Brussels, 25/01/2012 (Agence Europe) - Giving precedence to the right of European internet users to know how their personal data are used and imposing new requirements on companies, without harming small businesses. These are the challenges that Justice and Fundamental Rights Commissioner Viviane Reding set herself in proposing sweeping reform of EU data protection rules which date from 1995, set out in two legislative proposals: one for a regulation and the other for a directive on police and judicial cooperation. This reform is much needed - “There was no internet in 1995”, Reding pointed out - as more and more Europeans are using the internet to do their shopping and are joining social networks. Her aim is double: boosting the internal market by allowing Europeans to have full confidence in online services, she said, and giving them the guarantee that they can surf the net perfectly safely, particularly on social networks without any fear, for example, that companies such as Facebook or Google can make use of, or even sell on, their data. On this last point, the most symbolic measure is the “right to be forgotten”, which Reding is seeking to impose on all players in the sector. If her proposals are adopted, Reding believes the EU will become the world data protection champion.
In concrete terms, the commissioner's proposed reform will require companies to be given “explicit” consent before they can re-use any person's data, and they will also have to inform the person of the use that is to be made of the data. Companies will also have to prepare and make provision for informing users of their site of the right to be forgotten and data deletion. The reform will also require companies to have a data protection officer, and to assess regularly and report on the state of data protection. They will be required to report any breach of European rules as quickly as possible to national protection authorities - within 24 hours where possible. To make things easier, the commissioner says that companies, whether European or American, will deal only with the data protection authority of the country where they are headquartered. Companies will, thus, make savings in time and money, no longer having to comply with differing rules across the EU, but only having to observe the rules of the country where they have their headquarters, rules which will reflect the European arrangements. Reding says that this change could save companies up to €2.3 billion per year. She also provided for exemptions for small companies. Small businesses will not be required to engage data protection officers, nor will they have to produce data protection reports. But woe betide any which openly flaunt the rules: all companies will face penalties of up to 2% of their turnover (0.4% being the minimum level). In the event of a complaint - Reding made reference to Austrian student Max Schrems who, in 2011, accused Facebook of retaining deleted data and of setting up false profiles - the complainant, in such a case as this, would refer the matter to the Austrian authority which would contact the Irish authority (Facebook is headquartered in Ireland) and together these two authorities would deal with the case.
In home affairs and the revision of Framework Decision 2008/977/JHA, Reding intends to ensure observance of fundamental rights in all police and judicial operations which often have to deal with personal data retention and the transfer of personal data to other member states or to third countries. Here the commissioner proposes that all 27 member states apply the same rules. Some points in previous versions of the directive had been of concern to Home Affairs Commissioner Cecilia Malmström. An early draft, she said, would endanger cooperation with certain third countries, as, for example, when the United States asks a company to provide information on an individual on whom its suspicion has fallen. This point has been removed and a preamble allows for such requests if there is real public interest on the part of the body making the request and if they are recognised by European law. The Reding camp said on Tuesday that it was happy with this reformulation, in which she won more than she lost, it was felt.
Even before it was presented, Reding's ambitious proposal for reform had given rise to questions and criticism. “Everyone is in agreement” on the principles, confided a spokesman for one of the major counties on Tuesday. However, implementation could prove to be problematic. Some wonder about the feasibility of the “right to be forgotten”. This is a concept that goes down very well “on television”, said the above source, but is one that may prove impossible to put into application. The United States, very sceptical, inter alia, of the right to be forgotten and requirements on alerting the authorities in the event of problems with the rules, have lobbied intensively on this text, a Commission source revealed. (SP/transl.rt)