Today the European Commission’s Article 29 Working Party released Opinion 08/2012 providing further input on the EU’s revised Data Protection Regulation. The purpose of the Opinion is to provide “further guidance, notably on certain key data protection concepts and by analysing the need for and the effect of the proposed delegated acts and where necessary suggesting more suitable alternatives.”

Notable assertions in the Opinion include recommendations for a broad definition of personal data and a high standard for consent in order to “properly protect the privacy of personal information and future-proof the Regulation.”

The Working Party suggests that IP addresses and cookies should be included in the definition of personal data because the technology exists for such information to be used to identify individuals and single them out. With respect to consent, the Working Party stated that the revised data directive’s inclusion of the word “explicit” in the criteria for “consent” is an important clarification because it is “necessary to truly enable data subjects to exercise their rights, especially on the Internet where there is now too much improper use of consent.”