Brussels, 13/03/2015 (Agence Europe) - “This is a great day for the personal data protection regulation,” said EU Justice Commissioner Vera Jourova on Friday 13 March, reacting to the partial agreement reached by the EU's justice ministers on the one-stop-shop and the broad outline of the regulation (Chapter 2).
In the partial agreement, the ministers moved closer to a broad approach, which is expected in June on the overall approach to reform of the general regulation and the directive on policing. If an overall approach is reached, then three-way talks would be able to begin with the European Parliament. The Commissioner admitted that many issues remained to be thrashed out, but Latvian justice minister Dzintars Rasnacs (whose country holds the rotating presidency) thought it would be possible to make progress on reform. A European source said that the atmosphere was upbeat in the negotiating chamber on Friday, but over and above this desire to move forwards, the actual talks revealed that the compromises on the negotiating table did not meet all the member states' demands. Many delegations are hoping to change levels of protection for users in the three-way talks because they fear that the draft on the table does not even go as far as laid down in the 1995 directive, such as Austria's concern about the multiple objectives and 'legitimate interests' of companies that allow personal information to be made use of. German justice minister Thomas de Maizière suggested on Friday morning, and was backed by other countries, that the ministers spend a whole day in Luxembourg in June if necessary to tie up all the outstanding issues so that a broad agreement can be reached.
The partial general approach agreed upon by the ministers includes a one-stop-shop for dealing with disputes and establishes a single interlocutor for companies, along with general guidelines on how to deal with personal data protection, the legal basis according to which companies may use data, how users are to give their consent and the transfer and use of data for scientific ends. For the one-stop-shop, companies will have a single national regulatory body even if they operate in a number of countries. The regulatory body will be the one for the country where it has its head office. This seems simple on paper, but is more complicated for disputes or court cases about the use of personal information. Under the arrangement that has been reached, for example, someone living in France for whom Facebook refuses to remove a photo from the internet would have to take this to the national authority in France, CNIL. And then CNIL would have to rule on Facebook's decision and any penalties to be applied to Facebook. But for disagreements about CNIL's decision by other national bodies that are also involved in the case, it would be possible to lodge an appeal to a board, a European data protection committee comprising the European Commission and the member states, as long as important issues are at stake (the definition of 'important' may be based on a discussion or tacit agreement rather than necessarily any detailed criteria). If the said internet user in France disagrees with CNIL's ruling, he would be able to challenge the decision at a French court. A national regulator would be able to take decisions taken by the board to the European Court of Justice.
An over-complicated one-stop-shop?
Ireland and the United Kingdom made it clear on Friday that they are not happy with the one-stop-shop, even though it allows some proximity for individuals. Ireland says that although the threshold at which use of the board would be possible has not been set, it is welcome news that it would only be used for important cases in order to avoid unorthodox cases and not drown the board in petty cases. The Irish delegation calculated that the decision-making process for disputes could last as long as four months from the taking of a decision by a national authority, notifying the regulators concerned and any appeal against the decision. Not to mention any appeal to the board or the European Court of Justice, added Irish justice minister Dara Murphy. The United Kingdom takes a similar line. Justice minister Edward Faulks said he was disappointed that there wasn't any threshold for making appeals to the board, and feared that this would slow down the decision-making process. He said it was cumbersome, bureaucratic and made work difficult. The UK does not oppose the general approach. On this issue, a number of delegations, including Ireland and Germany, called for a review clause to assess how the one-stop-shop works in practice and how it deals with its first cases. The Commissioner said that the regulation already contained a review clause for the one-stop-shop (in four years' time), which could answer the ministers' request.
Clarification required on commercial use of personal information
There are concerns and even worries about other issues too, such as Chapter 2 of the Regulation, over which partial agreement has been reached. Austria, backed by Italy and other countries, wants more details and guarantees about companies' “legitimate interests” that would give them the right to use information (6 or 7 legal reasons are foreseen in the regulation). Austrian justice minister Wolfgang Brandstetter said that in order to be entitled to process information, one needs a properly motivated and substantial interest, but this was not properly expressed in the draft legislation. Another concern is about how different companies would use the information later on. Would a data controller at Amazon have the right to pass on an Amazon customer's private information to a similar company without the customer giving extra consent for this? This question was not solved on Friday and is of particular concern to Austria and Luxembourg, which fears that it could lead to a weakening of users' rights. France says that the clauses on the use of information for medical research or statistical purposes are unsatisfactory at present. French justice minister Christiane Taubira said they didn't go as far as the rules set out in the 1995 directive. (Solenn Paulic)