Draft EU Data law criticised in UK and Brussels

Politicians and lawmakers in London and Brussels have criticised the draft EU Data Protection Regulation, saying it is too prescriptive and unworkable in its current form. The UK Ministry of Justice (MOJ) has estimated that the draft regulation could cost the UK up to £360m per year. The Justice Select Committee has called for the EU data protection proposals “to go back to the drawing board” while the European Commission plans to make changes to the text.

Draft Regulation could cost UK up to £360m per year
The MOJ has just published its final version of the Regulatory Impact Assessment into the draft Regulation. It estimates that in its present form the draft Regulation will lead to a net cost of £100-£360m per annum in 2012-13 earnings terms for the private and public sectors.

The MOJ also believes that the EU Commission headline saving of €2.3bn is too high because the figure over-estimates the benefits, does not include policy costs and under-estimates the administrative costs.

The Impact Assessment also refers to figures from the DMA’s publication Putting a Price on Direct Marketing http://dma.org.uk/toolkit/putting-price-direct-marketing

and figures which a member provided as a cost-estimate in respect of the right to be forgotten provisions.

The UK Government will no doubt use the Impact Assessment in its negotiations in the EU Council of Ministers and it will be helpful to the DMA and other organisations in their lobbying efforts.

“Back to the drawing board” says Justice Select Committee
The House of Commons Justice Select Committee has called for the EU data protection proposals to go back to the drawing board in its report, published on 1 November. The report says EU proposals to update data protection laws are too prescriptive and unworkable. Concerns include explicit consent, the right to be forgotten and data breach notifications. The Committee has said the European Commission needs to “devise a regime which is much less prescriptive, particularly in the processes and procedures it specifies”.

They are all issues that the DMA raised when it submitted evidence to the Justice Select Committee’s inquiry. This follows a ministerial roundtable meeting, where the DMA joined other industry bodies to voice their concerns about the draft Regulation.

Information Commissioner Christopher Graham told the Committee that the Information Commissioner’s Office (ICO) would require a further £28m worth of funding to enforce the proposed system of penalties and fines in the current draft of the Data Protection Regulation. The system in the draft Regulation, he said, “cannot work” and is “a regime which no-one will pay for.”

The Committee also made the following comments on the draft Regulation:

Too prescriptive and inflexible
The draft text contains prescriptive rules, which means that there is no flexibility to adjust to individual circumstances. The Committee can understand why the European Commission wanted to use a Regulation rather than a Directive. A Regulation has the potential to make data protection compliance easier, particularly for SMEs who wish to trade across all the 27 Member States of the EU, because of the greater harmonisation a Regulation offers over a Directive

EU should focus on harmonisation
The draft Regulation should focus on stipulating those legislative elements that ensure harmonisation of rules across the 27 Member States of the EU. The national data protection authorities of the Member States should be entrusted to handle the non-essential elements, such as compliance.

Involve all stakeholders in impact assessment
The European Commission should produce a full impact assessment of the proposals in the current text of the draft Regulation with the input of all stakeholders. The existing impact assessment concentrates on the administrative savings to business with the abolition of the notification fee without looking at the cost to business of the new compliance requirements.

The Committee supports the UK Government and the ICO in their efforts to ensure that the necessary changes to the draft Regulation can be agreed during negotiations.

European Commission agrees to changes to Regulation
Over in Brussels, European Commissioner Viviane Reding has confirmed that the European Commission is prepared to make changes to the draft Data Protection Regulation in three areas:

• SME exemption
• Delegated Acts
• Public sector issues.

SME exemption
The European Commission is prepared to look at whether the existing SME exemption in the current draft text could be extended so that a small hairdresser is not subject to the same rules as a multinational company. The Commission may look to add further flexibility through an approach that takes into account the amount and sensitivity of the data processed.

Delegated Acts
The current draft text gives the European Commission powers to issue delegated acts in the future in certain key areas. Several stakeholders have raised concerns that this creates legal uncertainty. The Commission is prepared to review the power to issue delegated acts one by one with the Member States and to limit them to only what is truly necessary. This could lead to a 40% reduction in the number of areas where the delegated acts powers are required.

Public sector issues
The European Commission accepts that specific rules for the public sector are necessary in some cases, for example, where there is public access to registers, such as land records. However, it is not prepared to give a general exemption for the public sector.

European Parliament Committees consider amendments
The European Parliament Committees looking at the draft text of the Regulation are now considering amendments to include in their Opinions. The DMA, on its own, and with the UK Data Industry Group and FEDMA has sent suggested amendments to the Committees. This is backed up by a lobbying campaign of MEPs and other key individuals.

Justice Committee report: key dates
The Justice Committee, which is the lead committee, will publish its draft report around 17 December. The deadline for amendments to the draft report will be February 2013, with the final report due to be published in April 2013.

The DMA will continue to update members of developments through this newsletter.

Contact James Milligan, 020 7291 3360.