Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Authors: <a href="http://www.bakerlaw.com/gonzaloszeballos/">Gonzalo Zeballos</a>, <a href="http://www.bakerlaw.com/jamesasherer/">James Sherer</a>, and <a href="http://www.bakerlaw.com/alanmpate/">Alan Pate</a> Fighting the war on two fronts: External Outside of the EU, concerns continue after the former NSA contractor Edward Snowden leaks demonstrated issues related to <a href="http://www.out-law.com/en/articles/2013/november/change-in-attitudes-towards-data-protection-in-germany-behind-move-to-include-privacy-issues-in-eu-us-trade-talks-says-expert/">U.S. handling of European data</a>. Beginning in July, 2013, the ongoing Transatlantic Trade and Investment Partnership (TTIP) talks were seen as a focus of <a href="https://www.privacyassociation.org/events_and_programs/iapp_europe_data_protection_congress_2013/breakout_sessions_dpc13">cross-border interoperability</a>, with Germany initially applying internal pressure to include commercial spying rules during the negotiation before Viviane Reding, EU Justice Commissioner and vice-president, confirmed that data protection would not be <a href="http://www.ft.com/cms/s/0/92a14dd2-44b9-11e3-a751-00144feabdc0.html#axzz2mKjv8QZV">part of the negotiation</a>. In contrast, Ms. Reding stated that the EU expects that the U.S. will pursue &ldquo;necessary legislative change&rdquo; by the summer of 2014 to allow EU citizens the &ldquo;<a href="http://www.bloomberg.com/news/2013-11-19/u-s-eu-officials-seek-data-protection-plan-by-2014s.html.">right of judicial redress</a>&rdquo; to sue in the U.S. if EU <a href="http://www.reuters.com/article/2013/11/27/us-eu-data-idUSBRE9AP0NW20131127">citizen data is misused</a>, a right &ldquo;[e]very U.S. citizen in the European Union already enjoys&hellip;irrespective of whether he or she is resident in the EU.&rdquo;&nbsp; The European Commission (EC) released a memorandum relating to EU-U.S. data flows on November 27, 2013, focused specifically on &ldquo;large-scale U.S. intelligence collection programmes,&rdquo; which &ldquo;have had a negative impact on the<a href="http://europa.eu/rapid/press-release_MEMO-13-1059_en.htm"> transatlantic relationship</a>.&rdquo; There, the EC reported on findings of the July 2013 EU-U.S. Working Group and&nbsp; analyzed the function of the current EU-U.S. safe harbor, which has been in place since 2000. In contrast, the United States has indicated that the current safe harbor &ldquo;remains an effective way of protecting online data for both <a href="http://www.nytimes.com/2013/11/28/business/international/europe-urges-us-to-handle-data-privacy-with-care.html?hpw&amp;rref=business&amp;_r=0">American and European consumers</a>.&rdquo; Despite differences in approach and philosophy, the EU and the U.S. are working toward completing an agreement by mid-2014 that would protect the private data of individuals while still sharing information for law enforcement purposes; this follows talks that began in 2011 and have survived 15 negotiating rounds. Internal The Snowden affair has galvanized some internal activity within the EU, where in-process data privacy legislation has been gridlocked for nearly two years <a href="http://www.theguardian.com/world/2013/oct/22/breakthrough-data-privacy-rules-europe">due, in part, to U.S. pressure</a>. Previously, the U.S. had successfully lobbied for easing of data transfer rules, but tight data transfer regulation was reintroduced, which proscribes those practices unless explicitly allowed. Such lobbying was explicitly noted as sometimes being &ldquo;counter-productive&rdquo; in the context of EU data protection that was, instead, strengthened by the <a href="http://ec.europa.eu/commission_2010-2014/reding/pdf/news/20131022-libe-data-protection_en.pdf">European Parliament</a>. On October 21, 2013, the Committee for Civil Liberties, Justice and Home Affairs&rsquo; (LIBE) Members of European Parliament (MEPs) voted 49-1 (3 abstentions) on changes to current EU data protection rules to replace the current patchwork of national laws. The proposed law would take the form of a Regulation, rather than a Directive, and the changes include a number of modifications and clarifications, including: <ul> <li>Moving from an individual Member State-by-State national regulation scheme to a pan-European &ldquo;one-stop shop&rdquo; data protection law.</li> <li>Providing an <a href="http://uk.reuters.com/article/2013/10/21/uk-eu-data-idUKBRE99K0LF20131021">estimated &euro;2.3 billion</a> per year in benefits.</li> <li>Reiterating the &ldquo;right to be forgotten&rdquo; while still mindful of &ldquo;the right of erasure,&rdquo; a lower bar of compliance that recognizes the now-impossibility of entirely removing an individual&rsquo;s traces from the Internet and provides for the reality of freedom of speech.</li> <li>Defaulting to &ldquo;Privacy by Design&rdquo; and &ldquo;Privacy by Default&rdquo; as &ldquo;essential principles in EU data protection rules,&rdquo; where safeguards are built into products and services from the ground-up, and privacy-friendly default settings are the norm.</li> <li>Increasing imposed sanctions (fines) of up to 5% of annual worldwide turnover or &euro;100 million (whichever is greater) on organizations that break the rules.</li> <li>Seeking limits to user <a href="http://www.bbc.co.uk/news/technology-24622919">profiling that would require organizations</a> to detail prospective customer data use prior to its use. These requirements focus on the collection of the minimum amount of data to achieve the organization&rsquo;s purpose in its collection, and a higher bar for the clarity the organization uses to explain the data&rsquo;s use.</li> <li>Requiring EU supervisor approval before unblocking data-sharing with non-EU countries.</li> <li>Providing the &ldquo;same rules for all companies &ndash; regardless of their establishment,&rdquo; requiring organizations based outside of Europe to apply the same rules.</li> <li>Easing requirements for the data protection requirements associated with small and medium enterprises (SMEs), where SMEs may be exempt from regulations requiring a Data Protection Officer (DPO) if &ldquo;data processing is not their core business activity,&rdquo; and charging for excessive or repetitive requests for data.</li> </ul> The approved legislation will be debated among the European Commission, the European Parliament, and the European Council with the goal of an agreement on major legislative reform prior to the May 2014 European elections and legislation in force by 2016. The European Parliament still needs a subsequent vote and agreement with the 28 EU member states, but despite France&rsquo;s commitment to fast-track the rules (supported by Poland and the European Commission), other member states, including the United Kingdom and Germany, have stressed deliberation on identified issues with the legislation. Based on the U.K.&rsquo;s concerns, which included UK Prime Minister David Cameron&rsquo;s statement that the legislation was &ldquo;wrong&rdquo; and that the EU &ldquo;<a href="http://www.theregister.co.uk/2013/10/28/david_cameron_on_stalling_eu_data_protection_law/">should hold it up so we get it right</a>,&rdquo; EU leaders dropped a prior 2014 deadline and instead pledged to push forward in a &ldquo;timely fashion,&rdquo; saying instead that the regulation and the cyber security directive were &ldquo;essential for the completion of the Digital Single Market by 2015.&rdquo;

International Privacy – 2013 Year in Review – European Union