Data protection package: Parliament and Council now close to a deal

A “strong compromise” on how to ensure a high level of data protection across the EU was agreed by Parliament and Council negotiators in their last round of talks on the data protection package on Tuesday. It is now up to member states to give a green light to the agreement. The two draft laws in the package – a regulation and a directive – are scheduled for a confirmation vote in the Civil Liberties Committee on Thursday morning.

The draft regulation aims to give citizens control over their private data, while also creating clarity and legal certainty for businesses to spur competition in the digital market.

“Today’s negotiations hopefully have cleared the way for a final agreement”, said Parliament’s lead MEP on the regulation Jan Philipp Albrecht (Greens, DE), adding that “In future, firms breaching EU data protection rules could be fined as much as 4% of annual turnover – for global internet companies in particular, this could amount to billions. In addition, companies will also have to appoint a data protection officer if they process sensitive data on a large scale or collect information on many consumers”.

“The regulation returns control over citizens’ personal data to citizens. Companies will not be allowed to divulge information that they have received for a particular purpose without the permission of the person concerned. Consumers will have to give their explicit consent to the use of their data. Unfortunately, member states could not agree to set a 13-year age limit for parental consent for children to use social media such as Facebook or Instagram. Instead, member states will now be free to set their own limits between 13 and 16 years”, he concluded.

Data protection standards for cross-border police cooperation

The new draft directive on data transfers for policing and judicial purposes will ensure citizens’ rights and freedoms, allowing at the same time national law enforcement bodies in the EU to exchange information faster and more effectively.

“It is of the utmost importance, especially after the Paris attacks, to enhance police cooperation and exchange of law enforcement data”, said Parliament’ lead MEP on the draft directive Marju Lauristin (S&D, ET) after the agreement was reached. “I am very confident that this law will offer the right balance between safeguarding citizen’s fundamental rights and increasing the effectiveness of police cooperation throughout the Union”, she added.

The directive will be the first instrument to harmonise 28 different law enforcement systems with respect to exchanging data – also within each member state. At the same time, it should clarify police cooperation arrangements and give citizens greater certainty as to the law. EU countries may set higher data protection standards than those enshrined in the directive if they so wish.

Next steps

The provisional agreements on the package will be put to a confirmation vote in the Civil Liberties Committee on Thursday 17 December at 9.30 in Strasbourg.

If the deal is approved in committee it will then be put to a vote by Parliament as whole in the new year, after which member states will have two years to transpose the provisions of the directive into their national laws. The regulation, which will apply directly in all member states, will also take effect after two years.