Brussels, 04/03/2014 (Agence Europe) - On Tuesday 4 March in Brussels, European ministers for justice held an exchange of views that reached a relatively high level of consensus on the data protection dossier, particularly with regard to the question of the regulation's territorial scope, data portability, supervisors' obligations and the question of international transfers.
The European commissioner for justice, Viviane Reding, even said that they had made good progress and she welcomed the transition to the “Greek Spring”, following the Lithuanian “hibernation”.
Despite criticism made by a number of intractable countries such as the United Kingdom, the Netherlands and Hungary, the debates that took place on Tuesday, left a certain amount of room for optimism about the chances of the Council reaching an agreement on a partial approach (a number of chapters) in June. Trialogues would then be able to take place between the three institutions (Council, Parliament, Commission), according to certain sources. On 12 March, the European Parliament will adopt its position during the plenary session.
Most of the delegations congratulated the Greek presidency on the work it had undertaken in this area and decided to put the controversial subjects to the side (such as the issue of the one-stop shops, which had led to a showdown between the Council and the Commission last December) in an effort to make progress. The presidency also laid the groundwork for the other chapters in the regulation. On Tuesday, it called on ministers to confirm the outcome of their informal discussions in Athens.
The presidency therefore obtained the broad support of member countries on the fact that all companies, even those based in non-EU countries, should respect European rules when they provided services to Europeans. It did, however, receive criticism on this point from United Kingdom and the Netherlands, which do not see how the EU could compel countries from third countries to respect European rules. The Dutch representative pointed out that, “we need to be realistic, the EU is unable to impose its rules”. Chris Grayling from the United Kingdom rather sarcastically retorted that if they were going to be able to apply the rules, they needed a framework for them in the EU and that they still had a lot of work to do on this subject before it they would be able to achieve this.
One source close to the dossier said that applying these rules was completely possible by way of “adequacy decisions” being taken by the Commission. These decisions would mean that international data transfers would be authorised if the country in question displayed an equivalent level of data protection. They can also be applied through the application of binding corporate clauses between companies or appropriately justifiable derogations. One observer thought this exercise was more sensitive and that they would need to encourage non-EU companies to be as respectful of the rules as their European counterparts and demonstrate their good faith in this respect. The source added that despite all this, they would not necessarily be able to apply European rules in this field.
The criticism voiced by the United Kingdom focused on “pseudonymisation” in the regulation and the part on risk-based approaches. This technique consists of excluding a maximum number of identifying factors personally linked to an individual but which could be used, for example, in data for research into diseases, explained one source. The British secretary of state, however, pointed out that this was a technique and not a concept and that it was pointless to include this provision in the regulation.
The Greek Presidency obtained the overall support of member states on this point, as it did on the question of automatic citizen profiling, which can only be authorised with individual intervention in very specific cases. The presidency proposed that they stuck to the current 1995 directive on this point, which already includes a provision for natural persons not being subject to a decision that is exclusively based on automatic treatment and which produces legal effects in their regard or affects them in any significant way. For example, an insurance company would be prevented from demanding risk premiums from people it had received data for through automated systems (by collecting it and in intelligence), without any contact with the person in question.
Many delegations referred the discussions back to the working groups and called for the proposals to be improved. The German representative said that, “obviously, we cannot say that we reached a general agreement today”. He also noted that there were still a number of difficulties regarding the guarantees included in data transfers to third countries and that the, “requirements are not really ideal”.
Christiane Taubira, the French minister, had earlier indicated that this obviously involved the “Safe Harbour principles”. She also underlined that these principles should be re-examined and strengthened, as Viviane Reding was committed to doing, by demanding that the US authorities introduce the necessary improvements by next summer. (SP)