EU ministers have reached an agreement on reforming data protection regulations, opening the way for negotiations with the European Parliament on the final legislation. Designed to replace the existing data protection directive from 1995, the new law aims to give consumers greater control over how their personal data is used, especially online. It includes stricter provisions on explaining how data is collected and used, the 'right to be forgotten' when the data is no longer used, a right to port personal data between competing services such as social networks, limitations on automatic profiling to obtain personal details from basic data, and requirements to disclose any data security breaches to regulators and individuals.
The proposal also extends EU regulations to businesses based outside the region and handling data on EU residents. The law upholds the 'safe harbour' system for transferring data on EU subjects to non-EU countries. These countries must show they offer sufficient personal data protection in order to receive the 'safe harbour' status, to be determined by the European Commission in cooperation with member states and Parliament. The Parliament had called for stricter protections for international transfers, with approval by national regulators and informing the subject required in certain cases.
EU justice and home affairs ministers scaled back the original proposal to allow international companies to choose a 'one-stop shop' privacy regulator in the EU country of their choice. Instead, the one-stop mechanism will apply only in supervisory decisions on important transnational cases involving several national regulators. International data collectors will also be able to agree compliance mechanisms with regulators based on their assessed level of risk.
Data subjects will be allowed to file complaints with national regulations over suspected violations of the law, and appeal any regulator decisions in their own country, regardless of where the regulator is based. The EU ministers also endorsed the EC's proposal for higher fines for violators, of up to EUR 1 million or 2 percent of global turnover. This is less than the EUR 100 million or 5 percent passed by Parliament.
The council's text notably allows a considerable amount of flexibility for member states in implementing several parts of the regulations, particularly in areas involving the handling of personal data for law enforcement purposes. It also inserts a clause noting that data protection is not an absolute right, and must be subject to the principle of proportionately as elsewhere in EU law.
The first so-called trilogue meeting, between the European Commission, Council and Parliament on a final text is scheduled for 24 June.
