Privacy & Information Security Law Blog

On June 18, 2015, the Article 29 Working Party (the “Working Party”) published letters regarding the proposed EU General Data Protection Regulation (the “Regulation”) addressed to representatives of the Council of the European Union, the European Parliament and the European Commission. Attached to each of the letters is an Appendix detailing the Working Party’s opinion on the core themes of the Regulation.

The Parliament, the Commission and the Council will now come together in a “trilogue” to negotiate and agree on a final text of the Regulation. The first trilogue meeting is expected to take place on June 24, 2015. The purpose of the Working Party’s letters and attached Appendix appears to be to set out the Working Party’s position on a range of core issues in the Regulation, and to ensure the Working Party’s views are taken into account as the trilogue proceeds.

The Working Party’s key points include:

• Territorial Scope – In addition to the already broad territorial scope of the Regulation, the Working Party is of the view that the Regulation should apply to non-EU processors, where they act on behalf of controllers that are subject to the Regulation (in line with the Parliament’s views on this issue).
• Definition of Personal Data – The Working Party reiterates its view that IP addresses, online identifiers and other similar factors that enable an individual to be “singled out” (even if that individual’s real-world identity remains unknown) should, as a general rule, constitute personal data and therefore be subject to the Regulation. This proposal has significant implications for the online advertising sector, as it would potentially make many advertising cookies and tracking technologies subject to the Regulation.
• Pseudonymous Data – The Working Party is opposed to the classification of “pseudonymous data” as a separate category of personal data, subject to a lighter legal regime, the processing of which is not subject to the “balance of interests” test (effectively opposing the Parliament’s position on this issue). The Working Party does, however, support the use of pseudonymisation techniques as a security and risk mitigation measure.
• Purpose Limitation – The Working Party recommends that personal data should never be processed for purposes incompatible with those for which they were collected. Instead, it takes the view that an additional legal basis should be required, even for processing for new purposes that are not incompatible with the original purpose. This proposal may have material consequences for “big data” companies and others for whom the reuse of existing data is a key part of doing business.
• The “household purposes” exemption – In line with the Court of Justice of the European Union’s decision in Ryneš, the Working Party considers that the “household purposes” exemption should be limited to “purely” household activities.
• Mandatory DPOs – The Working Party is in favor of imposing a mandatory obligation to appoint a Data Protection Officer upon data controllers, if they meet certain thresholds in terms of the type, volume or nature of the data being processed (although the Working Party does not specify what those thresholds should be).
• Information Notices – The Working Party supports the use of layered privacy notices, and the proposal that data subjects should also be provided with information relating to further processing, data retention periods, international transfers and security measures.
• Data Portability – The Working Party supports the proposed broad scope of the right to data portability, and suggests that this right should be separate to the right of access.
• Right to Object – The Working Party is of the view that the right of data subjects to object to processing should apply widely, and should not be limited to processing performed on the basis of: (1) the legitimate interests of the data controller; (2) the public interest; or (3) the exercise of official authority.
• Profiling – The Working Party highlights that the proposals in the Regulation relating to data subject profiling are unclear and do not ensure sufficient safeguards to protect data subjects. The Working Party recommends that the creation of profiles should be limited to particular purposes (although the Working Party does not specify those purposes), and that specific obligations should be imposed on data controllers to inform data subjects of: (1) the relevant profiling measures that will apply to their data; and (2) the right to object.
• Risk-Based Approach – While the Working Party does not directly oppose the risk-based approach in general, it considers that risk should not be a determining factor in relation to a controller’s accountability obligations.
• Data Breach Notification – The Working Party supports different de minimis thresholds for notification to data subjects and to Supervisory Authorities. The Working Party further proposes that the notification obligations in the Regulation should be aligned with the equivalent obligations in the e-Privacy Directive (under which notification is required only where the breach is likely to “adversely affect” the personal data or privacy of a data subject).
• Data Transfers – The Working Party supports the inclusion of legitimate interests as a ground for the transfer of personal data outside the EEA, but is of the view that its use should be limited to exceptional circumstances, and not for large-scale, regular transfers of personal data.
• Access by Public Authorities – In the event that a court, tribunal or public authority in a non-EU jurisdiction demands access to personal data that are subject to the Regulation, the Working Party recommends that such matters be dealt with under a Mutual Legal Assistance Treaty, where one exists. Where no such treaty is in place, the relevant controller should report the matter to the competent Supervisory Authority. The Working Party’s previous guidance on this point in the context of Binding Corporate Rules (“BCRs”) for processors provides some helpful context.
• Binding Corporate Rules – The Working Party considers it essential that BCRs for processors continue to be recognized as a valid mechanism for cross-border data transfers.
• One-Stop Shop – The Working Party expresses its support for the “one-stop shop” in principle, but recommends that the details of its implementation are left to the European Data Protection Board, rather than being prescribed in the Regulation.
• Fines – The Working Party welcomes the introduction of significant fines for breaches of the Regulation, and also considers that the imposition of fines where a data controller or processor fails to cooperate with its Supervisory Authority should be reinstated.

Hunton & Williams has released a Guide to the Regulation, which is available by soft copy. An updated copy of this Guide will be released following the conclusion of the trilogue process and the release of the final text of the Regulation.