In March, the European Parliament voted overwhelmingly in favour of implementing the draft Data Protection Regulation, making its commitment to reforming the European regime irreversible. In order to become law, the Regulation must now be negotiated and adopted by the Council of Ministers.
Discussions around reform began in January 2012, in recognition of the growing economic significance of personal data. With estimates that by 2020 the personal data of European citizens will be worth nearly €1 trillion annually, it is important that any reform ensures an adequate level of protection for citizens while not overburdening businesses. To this end, Vice-President Viviane Reding has stated that the Regulation will “make life easier for business and strengthen the protection of our citizens.” The Regulation will make four key changes to the data protection regime, which are summarised below:
- Equal application in all EU Member States by replacing the “current inconsistent patchwork of national laws”, making compliance easier and cheaper
- Creation of a “one-stop shop” for organisations to deal with one data protection authority where their EU QA is located, rather than across various member states, reducing the administrative burden on organisations. EU residents may still bring complaints to the authority in their home country.
- Application of the Regulation to any organisation that operates within the single market to ensure that businesses are competing equally
- A right of EU residents to request that their data be removed where a data controller no longer has a legitimate reason to retain it
The draft Regulation continues to contain robust sanctioning powers with fines of up to 5% of annual worldwide turnover, a significant increase by the European Parliament on the 2% limit that had previously been recommended.
Despite the Parliament’s vote and ringing endorsement for the draft Regulation, the text is still subject to input from the Council of Ministers, who appear to be taking a more pragmatic approach aimed at promoting the EU Digital Agenda and continued growth in the digital marketplace. The next Council meeting is in June, so we may yet see further revisions to the existing draft.