Privacy & Information Security Law Blog

On March 16, 2011, a meeting of the “European Privacy Platform” group of the European Parliament was held in Brussels.  The meeting provided important insights into the likely structure and content of proposed revisions to the European Data Protection Directive 95/46/EC that the European Commission has been working on for the past several months.

The meeting was chaired by Member of the European Parliament (“MEP”) Sophie in ‘t Veld, and featured interventions by Viviane Reding (Vice President of the European Commission and Commissioner for Justice, Fundamental Rights and Citizenship) and Axel Voss (a German MEP and member of the EPP parliamentary block who is serving as the Parliament’s Rapporteur on the Directive review).  In addition, a number of other MEPs participated in the discussion, including Jan Albrecht (Green MEP from Germany), and Portugal’s Carlos Coelho (EPP) and Rui Tavares (Confederated Group of the European United Left).

Following an introduction by Ms. in ‘t Veld, Ms. Reding emphasized the following points:

• She referred to review of the Directive as her “top legislative priority,” indicating that the Commission had not yet decided whether the revised legal instrument should be in the form of a directive or turned into a regulation which would be directly binding on the Member States.  She also said that the revised legal instrument would be presented by the Commission this summer as scheduled.
• She said that the revision of the Directive would be based on four “pillars,” namely:
  • The right to be forgotten: this would involve a comprehensive set of new rules and a reworking of existing rules which would ensure that an individual has an effective right to withdraw consent to data processing.  In addition, the burden would be put on data controllers to show that they have a legal basis for processing data.
  • Transparency: Ms. Reding said that individuals must be informed of data that are collected about them, the purpose of collection and the risks of data processing. She specified that “greater clarity” would be required for signing up to social networks, and that children must be made aware of the risks of social networks.  She also said that information given to individuals online must be clear and easy to understand.
  • “Privacy by default”: this is a new term, which Ms. Reding defined as meaning that data protection requirements also must apply if data are processed for a purpose different from that for which they were originally collected.
  • Protection regardless of data location: she said that EU law should apply irrespective of the location of data processing and the means used by the controller to process the data.  Thus, according to Commissioner Reding, any online service targeted at EU consumers must comply with EU data protection law; in this regard, she specifically mentioned “U.S.-based social networks.”
• She said that reforming data protection rules for law enforcement as required by the Lisbon Treaty was “an important part of the reform of the Directive.”  In this regard, she indicated that there should be common rules for data processing across all sectors, including law enforcement, but that there might be a need to have exceptions for law enforcement data processing, provided the exceptions are clear and subject to strict safeguards.
• Finally, Ms. Reding noted that she is planning to reinforce the independence and harmonized powers of national data protection authorities (“DPAs”).

Mr. Voss then gave his presentation, as follows:

• He stated that the basic principles of the Directive are still valid, but that there is a need to increase legal certainty without hindering data processing for security reasons and by companies.
• He said that he was in favor of a harmonized level of data protection across all EU Member States, which should be done so that a high level of protection applies everywhere.
• He agreed with Commissioner Reding that EU law should apply wherever the data of EU citizens are processed.  In this regard, he made one comment that was very critical of the EU-U.S. Safe Harbor agreement.
• He stated that the revision of the Directive should focus on strengthening individual rights, such as purpose limitation, transparency and others.  He also was supportive of the right to be forgotten.
• He stated that he was in favor of a general right of accountability, and seemed to understand this term as imposing an obligation on data controllers to take measures to comply with applicable law.
• Mr. Voss indicated that it was necessary to strengthen the independence and enforcement powers of data protection authorities.
• He also said that measures should be taken to strengthen and streamline the procedures for Commission adequacy decisions and for international data transfers, without going into further detail.
• Mr. Voss stated that his draft report on the Commission Communication would be introduced on March 17, 2011, in the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (“LIBE”).  He said that the report would be published on April 11, and would be voted on in the Committee on May 24-25, with a view toward having it adopted by the plenary of the European Parliament on June 22-23.  He also made reference to a hearing to be held by his parliamentary group on “the economic side of privacy” on March 31.

Following these presentations, some of the other MEPs made comments, and questions were taken from the floor.  Below are some highlights of the discussions:

• There were a number of questions and remarks about cloud computing.  Mr. Voss stated that the processing of sensitive data generally should not be allowed in cloud computing systems, or only if the relevant servers are located in the EU.  In this regard, Ms. Reding reiterated her point that EU law should apply when EU data are processed anywhere in the world.
• In response to questions regarding the role of self-regulation, Ms. Reding stated that she is in favor of it as a way to make the application of EU legal principles more effective.  Mr. Voss stated that self-regulation needs to be overseen and controlled by the DPAs.
• With regard to the role of the DPAs, Ms. Reding stated again that she will emphasize in her proposal that they must be independent, but that she expects some resistance from national governments on this point.
• Finally, Ms. Reding stated that the Commission’s proposal will strengthen legal certainty regarding the use by companies of binding corporate rules (“BCRs”).  She stated that she is in favor of BCRs, but that their use must be coupled with enhanced enforcement powers against companies that use them.

Read our blog post covering the December 1, 2010, meeting of the European Privacy Platform.