European politicians voted overwhelmingly on Wednesday in favour of new laws safeguarding citizens’ data.
The new Data Protection Regulation was approved with 621 votes for, 10 against and 22 abstentions.
The new law includes higher fines for breaches of data protection law in the EU, up to 5% of worldwide revenue or a fine of €100 million, whichever is greater. The original draft of the text had called for 2 percent, but the European Parliament decided to raise it.
Citizens will also gain the so-called ‘right to be forgotten’. Businesses must comply with any demand by a customer for the erasure of their personal data when there are no legitimate grounds for retaining it. However the European Commission pointed out that this is not a right to re-write history: legitimate reasons to retain data include, for example, newspaper archives.
Explicit consent is also required for businesses wishing to process data. “This cannot be assumed. Saying nothing is not the same thing as saying yes,” explained Reding. Organizations processing people’s data must provide standardized information policies to explain what they’re doing with it and why.
Businesses and organisations will be required to inform users, paying or not, about data breaches “without undue delay.” There is much debate about what constitutes “undue delay”, but Reding has said she believes 24 hours is sufficient time for any organization to notify users.
Under the new regulation, users will have the right to demand that businesses send them all the information they have stored about them. Where requests to access data are “excessive or repetitive”, smaller companies will be allowed to charge a fee for providing access.
A one-stop-shop principle, allowing business to deal with just the data protection authority where they are based, not all 28 across the EU, will be enacted. However, the data protection authority in each member state will be empowered to impose sanctions as well as regular inspections of companies found to be in breach of the rules.
The new law would apply to all companies handling EU citizens’ data, whether they are based in the EU or not.
“The message the European Parliament is sending is unequivocal: This reform is a necessity, and now it is irreversible,” said Justice Commissioner Viviane Reding, who first proposed the law, said in a statement. “Strong data protection rules must be Europe’s trade mark. Following the US data spying scandals, data protection is more than ever a competitive advantage.”
There had been concern that any delay in the vote would see the whole process put into the hands of a new parliament following elections in May. The current parliament will now speak to ministers from the EU’s member states and agree on a timetable to implement the law.
A more negative cast on the vote was taken by DigitalEurope, an organisation representing the technology industry. In a statement released Wednesday, it called the regulation “ill-suited to the digital economy” and said it needed more work. “The text adopted at today’s plenary session of the European Parliament is over-prescriptive. It will hamper Europe’s ability to take advantage of new ways of using data. This will put Europe at a disadvantage to other parts of the world that are embracing the new technologies,” the statement said.
IDG News Service
Ltd
