EU Data Protection Regulation Update for In-house Lawyers

Addleshaw Goddard's Data and Information team have been closely following the EU draft General Data Protection Regulation's (Regulation) legislative history. This special briefing provides up to date insights in to the latest developments.

Current Status of Negotiations

The Regulation will replace existing EU data protection law (currently based on Directive 95/45/EC) with a more harmonised approach to data protection across the EU. The European Commission published the first draft of the Regulation in January 2012, with the European Parliament adopting a series of proposed amendments in March 2014. There have been further  drafts and negotiations since and the Council has recently agreed a ‘general approach’ which represents a significant step forward as this will now form the basis for ‘trilogue’ negotiations with the European Parliament and European Commission.  The aim of the trilogue process is to achieve agreement on a final text of the Regulation by the end of 2015. The first trilogue meeting is expected to take place on 24 June 2015. The Council has made it clear that 'nothing is agreed until everything is agreed' and so the Regulation remains very much in draft form.  A final text from the European Council is not expected until the first half of 2016. Regardless of any amendments that may yet be made, it is expected that the Regulation will significantly change EU data protection law in several areas.

The Top Ten Key Provisions

The proposals retain the general principles of data protection law, but also introduce some significant changes. Below are ten key provisions from the proposed Regulation which are likely to be of concern to businesses of all sizes which are involved in processing customer data, as well as practical steps that businesses should consider taking in order to mitigate risk, even at this early stage.

Click here to view the table.

Looking forward

It is expected that the text of the Regulation will be finalised early in 2016, and that the Regulation will come into force at some point in 2017-2018. While the proposed regulation is likely to undergo changes, businesses that plan ahead and begin to consider practical action now will be in a stronger position once the Regulation is finalised.