Introduction
Following four years of negotiation, agreement has been reached between the various EU institutions (the Commission, the Council and the EU Parliament) on reform of data protection laws to be applicable across all EU member states.
At present, although the existing directive of 1995 requires all member states to have provisions for the protection of personal data, this is not particularly prescriptive and it was left to each state to legislate as it felt appropriate. Consequently, data protection laws differ widely across the EU. The new General Data Protection Regulation aims to address this and will comprise one set of laws applicable uniformly across all member states.
Key provisions of the new regime
The new Regulation must now be formally ratified by the EU Parliament which is expected this month. The key provisions of the agreed draft of which you should be aware are:
- Breaches of protection (for example, by hacking) must be reported immediately to the regulatory authority in each country.
- The steps taken by a company to comply with the Regulation must be documented.
- Businesses handling significant amounts of sensitive personal data, or which monitor consumer behavior, will be required to appoint a dedicated data protection officer.
- The right to be forgotten – for personal data to be deleted either when it is no longer current or on request of the data subject.
- The right to data portability across service providers.
- Companies based outside the EU must comply with the Regulations when offering services within the EU.
The agreed draft also contains a tighter definition of consent than is currently contained in the UK Data Protection Act 1998 (albeit that this definition was always present in the underlying directive of 1995). This means that any consent to the processing of personal or sensitive personal data in the UK must be freely given, specific, informed and unambiguous once the new Regulations are in force. The requirement that consent be freely given is likely to be difficult to achieve in an employment context as noted by previous guidance from the Information Commissioners Office on this topic.
What should we do now?
Enforcement will also change significantly and become a far greater business risk as under the new regime fines of up to 4% of turnover may be imposed for breaches.
These far reaching changes become applicable from 2018 so businesses should begin to assess how they need to change their policies, systems and processes to make them compliant.
We will report further when the Regulation is available in final approved form.
Contact us
Should you require assistance in assessing how to revise your Data Protection policies to meet the revised rules, please contact us on +44 (0) 203 051 5711 or at info@abbisscadres.com.
Disclaimer
Content is for general information purposes only. The information provided is not intended to be comprehensive and it does not constitute or contain legal or other advice. If you require assistance in relation to any issue please seek specific advice relevant to your particular circumstances. In particular, no responsibility shall be accepted by the authors or by Abbiss Cadres LLP for any losses occasioned by reliance on any content appearing on or accessible from this article. For further legal information click here.
Circular 230 disclosure
To ensure compliance with requirements imposed by the IRS and other taxing authorities, we inform you that any tax advice contained in this article (including any attachments) is not intended or written to be used, and cannot be used, for the purpose of (i) avoiding penalties that may be imposed on any taxpayer or (ii) promoting, marketing or recommending to another party any transaction or matter addressed herein.