secrecy (II).
First of all about identity and digital personality Digital identity and personality
Legal identity, defined as the set of elements that the legislator takes into account to
individualize a person, is mainly suffered by the subject; however, some aspects are
under his control. Since the digital person is part of the concept of a legal person,
digital
identity cannot be radically different from legal identity.
1. The digital identity suffered by the individual Legal identity has traditionally
been designed in relation to the civilian police function assigned to it. Each person is
identified and individualized on the basis of biological and social characteristics, the list
of which varies from country to country.
According to French law, the composition of the status of persons is mainly a matter
of civil and family status transcribed within the acts of civil status. As such, we will
mention, the first name, surname, sex, date and place of birth, domicile. Although some
of the above elements are in fact subject to change, the stability of identity is a necessity
in that it conditions the certification of the legal existence of a person in the social group,
thus making it possible to control individuals and secure legal trade. Based on these brief
observations, what about digital identity? If we refer to positive law, digital identity is
implicitly enshrined in the protection conferred on it by special laws such as Article 4, 1
of the GDPR GENERAL DATA PROTECTION REGULATION (EU) (from which it is
inferred that a natural person is digitally identified from an «identifier, such as a name, an
identification number, location data, an online identifier, or one or more elements specific
to its physical, physiological, genetic, mental, economic, cultural or social identity» Is
this enough to deduce that the state of people exists in a numerical form?
First, in comparison with the function of identifying the status of persons, it should
be noted that there are electronic identification procedures based on elements of identity
traditionally included in the state of persons. First of all, it is important to mention the
Regulation of the European Parliament of 23 July 2014 on electronic identification and
trust services for electronic transactions in the internal market (EIDAS). Designed to
secure electronic transactions, this regulation established an electronic identification regime
«consisting in the use of personal identification data in an electronic form unequivocally
representing a natural or legal person». Second, from the perspective of a control of
individuals that the digital state of people is being consecrated. In positive law, on the
61
Проблемы и перспективы правового регулирования цифрового профилирования
one hand, the control can be carried out on the basis of identity documents incorporating
digitized data. This is the case for the passport since biometric elements are integrated into
it, a real «electronic passport». In the near future, this will be the case when Regulation
2019/1157 of the European Parliament and of the Council of 20 June 2019 is transposed
into national law, in particular, by adding biometric personal identification data to identity
cards’. For both the passport and the digital identity card, the control of the identity from
a digital title corroborates the idea of a certification specific to the state of the persons
Beyond the state of people, digital identity encourages reflection on the identification
elements freely determined by the subject and no longer suffered.
Digital identity mastered.
The emergence of a right to personal development as
a component of the right to privacy has resulted in a progressive mastery of the subject over
certain elements of one’s identity. One thinks, for example, of surnames and first names,
which, although conceived as fundamental elements of the state of persons, are liable to
be modified by the person himself. In the same sense, the terms relating to sex can be
changed according to a simplified procedure since the French law of 18 November 2016.
This margin of intervention left to individuals in the construction of their individual identity
also manifests itself with digital identity. Technological developments have increased the
possibility for the individual to modify his identity by the use of a pseudonym, its use is
widespread in virtual spaces. In the same logic, the subject modifies his image by the media
of digital filters, shapes his profile on social networks according to the target audience and,
when this trend reaches its climax, creates an identity from scratch by using an avatar, in
other words a character virtually representing the subject. In short, digital technology has
opened up new perspectives by detaching the person from the constraints of reality, to
enable him to build an identity at the service of his personal development. This reunion
between the digital identity suffered by the individual and the controlled digital identity
must make it possible to recognize the existence of a true digital personality that will be
an extension or manifestation of the traditional legal personality.
Digital personality.
Legal personality essentially consists of the ability of the subject
to have rights and to be bound by legal obligations. The digital personality should follow
the same destiny as the legal personality of which it is the digital expression. The existence
of the digital personality.
The existence of legal personality presupposes demonstrated both the ability to
have rights and the ability to be bound by obligations. As regards, first, the ability to
have rights, it is possible to confirm what is initially only a hypothesis by studying the
multiplication of subjective rights governing digital uses. The personal data regime is
the best-known illustration of this. Without taking over the entirety of the positive law,
the data are protected and their use is conditioned, in particular because of the need for
consent that can be withdrawn at any time. The person thus has a right of access to personal
data, «rectification», «erasure», «limitation of processing», «data portability», opposition
to data processing. With regard, secondly, to the ability to be bound by obligations, it
should be recalled that the French Civil Code (Articles 1369–1 to 1369–3) contains a
whole chapter dealing with contracts concluded in electronic form. In other words, the
digital person implements a fundamental ability of the personality: The ability to contract.
In addition, if the digital person contracts, he should also be able to answer for his fact
62
Проблемы и перспективы правового регулирования цифрового профилирования
as soon as the responsibility expresses the aptitude for the obligation. In this respect, there
is nothing in theory to preclude the application of the general regime of civil liability
for damage caused in the digital sphere. Nevertheless, digital damage remains a damage
and nothing in the texts reduces the fault to an action from the material world. We can
therefore see the existence of a digital personality. When then are the means to protect
this digital identity and consequently this digital personality? Today I will discuss the
contribution of the banking system in this protection, leaving aside data protection and
criminal law (digital identity theft):
PROTECTION BY BANKS AND BANKING SECRECY
The role played by banking and credit institutions in protecting digital identity is
essential through several tools.
INFORMATION
Banks have long been the reference for identity and financial information. To open
an account, obtain a loan or approve a mortgage application, banks must have accurate
information about the person’s creditworthiness and employment. For many customers,
banks hold valuable insights into revenues and consumption patterns over decades.
The PSD DIRECTIVE 2
The second European Payment Services Directive (PSD 2), in force in the European
Union since 13 January 2018, includes a set of regulatory provisions aimed at regulating
the provision of payment services and strengthening the security of payments at European
level. In particular, Strong Authentication for electronic payment Banks are legitimate to be
guardians and identity providers. However, to support this role and ensure authentication,
these institutions will need to continue to improve their identity and authentication
infrastructure. Like what:
– Fingerprinting: Identify a user’s authentication device using the time zone of the IP
address, operating system, browser, browser fonts and screen dimensions. This collected
information will help to confirm the user’s Identity and also check if the device used has
not been the subject of previous hacking attempts.
Behavioral analytics: Leveraging data on customers’ past transactions to determine
the risk of fraud for each new transaction.
– Behavioral biometrics: monitor keyboard key presses, mouse dynamics, and user
typing when browsing banking in order to establish a behavioral biometric profile and
thus detect profile changes.
Finally with banking secrecy.
BANKING SECRECY
Banking secrecy has always been a remarkable lever for protecting the identity of
account holders. Professionals in the banking fieldfare required to ensure the protection
of the information they receive from their customers and third parties about their customers
of which they are custodians. In a digital world in which the reliability of electronic
identification is an essential link in the chain of economic and commercial relations,
the trusted third party that constitutes the banking institution is undeniably at the heart
of digital identity, if only by the measures put in place as part of the obligations on the
knowledge of customers (KYC Know Your Customer process) The banker is responsible
for verifying the identity and contact details of the account holder, as part of his duty
63
Проблемы и перспективы правового регулирования цифрового профилирования
of care. This burden is so great that the bank incurs its liability to third parties in the
event of breaches, even in the event of simple negligence. Banking secrecy in France
was introduced by the Law of 24 January 1984 and falls into the category of professional
secrets. It is imposed on all the staff of banking institutions as well as subcontractors. It is
subject to derogations only in the cases expressly provided for by law. The violation of
banking secrecy is punishable by criminal law (1 year in prison and € 15,000). Banking
secrecy is a means of ensuring the protection of personal data and therefore of digital
identity; at the same time, the protection of such data is the basis of banking secrecy.
Some are already talking about a real digital identity market that would even constitute
the «oil of the twenty-first century» and as such banks have a central role in the protection
of digital identity just like the state and the individual himself.
В. В. Игумнов,
аспирант кафедры информационного права и цифровых технологий,
Московский государственный юридический университет
имени О. Е. Кутафина
ПРАВОВЫЕ ПРОБЛЕМЫ ПОЛУЧЕНИЯ ДОСТУПА К СВЕДЕНИЯМ
О СУБЪЕКТАХ ЦИФРОВОГО ПРОФИЛИРОВАНИЯ
Аннотация.
В статье представлен анализ средств инфраструктуры цифрового
профиля, используемых для организации доступа публичных органов власти, иных
органов и организаций к необходимым сведениям о субъектах цифрового профили-
рования. Целью исследования является определение проблем получения доступа
к сведениям о субъектах цифрового профилирования и выявление основных путей
их решения. В исследовании особенностей данной темы особое внимание прида-
ется объему хранящихся в системе данных, субъектам профилирования, объему
предоставляемых данных, а также обязательности использования инфраструктуры
цифрового профилирования при получении доступа к данным субъектов цифрового
профилирования. Отдельное место отводится проблеме актуальности использования
системы цифрового профиля при получении доступа к необходимым сведениям
о физическом лице при наличии действующего механизма получения согласия на
обработку персональных данных вне взаимодействия с государственными и муни-
ципальными информационными системами.
Ключевые слова
: цифровые технологии, информационные системы, цифро-
вой профиль, персональные данные, субъекты цифрового профилирования, реестр
согласий, инфраструктура цифрового профиля, система цифрового профилирования
LEGAL PROBLEMS OF OBTAINING ACCESS TO INFORMATION
ABOUT DIGITAL PROFILING SUBJECTS
Abstract.
The article offers an analysis of digital profiling infrastructure instruments
used to provide access of public authorities, other bodies and organizations to the necessary
information about the subjects of digital profiling. The purpose of the study is to identify
