The EU Council, which has the final say on the legislation, decided already last autumn that data protection reform would not make it through the current parliamentary session and set a deadline of 2015 for passing the law. EU states have been divided on the law, as some like the UK fear the proposal creates an increased regulatory burden for businesses, especially those operating online and internationally, and other countries, such as Germany, want stronger protection for personal privacy. The Council and Parliament will need to negotiate on the final text of the law before it goes to a vote in the new Parliament.
Designed to replace the existing data protection directive from 1995, the new law aims to give consumers greater control over how their personal data is used, especially online. It also extends EU regulations to businesses based outside the region and handling data on EU residents. The European Parliament vote covered the General Data Protection Regulation. In a separate vote, a majority backed the wider Data Protection Directive, which would also introduce separate rules for the use of personal data for law enforcement purposes.
In response to the recent revelations of mass surveillance by foreign intelligence services, the committee MEPs inserted in the draft regulation stronger safeguards for data transfers to non-EU countries. If a party in a third country requests a company, such as a search engine or social network, disclose personal information processed in the EU, the firm would have to seek authorisation from the national data protection authority before transferring any data. The company would also have to inform the person of such a request.
MEPs also inserted a right for customers to have their data deleted and bigger fines for firms that break the rules, of up to EUR 100 million or 5 percent of annual turnover. The European Commission originally proposed fines of up to EUR 1 million or 2 percent of turnover.
Industry groups have criticised the disclosure requirements, saying it will be difficult for national and international firms alike to implement the required notifications to regulators and customers. EuroISPA, the association of internet service providers, said the proposal was "overly prescriptive" and would be "unworkable in practice", while failing to provide meaningful protection to EU citizens.
ETNO, the association of telecom operators, expressed concern that the proposal discriminated needlessly between national and international firms and could make it difficult for businesses with operations or partners in the US. The GSMA was also concerned about possible discrimination, calling for a rethink to make the rules more technology-neutral and applicable to all players in the internet sector. In particular it fears an extra burden for telecom operators due to the separate rules in the Data Protection Directive, implying a dual regulatory regime that not all internet players would face.
