Search News and Articles
New rules regarding the protection of personal data on the way
On 25 January 2012, the European Commission proposed new rules regarding the protection of personal data in the EU. It was suggestions for two draft legislations regarding the protection of personal data in the EU.
On 25 January 2012, the European Commission proposed new rules regarding the protection of personal data in the EU. It was suggestions for two draft legislations regarding the protection of personal data in the EU.
One of the draft legislations is a proposal for an administrative order, with the purpose of regulating the general handling of personal data- in the private as well as the public sector. The proposal is supposed to replace the existing data protection directive from 1995, which has been implemented in Danish law by the Danish Personal Data Act, which will be repealed if and when the new proposal is passed.
In the light of the rapid development with regards to online services - and consequently, the new challenges with regards to protection of personal data, which have developed since the adoption of the data protection directive in 1995, the proposal for an administrative order set the stage for an update and modernisation of the regulation regarding handling of personal data governed by the existing data protection directive.
The proposal for an administrative order contains changes to the existing legal position among others on the following areas:
- The ground is prepared for the individuals' right to be forgotten, which has special importance to internet users' option with regards to deleting personal information, which is registered online.
- The requirements regarding the registeed persons' consent to the handling of personal data is in every sense more strict in that a consent must always be given explicitly.
- The registered persons' rights with regards to gaining access to their own information and the possibilities of transferring the personal data of their own motion from one supplier to another are strengthened too.
- The administrative order impose an obligation on the data controller - both companies and public authorities - who is obligated to inform the personal data protection authority (within 24 hours) in case of serious breach of the data safety.
- The national data protection authorities will be granted the power to hear complaints from persons belonging to EU country involved, event if the company or authority handling the personal data belongs to a country outside the EU.
- The ground is prepared for an EU legislation that is applicable even when the personal data is handled by companies outside the EU conducting business within.
- The intent is that the individual, national data protection authority shall deal with everything regarding a company's handling of personal data in the entire EU. Generally this will make it significantly easier for the company to handle personal data.
- It is suggested to introduce new provisions regarding sanctions for violations of the rules regarding the protection of personal data. These rules are inspired by existing rules regarding violations of the competition legislation. It is proposed that the data protection authorities should be given the capability to impose penalties on a company of up to EUR 1,000,000 or 2 per cent of said company's global turnover. The penalties start at EUR 250,000 or 0.5 per cent of said company's global turnover.
The second proposal is for a directive, which aims to regulate the handling of personal data within the member states' police and prosecution authorities. The adopted proposal should replace the existing framework decision of 2008 regarding the protection of personal data in connection with police co-operation and legal co-operation in criminal cases.
The European Commissions proposal will now be discussed by the European Parliament and the member states.
The administrative order would be enforceable in all member states 2 years after it has been adopted. In this connection the European Commission has announced that the proposed administrative order is expected to be adopted within 3-4 years at best.
Should you have questions relating to the proposals or relating to personal data protection in general, feel free to contact partner, attorney Johnny Petersen jp@delacourdania.dk, and partner, attorney Thomas Munk Rasmussen tmr@delacourdania.dk