Following years of negotiations, the Member States this week agreed on a new EU Data Protection Regulation. Naturally, the Latvian Council Presidency was delighted and concluded that the new Data Protection Regulation, which had been adjusted to the requirements of the digital era, would among other also strengthen the individual rights of citizens. However, the Chief Negotiator for the European Parliament, Jan Philip Albrecht, recalled that in particular with regard to consumer rights and corporate duties, there was still a wide gap between the proposals.

Personal data may only be processed under strict conditions

The most important aspects of the Council agreement refer to a higher standard of data protection, the development of business opportunities in the Digital Single Market, to better instruments to enforce the compliance with data protection provisions as well as to guarantees in respect of transferring personal data outside the EU. One of the ideas to achieve a higher standard of data protection is to determine that personal data may only be collected and processed under strict conditions and only for legitimate purposes. In future, the person concerned (whose personal data is to be processed) must give his clear consent that his data may be processed. From the point of view of the AK, in particular the latter is important but not sufficient, as companies intending to process data should be obliged to obtain the explicit consent of the persons affected. In the opinion of the AK, the effectiveness of the Declaration of Consent under Data Protection Law in an employment relationship should be restricted. Due to the typical power imbalance in negotiations in an employment relationship, employees often agree to give their consent out of necessity and because they are concerned that they might lose worry to lose their job, they do not dare to revoke it later. An aspect, to which too little attention is paid to.

Right to the deletion of and “Right to be forgotten"

The Council agreement shall also enable people affected to have more control over their personal data. To achieve this, the intention is to provide people with easier access to their own data and the right to have this data deleted; the “Right to be forgotten”. However, from the point of view of the AK, in the case of the “Right to be forgotten” on the Internet, not much other than the already existing deletion rights would remain, which would mean that actually no real progress is being made. It was also agreed to restrict "profiling", i.e. the automated processing of personal data, in order to assess personal aspects, for example relating to work performance, economic situation, health, personal preferences, etc.

Negotiations between Council and European Parliament begin on June 24

After both European Parliament and Council have made their positions clear, joint negotiations will start on June 24. The intention is to reach final agreement by the end of 2015. Fact is that the European Parliament has adopted better provisions for consumers. These have to be defended now. Otherwise the danger would be that the protection of personal data – even though it has been recognised as a fundamental right and is beyond dispute - would stand in the way of the trend towards more and more creative data utilisation.

Further information:

General approach - General Data Protection Regulation

AK Position on the Data Protection Regulation