Privacy & Information Security Law Blog

On October 21, 2013, the European Parliament approved its Compromise Text of the proposed EU General Data Protection Regulation (the “Proposed Regulation”). The approval follows months of negotiations between the various parliamentary committees. The European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (“LIBE”) has been in charge of working toward an agreement on the Compromise Text in the European Parliament.

Immediately after the vote, LIBE lead rapporteur Jan Philipp Albrecht commented: “Parliament now has a clear mandate to start negotiations with EU governments. The ball is now in the court of member state governments to agree a position and start negotiations, so we can respond to citizens’ interests and deliver an urgently-needed update of EU data protection rules without delay. EU leaders should give a clear signal to this end at this week’s summit.”

Although the European Parliament’s official Compromise Text has not yet been published, it appears that the most significant amendments are as follows:

• Extended Territorial Scope: The Compromise Text extends the wide territorial scope of the Proposed Regulation. It provides that the Proposed Regulation applies to the processing of personal data in the context of the activities of a controller’s or processor’s establishment, even if the processing does not take place in the EU (e.g., where processing is actually conducted overseas or in the cloud). The Compromise Text greatly extends the territorial scope by making both controllers and processors established outside of the EU subject to the Proposed Regulation where the processing relates to monitoring, or offering goods or services to, data subjects in the EU. The territorial extension may cause ambiguity and confusion, however, as it eliminates the EU residency requirement (so it may apply to data subjects temporarily travelling in the EU), and the requirement regarding monitoring data subjects’ behavior (it is unclear what would constitute “monitoring” of data subjects under the Proposed Regulation).
• Clarification of Key Concepts: The Compromise Text introduces a definition of pseudonymous data. This is “personal data that cannot be attributed to a specific data subject without the use of additional information, as long as such additional information is kept separately and subject to technical and organisational measures to ensure non-attribution.” If the data controller is unable to comply with a provision of the Proposed Regulation because the controller is processing pseudonymous data, the controller is not obliged to comply with that particular provision.
• Changes to the Legal Bases for Data Processing  ̶  Legitimate Interests and Consent: The Compromise Text allows for the processing of personal data where it is necessary for the purposes of the controller’s legitimate interests, except where such interests are overridden by the data subject’s interests or fundamental rights and freedoms. This largely preserves the current position relating to legitimate interests under the existing EU Data Protection Directive 95/46/EC. The Compromise Text also amends the definition of consent to include a purpose limitation: consent is no longer valid when the purpose for the processing ceases or as soon as the processing is no longer necessary to carry out the purpose for which the personal data were originally collected.
• Reinforcement of Data Subjects Rights: Amendments to the notice provisions may reflect recent sensitivities regarding law enforcement access to data following the PRISM scandal. The Compromise Text requires the data controller to provide notice to individuals whether personal data was provided to public authorities within the preceding 12 months. The Article does not specify that the controller must have handed over the personal data to the authorities, nor does it include any other circumstances or details. A similar provision requires controllers to provide similar notice in response to a subject access request. Profiling that has a discriminatory effect on the grounds of race, ethnic origin, political opinions, religion, philosophical beliefs, trade union membership, sexual orientation or gender identity, is prohibited outright, and the controller must implement safeguards against possible discrimination resulting from profiling.
• Data Protection Officers: The Compromise Text provides that a controller or processor must appoint a data protection officer (“DPO”) when the controller is processing the personal data of more than 5,000 data subjects in any consecutive 12-month period, or where the core processing activities relate to processing sensitive personal data, location data, children’s data, or employee data in large-scale filing systems. The minimum protected tenure of DPOs is extended from two years to four years. A group of companies may appoint a primary DPO, provided the DPO is easily accessible from each place of establishment.
• Breach Notification, Fines and Compensation: The Compromise Text relaxes data breach notification requirements. The 24-hour window to report a breach to the relevant regulator has been removed, and no new time limit is specified. Rather, breaches must be reported “without undue delay.” The Compromise Text increases potential fines to 5% of an enterprise’s annual worldwide turnover or 100 million Euros (whichever is greater). Finally, the Compromise Text provides a private right of action for individuals who have suffered damage, including non-pecuniary damage, resulting from violations of the Proposed Regulation. It also stipulates that where there is more than one controller or processor involved in the processing, each controller or processor will be jointly and severally liable for the damage (unless they have an appropriate written agreement establishing liability with respect to their responsibilities).
• International Data Transfers: The Compromise Text enables an organization which has a “European Data Protection Seal” to rely on the seal as an adequate basis for transfers of data outside the EEA to recipients that also hold a seal. The European Data Protection Seal is a new concept which is essentially a certification program allowing controllers and processors to apply to have their data processing activities audited and certified by data protection authorities or accredited third parties. In the event an organization that holds a seal violates the Proposed Regulation, a fine would only be imposed if the violation was intentional or negligent.
• Right to Erasure: According to the Compromise Text, any data subject should have the right to have his or her personal data erased upon request. To bolster this right, if a data subject asks a controller (e.g., an Internet company) to erase his or her data, the company also should forward the request to other companies that maintain the same data on the individual. This “right to erasure” replaces the “right to be forgotten” that was initially proposed by the European Commission.
• Miscellaneous: The Compromise Text prohibits the disclosure of personal data as ordered by a court, tribunal or administrative authority of a country that is not deemed “adequate” by the European Commission. If such a country requests that a company (e.g., a search engine, social network or cloud provider) disclose personal data processed in the EU, the company would have to (1) notify the data protection authority of the request without undue delay, and (2) obtain the data protection authority’s prior authorization for the transfer.

The next stage is for the Council of Ministers to reach an agreement on the Proposed Regulation, after which a “trilogue” between the Parliament, the Council and the Commission will be established to agree on the final text. A vote is expected before the parliamentary elections in May 2014.