At the last minute on Wednesday 20 December member states’ ambassadors on the COREPER committee decided on their negotiating position on the free circulation of non-personal data during their last meeting of the year.
Unlike what was desired by France, the document only includes a single derogation for public security (proposed by the European Commission).
The draft regulation creates a single market for non-persona data processing and storage, such as the cloud. It covers groups of anonymous data used for analysing big data, information for farming to monitor and make best use of pesticides and water and data on industrial machinery maintenance.
Limited restrictions
The negotiating mandate issued by COREPER to the future Bulgarian Presidency of the Council of the EU is similar to that proposed by the European Commission in September 2017 (see EUROPE 11861). It bans limits on data being located in a single member states apart from for public security reasons.
Unlike the previous version (see EUROPE 11928), the text the Council has agreed on introduces more derogations for public policy or the exercise of official authority.
However, the compromise states in a referral that the public authorities are not required to outsource their services. The text states that there can be legitimate reasons pushing a public administration to provide services itself or insource them and therefore nothing in the present regulation forces member states to outsource or externalise the provision of services they wish to provide or to organise them using methods other than public tender.
The Council’s position has been welcomed by DigitalEurope. It notes that a country introducing a new localisation requirement would need to notify and justify its plans with the European Commission. likewise, any existing limits on free circulation muse be justified if they are to be kept.
A cooperation mechanism among member states is foreseen whereby the competent authorities could not be refused access to data stored and processed in another member state. The final version says that the competent authorities may impose functional requirements to facilitate data access, such as the need to keep system descriptions and passwords in the member state in question.
More work to be done on responsibility
The Council’s text calls on the EU to examine the quest of responsibility through auto regulation and other best practices. The document states that this should take account of recommendations, decisions and action taken without human interaction throughout the data processing chain. It adds that work may also take into account mechanisms for determining responsibility and the transfer of responsibility among cooperation services, insurance and auditing.
It is now for the European Parliament to decide on its negotiating position so that interinstitutional talks may begin. Parliament’s rapporteur, Anna Corazza Bildt (EPP, Sweden), has not yet published her draft resolution for the internal market and consumer protection committee.
For the Council’s mandate, see: http://bit.ly/2CNdOWx (Sophie Petitjean)