Out-Law News 1 min. read
09 Jan 2015, 3:00 pm
Jan Philipp Albrecht said the onus is on justice ministers across EU countries to "deliver" the planned new General Data Protection Regulation (DPR), according to a report by EU news website Euractiv.
However, Albrecht said the UK's preference for a new data protection directive as opposed regulation, and German and French concerns about the way any new data protection regime would be enforced are among the main barriers to reform, the report said. An EU regulation has uniform application across EU countries, whereas a directive has to be transposed into the national laws of all 28 EU countries, often leading to slight differences in those rules.
National justice ministers, through the structures of the EU's Council of Ministers (the Council), are currently in the midst of long-running negotiations on the proposed new DPR. Both the Council and the European Parliament must agree on a single wording of the reforms before those changes can be brought into force. The Parliament agreed its position on the DPR in March 2014 but is waiting on the Council finalising its own negotiating position before final talks about the wording of the text can begin.
European political leaders previously committed to finalising the data protection reforms "by 2015", but Albrecht questioned whether that timetable was now realistic, according to the Euractiv report.
"If ministers want a DPR, it will be up to the Council to deliver it," Albrecht said. "If they want to allow companies to do regulate themselves, they have to beef up the rights of individuals to overcome this with stronger levels of protection."
Albrecht, the Parliament's lead rapporteur on the data protection reforms, said that one of the areas of the proposed data protection reforms where there is a difference of opinion between the Parliament and the Council is in relation to the notion of individuals' consent to the processing of their personal data.
According to its DPR proposals, the Parliament wants organisations seeking to rely on individuals' consent to process personal data to ensure that that consent is a "freely given specific, informed and explicit indication" of a person's wishes "either by a statement or by a clear affirmative action".
In contrast, the Council's suggested proposals for new consent rules would, if introduced, require organisations to ensure that consent given by individuals is "unambiguous".
The Parliament also backs plans to allow data protection authorities to serve fines totalling up to 5% of businesses' annual turnover for breaches of the new Regulation. The Council is seeking to cap fines at up to 2% of annual turnover.