In the cyberworld, there are two basic ways in which personal information is collected: (i) through direct solicitation from users (registration and transactional data); and (ii) surreptitiously through tracking the way people surf the Internet (clickstream data).

It would be necessary to define such terms as data; data-subject; data user; data-file; data retention; data preservation; personally identifiable data; sensitive data; traffic data; location data; transborder flow of personal data; processing of personal data; communication; third party user; registration and transactional data; clickstream data.

Essentially, Internet service providers (ISPs) are required to clickstream, collect and store data on the activities of their customers in the cyberspace.

Scope: Protection of personal data and privacy of communications Scope ratione personae: personal data Scope ratione materiae: private and public sectors: quere whether International Organizations should be included Possible exclusions: Purely personal and house-hold activities Definitions: data; data-subject; data user; data-file; data retention; data preservation; personally identifiable data; sensitive data; traffic data; location data; transborder flow of personal data; processing of personal data; communication; third party user; registration and transactional data; clickstream data Core principles: Lawful and fair data collection and processing; accuracy; purpose specification and limitation; proportionality; transparency; individual participation and in particular the right to access; non-discrimination; Responsibility; Independent supervision and legal sanction; data equivalency in the case of transborder flow of personal data; derogability Restrictions to right of access: Maintenance of public order; defence and security of the State; public health, etc. Confidentiality and Security: Confidentiality of communications; security of sensitive data Rights in respect of the data subject: to be informed; to withhold consent; access; rectification; to object to processing of data for a legitimate reason; to a remedy Data processing: Fairness and lawfulness; accountability Criteria for legitimate data processing: Consent; contractual obligation; other legal obligation; necessary to protect vital interest of data subject; necessary in the public interest; necessary for the purposes of legitimate interest Exceptions and limitations: National security; defence; public security; criminal law enforcement; fiscal concerns and economic well-being; protection of data subject and others Policy making (census, population registers, surveys); Scientific, research and statistics; Journalistic and artistic activities Sanction and remedy: Administrative; judicial Adequacy of level of transborder protection: principle of adequacy; determination of adequacy; derogations Implementation: Legislation; regulation; self-regulation

Scope: Protection of personal data and privacy of communications Scope ratione personae: personal data Scope ratione materiae: private and public sectors: quere whether International Organizations should be included Possible exclusions: Purely personal and house-hold activities Definitions: data; data-subject; data user; data-file; data retention; data preservation; personally identifiable data; sensitive data; traffic data; location data; transborder flow of personal data; processing of personal data; communication; third party user; registration and transactional data; clickstream data Core principles: Lawful and fair data collection and processing; accuracy; purpose specification and limitation; proportionality; transparency; individual participation and in particular the right to access; non-discrimination; responsibility; independent supervision and legal sanction; data equivalency in the case of transborder flow of personal data; derogability Restrictions to right of access: Maintenance of public order; defence and security of the State; public health, etc. Confidentiality and Security: Confidentiality of communications; security of sensitive data Rights in respect of the data subject: to be informed; to withhold consent; access; rectification; to object to processing of data for a legitimate reason; to a remedy Data processing: Fairness and lawfulness; accountability Criteria for legitimate data processing: Consent; contractual obligation; other legal obligation; necessary to protect vital interest of data subject; necessary in the public interest; necessary for the purposes of legitimate interest Exceptions and limitations: National security; defence; public security; criminal law enforcement; fiscal concerns and economic well-being; protection of data subject and others Policy making (census, population registers, surveys); Scientific, research and statistics; Journalistic and artistic activities Sanction and remedy: Administrative; judicial Adequacy of level of transborder protection: principle of adequacy; determination of adequacy; derogations Implementation: Legislation; regulation; self-regulation