EU privacy laws will apply to non-European businesses

• The proposals at a glance
• How will this impact MY business?
• Details of the proposals' impact
• What other organisations are saying
• Useful links
• DMA research and advice
• Latest updates

EU privacy laws will apply to non-European businesses
The EU Council of Ministers reached a partial agreement on rules governing the transfer of personal information about EU citizens to countries outside of the EU by businesses at their meeting earlier this month.

However, they have yet to agree on key areas of the draft Data Protection Regulation and there was no mandate to enter into three-way negotiations with the European Parliament and the European Commission.

This means that the Regulation is unlikely to complete its passage through the European institutions until 2015 and will not have to be implemented into UK law until 2017.

EU Council of Ministers reach partial agreement on:
1. The territorial scope (the Regulation will apply to personal information of EU Citizens no matter where in the world the information is processed.

2. The definition of Binding Corporate Rules (a procedure enabling global groups to transfer personal information between subsidiaries within that group even if the subsidiaries are based outside Europe).

3. The definition of international organisations, such as the United Nations.

4. The rules on transferring personal information to countries outside Europe.

One-stop shop mechanism
No agreement was reached on the one-stop shop mechanism, which would allow businesses to deal with one national data protection authority in the EU – the one where the business carries out its main data processing activities. (Some Ministers expressed concerns about the risk of 'forum shopping' by businesses.)

No agreement on key issues for 1-to-1 marketing industry
Key issues still being debated include profiling, pseudonymous data, data portability(the ability of consumers to move their personal information from one service provider to another) and the need for organisations to produce privacy impact assessments on how changes to their data processing activities will affect their customers. The DMA, together with other trade bodies, will make sure that the views of the advertising and marketing industry are part of the debate on these issues.

Viviane Reding, the European Commissioner for Justice, and the Greek Government, who hold the Presidency of the Council of Ministers until the end of this month (June 2014), see this as a triumph. This was almost certainly Viviane Reding’s last appearance before the Council of Ministers in her capacity as European Commissioner for Justice.

Reding will take up her seat in the European Parliament as an MEP following her election in the May European Elections if Jean-Claude Juncker becomes President of the European Commission, as each Member State can now only have one European Commissioner.

The Greek Presidency will produce a consolidated text of the draft Regulation showing what has been agreed to date by the Justice and Home Affairs Ministers.

Italy takes over Presidency of the Council of Ministers
The Italian Government takes over the Presidency of the Council of Ministers and responsibility for the Regulation at the beginning of July. They have already called an informal meeting of the Justice and Home Affairs Ministers at the beginning of July.

What next - Directive or Regulation?
It is likely that they will discuss the key issue of whether the new Data Protection Legislation will be a Regulation or Directive. This is a key issue that has still not been resolved.

The key difference between a Regulation and a Directive is that a Directive gives more flexibility for national governments when they implement the rules into their own national law. This means that, as with current Directive, there are 27 different variations of the current Data Protection Directive and therefore a less harmonised approach across the Member States.

Update following May elections
Following the election of the new European Parliament and with the new European Commissioners taking office towards the end of this year, we are anticipating that both institutions will be focused on internal organisational issues until November This means that both the Commission and the Parliament will only be able to make little if any progress on the Regulation until then.

James Milligan, Solicitor, DMA