The Working Party on the Protection of Individuals with regard to the Processing of Personal Data (the Working Party) has adopted an opinion on the European Commission’s proposals for reform of current data protection law. The opinion highlights a number of concerns and suggested improvements, but in general the Working Party welcomes the proposals.
The Working Party was set up under Article 29 of the Data Protection Directive 95/46/EC (the Directive), which outlines the current data protection regime for the European Union. The Working Party is tasked with monitoring the uniform application of the Directive by examining questions relating to data protection and privacy and then issuing recommendations, opinions and working documents. Earlier this year, the European Commission published its proposals for a revised data protection legislative framework consisting of a new regulation and directive (the reforms).
The Working Party concluded that the proposed framework has the potential to meaningfully strengthen data protection across Europe by reducing existing fragmentation. On the whole, the Working Group embraced the increased clarity of the law set out in the reforms and reacted favourably to numerous aspects of the proposed provisions including:
- Strengthening the rights of data subjects in relation to data access, data portability, data deletion and remedies for breach of these rights.
- Enhancing the responsibility and accountability of data controllers for the processing of personal data throughout the information life cycle.
- Provisions incentivising investment in systemic data protection, including data protection by default, data protection by design and data protection impact assessments.
- Amplifying and harmonising the powers of national and international supervisory authorities, including the ability for them to impose significant fines and the obligation to be consulted on legislative measures.
Despite the mostly positive attitude toward the reforms, the Working Party concluded that certain features require improvement. The Working Party urges the European Parliament and European Council to use the forthcoming round of legislative negotiations to enhance the reforms to provide the best protection possible. In particular, the Working Party commented that:
- Theproposals should be set out in a single, comprehensive legal document.
- There should be a stricter deadline for the revision of other legal instruments to ensure alignment of provisions; the proposed three year review period is too indulgent.
- Further clarification is required in relation to deciding where a multinational company has its main establishment to enable the effective functioning of the proposed system of determining which national data protection authority should be the “lead authority”.
- It would be more appropriate to measure the relief threshold for small and medium-sized enterprises using criteria that take the nature and extent of data processing into account, rather than using the proposed employee number threshold.
- The reforms omit vital provisions relating to the accuracy of personal data, limitations on data retention periods and mandatory deletion of data by third parties upon a data subject’s request.
- The scope of derogations in relation to international transfers is too wide.
- There is a need for stronger provisions in regard to data protection rules for police and judicial cooperation in criminal matters.
- An independent assessment of the increased costs for data protection authorities is required to ensure operation under the new framework is feasible.
- It has concerns about the strong role of the Commission in relation to the use of delegated and implementing acts and in individual cases that are to be dealt with by the supervisory authorities in the European Data Protection Board.
The Working Party has indicated that it may yet produce additional opinions exploring specific provisions of the reforms in more detail.