On 5 October 2012, the Article 29 Working Party, an advisory body that represents data protection authorities in the EU (“Working Party”), issued a second opinion (“Opinion”) on the European Commission’s proposals to implement a new EU Data Protection Regulation (“Regulation”) to replace the current ageing regime implemented under the Data Protection Directive (95/46/EC).
Following on from the areas of concern highlighted in its first opinion of 23 March 2012, the Working Party confirms in the Opinion that it welcomes the approach adopted by the Commission for reforming the EU data protection legal framework and that it has issued the Opinion to provide further guidance on the key data protection concepts of “personal data” and “consent” and to analyse the need for, and the effect of, certain proposed “delegated acts”.
In summary, the Working Party considers that:
- Personal Data: having conducted further analysis on the concept of personal data, the Working Party’s view is that the definition of “data subject” in the draft Regulation and related recitals should be clarified to incorporate the notion that the identifiability of an individual includes the ability to single them out and treat them differently. The Working Party also recommends clarifying recital wording in the draft Regulation to provide that online identifiers (e.g. IP addresses, cookies, location data) should, as a general rule, be considered to be personal data as they relate to an identifiable individual.
- Definition of Consent: the Working Party endorses the provisions of the draft Regulation relating to consent and confirms that where consent is used as a legitimising ground for processing data it is essential that any statement or affirmative action used to obtain consent must clearly signify the data subject’s agreement to personal data relating to them being processed. The Working Party acknowledges that doubts have been raised regarding the proposed requirement in the draft Regulation’s definition of “consent” for any consent to be “explicit”, but its opinion remains that the inclusion of the word “explicit” is an important clarification and should be retained.
- Delegated acts: the Opinion considers in detail the issue of delegated and implementing acts (“Delegated Acts”), which the Commission has the general power to adopt under the Treaty for the European Union in cases where specific Directives or Regulations allow for such acts. The draft Regulation foresees a considerable amount of Delegated Acts which, if adopted in the proposed form, would result in a substantial part of the EU rules on data protection not being directly incorporated into the Regulation and not being adopted through normal legislative procedures. The Working Party’s opinion is that Delegated Acts should only be inserted in the draft Regulation where the Commission can substantiate that it is indeed necessary and that all essential acts should be dealt with in the draft Regulation itself and not in a Delegated Act. The Working Party further emphasises the importance of interpretative guidance to be provided by the European Data Protection Board (the advisory body which will succeed the Working Party) and sets out a detailed analysis on each of the Delegated Acts proposed under the draft Regulation and its opinion on whether a Delegated Act is the most appropriate way for dealing with the issue concerned.
In terms of next steps, it is intended that the LIBE committee, which was appointed by the European Parliament as the main committee for overseeing the data protection reforms, present its draft reports on the reforms by the end of 2012.