EU data protection rules

Negotiators from the European Parliament and Council this evening reached an agreement on the long-open reform of the EU's data protection rules. The agreement must now be confirmed by the representatives of EU governments before the end of the year (1).  Commenting on the agreement Green MEP and European Parliament draftsperson/rapporteur on the data protection regulation Jan Philipp Albrecht stated:

"This evening's breakthrough paves the way for the conclusion of the much-anticipated reform of the EU's data protection rules. The legislation will create an EU-wide data protection regime for the first time, replacing the outdated patchwork of national data protection rules. This would be a major step forward for consumer protection and competition and ensure Europe has data protection rules that are fit for purpose in the digital age.

"This evenings' negotiations yielded agreement on the major outstanding issues in the reform. Firms contravening the data protection regulation would face fines of up to 4% of revenue, which could imply € billions for the major global online corporations. Under the new rules, businesses would also have to appoint a data protection officer if they are handling significant amounts of sensitive data or monitoring the behaviour of many consumers.

"The new rules will give users back the right to decide on their own private data. Businesses that have accessed users' data for a specific purpose would not be allowed to transfer the data without the user being asked. Users will have to give their consent by a clear and affirmative action for their data to be used. The European Parliament had proposed that the age at which users can consent to the use of their data by parental agreement be set at 13 but EU governments opposed this and, instead, the matter will be left to member states which can set the age between 13 and 16 years at the maximum.

"The new rules will give businesses legal certainty by creating one common data protection standard across Europe. This implies less bureaucracy and creates a level playing field for all business on the European market.

"It is now up to EU governments to give the final green light to this agreement and ensure the balanced compromise struck this evening brings this long legislative process to successful conclusion."

(1) The data protection reform includes the data protection regulation, which will replace the EU's 1995 data protection directive, and a directive on data protection for police and justice authorities. The agreement reached in the trilogue negotiations must now be confirmed by the permanent representatives of EU governments in COREPER and will be voted on by the European Parliament's civil liberties committee on Thursday.