The General Data Protection Regulation: The Status Of The Negotiations To Implement A New Data Protection Law Throughout Europe - Privacy Protection

Significant progress has been made to finalize the European Commission's 2012 proposal to completely reform the European Union's data protection laws—the new General Data Protection Regulation (GDPR or Regulation). The current EU data protection regime, the EU Data Protection Directive 95/46, is widely considered to be inadequate in light of advances in technology that rely on the use of personal data such as big data analytics. Reform is needed to "future-proof " data protection law while simultaneously protecting the rights of individuals and allowing businesses to utilise personal data.

The proposal is also an opportunity to harmonise data protection law across the European Union. As the current EU data protection regime was drafted as a Directive, each Member State enacted the rules in its own way; the end result being a patchwork of data protection regimes throughout Europe that sometimes conflict with each other. The GDPR will be directly applicable in the same form in all Member States and will, hopefully, reduce the need for specific local advice in each Member State.

In March 2014, the European Parliament published its proposed text of the Regulation following extensive amendments to the Commission's original draft. The European Council of Ministers then published its full draft of the Regulation on June 15, 2015, having debated the Parliament's draft in a piecemeal fashion since March 2014. While agreeing on some key data protection proposals, the Parliament and the Council are in disagreement over others. The Parliament's prescriptive approach reflects the concern over data protection raised by the Snowden revelations during the Parliament's review. The Council, composed of government representatives for each Member State, has adopted a more "risk based" approach, which allows organisations to judge the impact of their data processing activities for themselves. The EU institutions are continuing negotiations to decide upon a final draft which is hoped to be approved by the end of this year.

This article highlights a number of key changes proposed by the various drafts of the Regulation, both those changes where the Council and the Parliament have adopted a similar approach and those where there is a high degree of discrepancy between the EU institutions, all of which will affect organisations which process personal data.

The Regulation introduces the concept of "privacy by design," whereby appropriate levels of security are built into an organisation's data processing procedure.

Privacy by Design

The Regulation introduces the concept of "privacy by design," whereby appropriate levels of security are built into an organisation's data processing procedure. Data controllers are required to take a proactive approach, ensuring that an appropriate standard of data protection is the default position for all data controllers to take.

The Parliament's draft details the obligations of organisations here to a greater extent than the Commission's draft, for example, by requiring controllers to take account of the state of current technical knowledge and international best practice when implementing technical and organisational measures. The Parliament text extends the obligation to data processors. The Council's draft is closer to the Commission's approach, which allows the controller to take account of the cost of implementing the required measures. The Council's draft requires controllers to consider the risks posed to individuals by the processing instead of setting precise benchmarks for compliance, and makes suggestions about how to minimise risk, for example by encrypting personal data or using pseudonymisation.

The current The current Directive has no equivalent concept of privacy by design, so a legal requirement for organisations to change their overall approach to data processing would be a fundamental adjustment for controllers.

Governance

Under the GDPR, data controllers could be required to appoint a Data Protection Officer (DPO) to carry out relevant assessments of an organisation's data processing, although this proposal has been the topic of much debate among the EU institutions. The drafts proposed by both the Commission and the Parliament would obligate data controllers to designate a DPO when their processing reaches certain thresholds. However, the appointment of a DPO is not mandatory under the Council's draft (unless otherwise required by national law).

Data controllers will be required to undertake impact assessments for higher-risk processing. These assessments would generally include an evaluation of the risk posed to the data subject as well as the measures envisaged to address the risk. The Council's draft suggests that only "high-risk" situations would necessitate a mandatory impact assessment, whereas a "specific risk" would trigger an assessment in the Parliament's text. The Parliament also suggests carrying out general impact assessments in relation to the processing of data protection once every two years.

It remains to be seen whether organisations will be able to carry out these relevant assessments without the designation of a DPO, whether such appointment is mandatory or not.

Processor Liability

Processors will have direct obligations to comply with the GDPR under certain circumstances. They also will be liable to sanctions for breaching the GDPR, whereas under current legislation (at least in the UK), all responsibility to comply with the law falls on the data controller. The exact obligations are yet to be agreed upon by the Parliament and the Council, but it is clear that processors will be held accountable for their own level of appropriate security and must document their processing to the same extent required by controllers under the new Regulation. Processors must obtain the prior consent of the controller to employ sub-processors, while controllers must only use processors which provide sufficient guarantees to implement appropriate measures to meet the requirements of the Regulation.

Contracts with third parties will need to be amended to address the shift in responsibilities for processors.

Notification Obligations

The Regulation introduces an express obligation for controllers to notify breaches of security relating to personal data to the relevant data authority where the breach is likely to cause a degree of risk to the data subject. The Council's and the Parliament's drafts require a detailed notification to be made to the data authority promptly. Data controllers must notify the authority within 72 hours of the breach and processors must notify the relevant data controller of the same without undue delay. Controllers must also communicate the fact that there has been a personal data breach to the data subject promptly where there is a high risk to the individual's rights and freedoms.

Policies of controllers and processors that relate to responding to security breaches will need to be amended and tested ahead of the implementation of the Regulation.

The Data Subject's Rights

Individuals will have the right to have their personal data removed from a controller or processor's system or online content (the "right to be forgotten"). The Council has clarified that this right is not absolute and will always be subject to the legitimate interests of the public. Controllers will need to judge whether freedom of expression and information prevails over the protection of personal data.

Data subjects' right to data portability (the right have a person's data transferred to another service provider) has been endorsed by the Council. However, the Council has restricted the application of this right to personal data provided by the individual.

Individuals will also have the right not to be subject to automated data profiling (where this would produce a "legal effect"). The Council's draft allows profiling in specific circumstances (such as tax evasion monitoring) and where data subjects have provided explicit consent. The practical difficulties of obtaining this consent to carry out "big data" analytics projects may be difficult to achieve and profiling may be hard to justify under alternative grounds.

International Application of the Regulation

The Council has retained the extended territorial scope of the GDPR, with the legislation applying depending on the type of data processing being undertaken, not where that processing is being carried out. Data controllers located outside the European Union that process personal data in relation to offering goods or services to individuals within the European Union, or as a result of monitoring individuals within the European Union, will be subject to the Regulation. Non-EU organisations will need to consider whether their activities are caught by the Regulation and whether they must appoint a European representative to take responsibility for their actions.

Individuals will have the right to have their personal data removed from a controller or processor's system or online content (the "right to be forgotten").

Harmonisation

The Commission and the Parliament originally envisaged that the GDPR would ensure that one data protection law would be applicable to all EU Member States under the banner of "One Continent, One Law." However, the Council's draft provides more than 40 exceptions to the application of the GDPR, which are dependent upon additional factors—largely the national laws of the Member States. If these exceptions survive to the final draft, there will continue to be a discrepancy in the national data protection laws throughout the European Union and local advice on data protection laws will still be required on a number of issues.

Furthermore, the Commission's proposal for any national data protection authority to act as a "one-stop-shop" for an organisation's compliance with data protection law throughout Europe has been significantly diluted. The Council's draft still requires organisations to liaise with the supervisory authorities from different Member States where there is an international data protection issue as opposed to dealing with just one authority as proposed by the Commission and the Parliament. If this position remains, the GDPR will be seen as a missed opportunity to harmonise European data protection laws.

Sanctions

The GDPR will see fines imposed on organisations that breach EU data protection law rise well above the current maximum fine that could be imposed by the Information Commissioner Office in the United Kingdom (currently £500,000), for example. The Council's draft supports the Commission's proposal to limit maximum fines for a breach of the GDPR to 2 percent of an enterprise's worldwide turnover, or €1 million, whichever is higher. These levels are significantly lower than the Parliament's suggested maximum fines of up to €100 million or 5 percent of the entity's turnover.

What Next?

The three institutions have now entered a closed door series of negotiations to agree to the final text. Given the informal nature of these negotiations, there is no clear deadline for the parties to come to a consensus on the final version of the GDPR. Tough negotiations will be required to bridge the disparities between the Parliament and the Council, so a final draft is unlikely to be concluded before the end of this year.

Once the legislation is finalised, there is likely to be a two-year transition period to adhere to the new rules. Therefore, the GDPR could be in force throughout the European Union by the end of 2017. Organisations (both inside and outside Europe) should examine the new rules very carefully to identify the changes that they need to make to ensure that they are compliant with the GDPR before it comes into force, particularly in light of the enhanced sanctions.

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.

UK: The General Data Protection Regulation: The Status Of The Negotiations To Implement A New Data Protection Law Throughout Europe