The European Commission has announced plans to reform comprehensively the existing EU data protection regime. The proposals, in the form of a new Regulation and Directive, aim to modernise, strengthen and future-proof the principles set out in the 1995 Directive, which was designed to safeguard a pre-internet society. The new Regulation will sweep away the current patchwork of national laws in favour of a single EU law, valid across all 27 Member States. This will, it is hoped, end some of the legal uncertainty and fragmentation that companies of all sizes face when doing business in Europe.
The proposals include some significant amendments to the existing rules including:
- the strengthening of individuals’ rights to include easier access to personal data, a right to request that all personal data be deleted if no longer necessary, and new rules on obtaining explicit consent;
- increased obligations for data controllers, such as the mandatory requirement to notify security breaches and the obligation for large organisations to appoint a data protection officer;
- the extension of EU rules to companies located outside the EU but which are active in the EU market and offer goods and services to consumers in the EU;
- the reduction of red tape for businesses by removing the requirement to notify all data protection activities to data protection supervisors; and
- the strengthening of national data protection authorities’ powers, such as the ability to impose fines for serious breaches up to €1 million or up to 2% of a company’s annual worldwide turnover.
The proposals will now be passed to the European Parliament and the EU Member States for consultation. If agreed, the new Regulation will take effect two years from the date of adoption and will apply to all Member States automatically.
The proposed Regulation can be found here.
UPDATE: A more detailed discussion of this development can be found here.
