Normally, the announcement of proposals from the European Commission excite nobody save the right-wing tabloids, however "Regulation on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data” is likely to affect every EU citizen and every business and has been described as the biggest, most impactful piece of legislation that the European Union could produce without developing tax powers.
The proposed law has three objectives:
- to make it easier for companies to do business in Europe;
- to give individuals greater control over their personal information; and
- to give Europeans what has been dubbed the “right to be forgotten”.
The proposal would force all companies to get explicit consent from customers to collect their data, explain how it will be used, and allow users to totally erase their information. Failure to comply could cost a company a fine of up to one million euros or 2% of annual turnover. In part this is already enshrined in existing Data Protection rules but this makes it more explicit.
With each country in the 27-state European Union enforcing its own data protection laws, the legislation would create a single EU law for all nations as well as companies offering services in Europe, even if servers are based overseas. The proposed regulation should make it easier for the relevant national agencies to force organisations to comply with a time limit on how long they may store data before having to ask for permission to hold on to it for longer.
This kind of sunset clause is designed to make people think about their personal data and where it resides. An individual might decide to extend the life of his data, but having to do so actively will remind him of the presence and scale of his online data. Giving people greater control over their information in an era of social networking websites and cloud computing, is expected to give greater confidence with respect to storing things online.
From a corporate perspective, this proposal may well impose an onerous burden:
- Marketing systems will need to be adapted to better seek permission to store personal data.
- It may well prove to be impossible to delete a piece of information completely and there will need to be limits to the liability of data holders.
- There are also questions about the ownership of data and where to draw the line between an individual customer’s data and the companies own.
- Companies will also have to appoint a data protection officer, a requirement that already exists in Germany.
Nevertheless, any attempt to make companies take their data seriously is to be welcomed and there is an upside. A company will only have to deal with one single data protection authority ie the data protection authority of the member state in which the company has its main establishment. It will not matter anymore which data protection authority deals with a case. All data protection authorities in whatever EU country will have the same adequate tools and powers to enforce EU-law. Overall it is expected to save businesses 2.3 billion euros a year by eliminating the mountain of red tape that companies must navigate currently.
The legislative process is likely to take at least two years, so the rules could still change considerably. Companies are unlikely be required to comply before 2014 or 2015, after legislation has been approved by national governments.
Photograph by Mike Tobin under a creative commons license
