Changes from previous EU data protection law

In addition to harmonization, the proposed data protection law contains a number of key changes.  The Proposed Regulation strengthens regulatory authority and contains changes that affect consumers and companies.

Consumers

The Proposed Regulation gives consumers greater online privacy rights.

• The “right to be forgotten” allows for the deletion of unnecessary personal data.
• Opt-in consent for data processing.
• Easier transfer and portability of personal data.
• Easy access to redress for consumers to handle issues through their home national data protection authorities, even if their personal data is processed in another country.

Through these changes, the Proposed Regulation attempts to give users greater choice and control over their data.

Companies and Organizations

Companies and organizations will also face significant changes for compliance with data protection law.  Some aspects of the Proposed Regulation will soften compliance and administrative requirements.  For example, companies would only have to deal with the national data protection authority in the EU country where they have their main establishment.  The Proposed Regulation also attempts to ease the rules for international data transfers through less administrative requirements. The Proposed Regulation replaces some existing requirements for data processing with similar requirements to be conducted differently (ex. data processing reporting).

Other aspects of the Proposed Regulation increase responsibility and accountability.  In addition to integrating privacy and “privacy by design” into products and services, many companies would face significant changes in the law.

• Independent national data protection agencies will have greater enforcement power, including the ability to fine companies that violate EU data protection rules up to 5% of a company’s global annual turnover.
• In addition, companies will have to give notification of serious data breaches without undue delay; if feasible, within 24 hours.
• The Proposed Regulation will also apply to companies not established in the EU, if they offer goods or services in the EU or monitor the online behavior of citizens.
• Companies with more than 250 employees will have to hire a data protection officer.

In sum, the Proposed Regulation seeks to simplify existing data protection law for companies yet strengthen enforcement against violations.

Initial Responses to the Proposed Regulation

The Proposed Regulation has faced mixed initial responses from EU national data protection authorities.  National data protection authorities welcome the efforts of the Proposed Regulation to harmonize rules and increase online privacy rights, but have already criticized the Proposed Regulation.  German Data Protection Commissioners (“DPAs”) criticized the Proposed Regulation for possibly adversely affecting the ability of German data subjects to enforce their constitutional rights in German Federal Constitutional Court.  The German DPAs also stated that it was “unacceptable” to give unelected European Commissioners ultimate authority with respect to data protection.[2]  The United Kingdom’s Information Commissioner’s Office (ICO) criticized the Proposed Regulation for being overly prescriptive and failing to recognize the reality of international data transfers in today’s globalized world.[3]

Although the Proposed Regulation has faced criticism, it represents a step towards increasing online privacy rights and harmonizing data protection law for companies.  Therefore, it includes valid points that are embraced by many in the EU and privacy community and should not be dismissed.  At this point, the Proposed Regulation is entering the EU legislative process.  The Proposed Regulation will likely be significantly debated and modified over the next couple of years before its possible adoption and another two years before it is effective.

Links

European Commission Data Protection Reform

http://ec.europa.eu/justice/newsroom/data-protection/news/120125_en.htm

European Commission Press Release

http://europa.eu/rapid/pressReleasesAction.do?reference=IP/12/46&format=HTML&aged=0&language=EN&guiLanguage=en

1995 EU Data Protection Directive

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:NOT

The Project’s mantra is Empowering Individuals to Protect Their Data with Implementable Solutions.  The Project pursues this goal by advocating a technical and paradigmatic shift to forge collaboration between those who develop the technology and those who craft the legal regimes that incentivize and shape those developments.

Operating at the intersection of technology and the law, our audience includes attorneys, technologists, policy makers, not-for profits, and society at large. Equally important, because our work focuses on implementable solutions, we strive to work with established companies, startups, government entities, and other organizations in the field.  As a result, the Project speaks to a wide ranging audience.

Finally, the Project would like to thank HSTLJ for allowing us to use their blog as a platform. And, we would like to thank Hastings for its support.

For more information about the Project please visit our website or contact the Executive Director *protected email*.

Double Blind Justice (hereinafter “DBJ”) applies a scientific and experimental approach to outstanding issues in the areas of intellectual property and science law.  For each issue presented, two practitioners, professors or other interested parties will be given the opportunity to provide a test or standard that they believe balances interests and provides sound policy.  Our “subjects” will then apply the test to approximately five to ten hypothetical examples.  The hypos will be provided by journal members and also sourced from the legal community through ongoing “calls for hypos.”

Each installment will publish the two tests and the outcomes of the hypotheticals alongside each other.  We will typically select subjects with somewhat different interests so our “results” may be slightly different.  Or they may have complete agreement.  Nobody knows.  You will have to check in with DBJ to find out.

We are doing this for many reasons.  We believe that most of the commentary on current issues is polemicized, predictable and can be adequately addressed by amicus briefs.  We think a fresh, fun, and creative approach to legal scholarship is needed.  Although we intend to publish the results in our journal, we recognize that internet publishing has superceded traditional media for legal scholarship and feel that this change in media provides us the freedom to experiment with new and different formats for presenting analysis.

Chief Justice Roberts has recently commented that there is a disconnect between legal scholarship and the profession of law and that the subject matter presented in law reviews is of not of much help to the bar.*  We intend to address his concerns by providing a practical (and sporting) approach to legal scholarship that draws upon the experience of the profession.

*http://lawprofessors.typepad.com/adjunctprofs/2011/07/chief-justice-roberts-comments-on-legal-scholarship-today.html