Luxembourg, 15/06/2015 (Agence Europe) - More than three years after the legislative proposal was presented, EU justice ministers, meeting in Luxembourg on Monday 15 June, adopted their position on the regulation on personal data protection.
This political agreement in principle will allow the member states to open negotiations with the European Parliament on 24 June. The fate of the directive on personal data in criminal and police matters has now been placed in the hands of the incoming Luxembourg Presidency.
Latvian Justice Minister Dzintars Rasnacs described the agreement as “historic”. He pointed out that it had come after “three years of intense discussion”, though stormy might be a more accurate description. Reform of the 1995 directive was influenced by the revelations of Edward Snowden in mid-2013 on mass surveillance and the activities of the NSA and by a number of EU Court of Justice rulings, such as the one in May 2013 on the “right to be forgotten”. Disputes grew, too, between national data protection authorities and internet giants such as Google and Facebook, which have been suspected of delaying the process.
On Monday, ministers decided they were in a position to be able to adopt a balanced compromise, addressing the interests of both citizens and companies. Justice Commissioner Vera Jourova said that the text provided a sound starting point, while making clear that it can be further improved.
This cautious enthusiasm was largely shared by the ministers who are looking to the negotiations with the European Parliament to fine-tune the text. Some countries, however, found it impossible to overcome their reservations and decided not to back the general approach. Austria and Slovenia went as far as to express their serious concerns, particularly on the treatment of personal data for purposes other than those for which initial consent was given.
This point, justified by the legitimate interests of third company/companies, could prove to be a source of friction with Parliament. Austria was of the view that this aspect of the reform amounted to providing less good protection than what it currently offers within its borders. Minister Wolfgang Brandstetter, however, expressed confidence that “a consensual solution will be reached in trialogue”. The incoming Luxembourg Presidency announced “its firm intention of concluding the reform before the end of the year”, through Justice Minister Félix Braz. Some, however, feel that this is a challenge that will be impossible to meet.
The regulation is to improve the level of data protection compared with the 1995 version and enhance citizens' rights, for example, offering the right to erasure of data rather than the right to be forgotten, which does not feature as such in the compromise.
Citizens' unambiguous consent required. The text requires citizens to give their “unambiguous” consent for use to be made of their data, processing that can be done by the person in charge of data of a private or public company on a legal basis that comprises six criteria (including data used to perform a contract, unambiguous consent was given, treatment meets a legal obligation or is still necessary for the vital interests of the citizen). Consent may be written, oral or by ticking a box. It must be clear that the citizen is fully aware of what use may be made of his/her data. Consent must be given for all the types of treatment that may be applied. A derogation is permitted, however, which, in certain circumstances, allows the interests of the company to override those of the person concerned and his/her fundamental rights.
One of the key points is the “one-stop-shop” mechanism to make things easier for companies and citizens who want to lodge a complaint. Citizens will now be able to contact their national authority and it is this national authority which, in principle, will decide on the action to be taken. In major transnational cases, an authority may deliver the decision in conjunction with the other authorities involved, within the framework of a mechanism that ensures the consistency of decisions and allows recourse to a European board. A company providing services in various member states will have only one point of reference, the authority of the country where it is headquartered. This mechanism is far from being considered by some countries as sure to make life simpler. The United Kingdom and Poland see in it a complex and bureaucratic arrangement that could be the source of many disputes.
The regulation stresses the specific situation of small and medium-sized companies who have been granted numerous derogations and the flexibility and responsiveness of the rules for public administrations.
Sanctions may be as high as 2% of a company's global annual turnover. In March 2014, the European Parliament argued for 5%.
The Parliament has welcomed the agreement. Its rapporteur, Jan-Philipp Albrecht (Greens/EFA, Germany) will seek to bring the positions together, though tensions are expected over companies' obligations. “Clearly there are differences”, he said, persuaded that “constructive” negotiations will allow the European legislator to meet the deadlines set. (Solenn Paulic)