Privacy & Information Security Law Blog

On February 27, 2013, the Article 29 Working Party (the “Working Party”) issued a statement on the European Commission’s proposed revised data protection framework (“Statement”), including the proposed General Data Protection Regulation (“Proposed Regulation”). The Working Party offered amendments to the Proposed Regulation in the form of two Annexes to the Statement on the topics of competence and lead data protection authority (“DPA”) and the exemption for household or personal activities.

The Statement identifies the following six areas of concern in the Proposed Regulation:

Public Sector Flexibility
The Working Party believes that there are no compelling reasons to create more flexibility for the public sector in the Proposed Regulation. In the Working Party’s opinion, a distinction between the public and private sector could lead to legal uncertainty and would be unworkable in practice.

Personal Data and Pseudonymization
The Working Party emphasizes that data protection rules continue to apply when using pseudonymizing techniques or encryption. Re-identification of individuals remains possible in these cases since encryption does not change the personal nature of the data and pseudonymizing data only disguises, but does not de-identify the data.

Consent
The Working Party supports the proposed requirement that consent always should be explicit in order to be used as a legal basis for data processing.

Governance
According to the Working Party, it is necessary to provide “clear rules on issues such as budget, equality of powers, the margin of discretion for DPAs and how the mutual assistance and the consistency mechanisms are to be put into practice” in order to ensure that DPAs and the European Data Protection Board (“EDPB”) can effectively carry out their enhanced duties under the Proposed Regulation. In particular, the Working Party believes that the budget of a DPA should be set at a fixed amount to cover the basic functions that all DPAs must undertake. The budget then would be supplemented by an amount based on a formula related to (1) the population of an EU Member State, (2) the gross domestic product of that Member State, and (3) the amount of main establishments in that Member State. The Working Party states that DPAs also should be able to define their own priorities and initiate enforcement actions.

International Data Transfers
The Working Party believes that the Proposed Regulation should allow data transfers to third countries only on the basis of binding legal instruments. In addition, the Working Party emphasizes the need to include the use of Mutual Legal Assistance Treaties (“MLATs”) in the Proposed Regulation in the case of disclosures that are not authorized under EU or national law. According to the Working Party, data transfers should be prohibited when a judgment of a court or a decision of an administrative authority of a third country requests a data controller (or a data processor) to transfer personal data from the EU to that third country, and there is no MLAT or another international agreement in force between the requesting third country and the EU or the relevant Member State.

Risk-based Approach
The Working Party recognizes that some of the provisions in the Proposed Regulation may pose an unbalanced burden on some controllers, but still asserts that all data controllers must comply with data protection law, which may be accomplished in a scalable manner.

In the first Annex to the Statement, the Working Party suggests amending the Proposed Regulation to ensure that:

• DPAs would remain competent to supervise all data processing operations within the territory of their Member States (i.e., the competence of the lead DPA should not be exclusive);
• The lead DPA would be the single point of contact for the data controller or data processor, in charge of the decision-making procedure in which all competent DPAs will take part;
• The outcome of the decision-making procedure should be binding on all competent DPAs;
• In cases where ambiguity remains about which DPA should take the lead, the EDPB should designate the lead DPA; and
• Individuals always have the option to seek judicial redress in courts in their own Member States.

The second Annex to the Statement welcomes the fact that processing of personal data for personal or household purposes still would be exempted in the Proposed Regulation; the Working Party proposes, however, to delete the requirement that such processing must not result in any gainful interest and must not be connected to a professional or commercial activity in order to fall within this exemption.

This is the third time that the Working Party has expressed its views on the data protection reform package. The Proposed Regulation is currently being reviewed by the European Parliament and the European Council.