EU Data Protection Regulation Latest News

The EU Council of Ministers, comprising the Justice Ministers from Member States, is on course to reach a final position on all the amendments it would like to see in the European Commission’s original proposal from January 2012.

The Advertising Association’s (AA) Data Protection Group, which is chaired by the DMA’s executive director Chris Combemale met yesterday afternoon to discuss the regulation. The group was, overall, happy with the general progress of the negotiations.

The group received an update from FEDMA, which represents Europe’s national DMA’s in Brussels, on the latest Council text. The Data Protection Group agreed that the Council has adopted a business friendly agenda and there are some indications that the Commission will be willing to make compromises in the upcoming trilogue negotiations between Council, Commission and Parliament.

The latest Council text includes a number of changes relevant to one-to-one marketing such as changes to the definition of consent, which widens the scope for businesses to gain consent. It reads, “informed indication of the data subject’s wishes, either by a written, oral statement, if required by specific circumstances, by any other clear affirmative action”.

An example of such an action would a tick-box in an online form.

There has been some tinkering with the wording for legitimate interest to process data. The Italian text did read, “processing of personal data for direct marketing purposes can be regarded as carried out for a legitimate interest”.

However, the latest text uses the word ‘may’ instead of ‘can’ and could be viewed as a slight weakening of the provision. But in reality this change will not have an effect.

The Parliament text is still better than the Council text on legitimate interest. The DMA has been lobbying for the Council to adopt the Parliament definition so the two texts will be aligned on this issue. The Parliament text includes a specific reference to pseudonymous data not contained in the Council text it says, “processing limited to pseudonymous data should be presumed to meet the reasonable expectations of the data subject”.

The Council has adopted a definition on profiling more akin to the definition for automated processing used in 1995 directive and with which the industry is already familiar. The data subject has the right to object to automated processing or if there is a significant effect on them. Whereas the Parliament text has a de facto ban on profiling unless there is consent. The Council text is much closer to what we hope to achieve than either the Commission or Parliament text, although in a meeting Commission officials stressed to the DMA that they never intended to stop profiling by marketing companies.

It is important to remember that the Council text, while nearly finished, still has some way to go yet as chapter III (rights of the data subject), VIII (liability and sanctions) and definitions in chapter I need to be agreed. There is plenty of scope for the text to change whether that is for better or worse is not yet known.

At the same time the Council is also reviewing issues, which were agreed under the ‘partial-general approach’. This ‘partial-general approach’ means that in order to satisfy political pressure from the European Commission and the European Parliament, the Council could agree on individual chapters of the draft Regulation while at the same time saying “nothing is agreed until everything is agreed”.

The current review process will ensure that there are no discrepancies between different chapters.

At the end of June there will hopefully be three versions of the draft Regulation: the European Commission’s original proposal dating from January 2012; the amendments approved by the European Parliament in March 2014; and the amendments approved by the Council in June this year.

Representatives from each of the three institutions will then sit down in three way negotiations – the Trilogue - to agree a final version of the text. The three institutions will have large disagreements on a number of issues and so it is impossible tell what form the final version of the Regulation will take.

Trilogue negotiations happen in secret and there are political trade-offs. For example, the Parliament may trade their definition of personal data with the Council to ensure their definition ‘explicit consent’ was in the Regulation. This is only an example of the type of trade off that happens in trilogue negotiations.

It is likely that the trilogue negotiations will take between six to nine months to complete. The first trilogue meetings have been scheduled for 25 June and 14 July. The new Regulation is likely to complete its passage through Brussels in the first quarter of 2016 and it will have to be implemented into UK law and the laws of the other Member States two years later, so in the first quarter of 2018.

The DMA and FEDMA continue to work the UK and EU to ensure the best outcome for DMA members. In June the DMA with the AA will travel to Brussels on a lobbying trip to meet with members of the EU Civil Liberties, Justice and Home Affairs (LIBE) Committee, who will be attending Trilogue negotiations representing the Parliament.