Brussels, 19/03/2015 (Agence Europe) - National personal data protection authorities in the Article 29 Working Party were highly critical in an opinion on 17 March of the partial general approach agreed by EU justice ministers on 13 March on Chapter 2 of the general data protection regulation.
Indeed, the compromise was not to the liking of all the delegations. It allows later use to be made, including for commercial ends, of users' data without further agreement on their part. The compromise states that, when the purpose of further processing is not compatible with the reason for which the personal data were gathered by the same controller, the further processing must have as its legal basis at least one of the grounds mentioned in paragraph 1, for example, if the person concerned has given unambiguous consent to the processing of his/her personal data for one or more specific purposes; if processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation to which the controller is subject; or if processing is necessary in order to protect the vital interests of the data subject or of another person. Further processing by the same controller for incompatible purposes on grounds of legitimate interests of that controller or a third party shall be lawful if these interests override the interests of the data subject, the text also states.
Austria called for these points to be clarified before June when ministers are supposed to ratify their overall approach. Various delegations are counting on the trialogue negotiations with the European Parliament to bring improvements to the overall level of protection.
Of particular concern to European regulators is the legitimate interests clause which could allow companies to process data even for purposes incompatible with the initial objective. The Article 29 working party says it is “is very much concerned about the proposed provisions on further processing, especially in the context of Big Data. In fact, according to the Council, it will be possible for a data controller to further process data even if the purpose is incompatible with the original one as long as the controller has an overriding interest in this processing. This new possibility offered to the data controller opens serious concerns in the data protection community”, it says. It also takes the view that “this situation would render one of the fundamental principles of the data protection framework, the purpose limitation principle, meaningless and void”.
Such an approach “which conflates the notions of legal basis and further processing for compatible purpose, contradicts the EU data protection acquis and would be illegal under the current legal framework. It could furthermore have no other consequence but to undermine the whole new data protection framework and to dilute the level of protection for EU citizens in comparison to Directive 95/46/EC in force”, the Article 29 Working Party goes on. It therefore “calls upon the member states, the Commission and the European Parliament to take up their responsibilities to ensure that the wording related to further processing in Chapter II of the future Regulation is modified and that the fundamental right to data protection of EU citizens is adequately protected”. (Solenn Paulic)