April 19, 2016

Parliament’s vote has ended more than four years of work on a complete overhaul of EU data protection rules.  The reform will replace the current Data Protection Directive (95/46/EC), which dates back to 1995 when the internet was still in its infancy, with a general Regulation designed to give citizens more control over their own private information in a digitised world of smartphones, social media, internet banking and global transfers.

The new rules include provisions on:

• a “right to be forgotten”;
• “clear and affirmative consent” to the processing of private data by the person concerned;
• a right for individuals to transfer their personal data to another service provider;
• the right for individuals to know when their data has been hacked;
• ensuring that privacy policies are explained in clear and understandable language; and
• stronger enforcement and fines of up to 4% of firms’ total worldwide annual turnover.

The data protection reform package also includes a Directive on data transfers for policing and judicial purposes.  It will apply to data transfers across borders within the EU as well as, for the first time, setting minimum standards for data processing for policing purposes within each Member State.

The new rules aim to protect individuals, whether victims, criminals or witnesses, by setting out clear rights and limitations on data transfers for the purpose of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and preventing threats to public security, while at the same time facilitating smoother and more effective cooperation among law enforcement authorities.

The Regulation will enter into force 20 days after publication in the EU Official Journal.  Its provisions will be directly applicable in all Member States two years after this date.

As for the Directive, Member states will have two years to transpose its provisions into national law.

Due to what the Commission calls the UK’s and Ireland’s “special status regarding justice and home affairs legislation”, the Directive will only apply here to a limited extent.  To read the European Parliament’s press release in full, click here.