The European Commission is set to announce its proposals for new European Union privacy rules on Wednesday. Businesses are anticipating major changes concerning the way in which personal information is managed and some have expressed fears that the proposals may be too strict.
The present regulations have been in place since 1995 and the revisions are expected to harmonise the privacy rules across the EU's 27 member states. Justice Commissioner, Viviane Reding, has proposed that users will be informed when personal data concerning them is being gathered; the reason behind this; as well as the period of time for which the information will be kept. Further features of the new rules include the so called "right to be forgotten" which will enable individuals in most cases to ask for data stored about them to be deleted; this strengthens the concept of "data minimisation" in the existing Directive. Companies will also be required to inform data protection authorities if there is a data breach, within 24 hours of an incident occurring.
Major technology companies Facebook and Google, who are likely to be most affected by the new laws, are on tenterhooks about the rules. However, it is not just large corporations who will be subject to the rules; every company which deals with personal data (for example in a database or in lists) will be required to take notice of the changes. Those who fail to do so are expected to face big fines. In fact, a draft of the new EU rules has indicated that companies may have to pay up to two percent of their worldwide turnover in fines should they fail to comply with the new measures. Depending on the size of the company in question, this could lead to a sizeable figure being paid by way of penalty. The proposals are far-reaching and also cover non-EU companies that operate within the EU.
Whilst there has been a longstanding demand for a single approach to data protection across Europe, critics suggest that the EU Commission's plans, which will overrule the multitude of national privacy laws, are a step too far. Reding, on the other hand, argues that the proposals will help to protect users from over-sharing and will "become a trademark people recognize and trust worldwide."
Before the new Directive becomes law, the proposed regime must first acquire the approval of the EU Member States and be ratified by the European Parliament. Therefore, it may be some time until the new directive is implemented and for the full impact of the rules to be assessed.
Disclaimer
The material contained in this article is of the nature of general comment only and does not give advice on any particular matter. Recipients should not act on the basis of the information in this e-update without taking appropriate professional advice upon their own particular circumstances.
