On January 8, 2013, the European Parliament issued two reports prepared by the Parliament’s committee of Civil Liberties, Justice and Home Affairs (the “LIBE”) on the European Union Proposed General Data Protection Regulation (the “Proposed Regulation”) and its draft Directive for law enforcement. Both reports were based on proposals that were released by the European Commission in January 2012. While the law enforcement report is of limited interest to most sectors of the business community, the draft report on the “processing of personal data and the free movement of such data” would – if finalized by the European Parliament -- impose significant burdens on the international business community in its dealings with residents of the EU.3
The author of the report on the Proposed Regulation, Jan Philipp Albrecht, is a member of the European Parliament from Germany, and has long advocated for more stringent privacy restrictions. Against this background, the Albrecht Report proposed 350 separate amendments to the Proposed Regulation, which itself proposes 91 separate articles and leaves open a number of places for further “delegated” and “implementing acts” in the future. The amendments in the Albrecht Report would significantly lengthen the existing Proposed Regulation, as well as eliminate many of the mandates for delegated and implementing acts, instead replacing them with provisions built into the Regulation.
The Albrecht Report’s amendments would strengthen and expand many of the individual consumer rights in the Proposed Regulation. For example, the much discussed “right to be forgotten” in the Proposed Regulation would be amended to be a “right to erasure and to be forgotten.” This would expand the data subject’s right to have his or her data erased, and impose erasure requirements on data controllers, including requiring them to take certain steps to have data erased even after it has been disseminated to third parties. Another example comes from the proposed right to data portability. As written, the Proposed Regulation would require consumer data to be provided in a “commonly used format” upon consumer request. The Albrecht Report would expand this right to require the data to be provided in an open source format, free of charge.
Despite the extensive proposed changes, the Albrecht Report fully supports the structure of the Proposed Regulation as a “one stop shop” for enforcement across the EU. The European Commission hailed the Report’s support for “strong and uniform” regulation. The Proposed Regulation would replace the 1995 EU Data Protection Directive in its entirety.
It remains to be seen how influential the Albrecht Report is in further shaping the Proposed Regulation. At present time, the Albrecht Report remains in draft form; a final version will be voted on by the Parliament later this year.