Tag Archives: eu data regulations

EU Data Protection Regulation – Getting closer?

Leave a reply

EU dpaThe EU Regulation is designed to replace the current multiplicity of EU data protection laws with a single set of rules to be applied throughout all Member States.  Time is moving on so it’s important to keep on top of the discussions and updates being published.

Last month’s proposed revisions to Chapter IV (which deals with data controller and data processor obligations) are summarised below.  However, it is worth remembering that “nothing is agreed until everything is agreed” in relation to the Regulation.

Greater discretion for data controllers – risk-based compliance

Businesses will be relieved to see greater discretion for data controllers in complying with the legislation as recent Chapter IV discussions in Europe have moved towards a risk-based approach to compliance.

A balance between privacy and entrepreneurship

EU balanceThe proposed amendments to Chapter IV suggest that data compliance obligations should be proportional to the organisation’s specific data processing activity and associated risks.

Once these activities and risks have been assessed, appropriate privacy and data protection tools should be instigated by the organisation.

Different activities, even where the same data is involved, may quite often have different consequences, requiring different levels of protection. The risk-based approach allows data controllers a more flexible approach in assessing their data compliance responsibilities within the context of their own particular business.

It appears that most countries welcome the risk-based approach, which they view as providing a good balance between protecting personal data and safeguarding businesses and entrepreneurship.

Chapter IV Proposed Revisions 

Below are some examples of the revisions proposed by the EU Council:

  • Data protection impact assessments are only required where “high” risk (for example identity theft, fraud or financial loss) to the rights and freedoms of individuals is involved
  • The appointment of Data Protection Officers is voluntary (unless individual Member State legislation states otherwise)
  • Only data breaches that are likely to result in “high risk for rights and freedoms of individuals” need be reported
  • If stolen or breached data is encrypted or protected in such a way that the data remains indecipherable, there is no requirement to report the breach.
  • Required levels of security measures will be established by considering multiple factors, including the nature, scope, context and purpose of the data processing to be undertaken, in combination with the cost of implementation and the technology available.
  • Only where a data privacy impact assessment indicates that data processing would result in “high risk” to the rights and freedoms of individuals, the supervisory data protection authority should be consulted prior to the start of such processing

There is also a suggestion that data controllers may use “adherence of the processor to an approved code of conduct or an approved certification mechanism” to demonstrate compliance with the obligations of a controller.  So organisations may find it well worth considering selecting only those data processors who have appropriate data security certification such as ISO 27001 or DMA DataSeal.

If you have any concerns about your data compliance in general or the impact of EU changes in your business, contact us on 01787 277742.  Or email victoria@datacompliant.co.uk

Services

Delays to the EU Data Protection Regulation …

Leave a reply

iStock_000025602036SmallThere has been little progress on the draft EU Data Protection Regulation since October.  However, the Greek Government took over the Presidency of the Council of the European Union in January 2014, so it is now up to them to progress this legislation.

It is clear that delays are inevitable. Even if the draft is agreed at the Justice and Home Affairs Ministers Council meeting in June, the process then continues with three-party negotiations between Justice and Home Affairs Ministers, the European Commission and the European Parliament.

That process is unlikely to start before the autumn, which would mean that the EU Regulation must be delayed until the end of this year or, more likely, until early 2015.  This will delay the law coming into force until the end of 2016 at the earliest, and more likely in 2017.

Three aspects of the new legislation that we have not covered in previous blogs are:

·         International Data Transfers:  this is a new certification programme which will allow data controllers and processers to apply for certification under The European Data Protection Seal. The certificate will be gained through an audit of data processing activity and certification granted by data protection authorities or accredited third parties.  The European Data Protection Seal will enable legitimate transfers of data outside the EEA to recipients who also hold a Seal.

·         Data Protection Officers:  though still in the draft stage, it is clear that firms will be encouraged or required to appoint data protection officers (DPOs) to ensure an organisation uses, controls and processes data compliantly, nationally and / or globally.  There are 500 million citizens within Europe, and currently, a DPO is to be appointed if an organisation processes data on more than 5,000 individuals per annum.

·         One Stop Shop continues to be a subject of fierce debate.  It is significantly different from current legislation where a business is always subject to the data protection authority in each and every country in which it operates.  Under the new One Stop Shop rule, a business which operates in several of the EU Member states would only be subject to the national data protection authority in the country where its Head Office is based.

The debate relates to citizens’ human rights – any data protection complaint made against a company whose head office location is in a different country, will mean that individuals must complain to their own national data protection authority, who will then pass it onto the authority in the relevant country.  This complexity will make it difficult for individuals to complain simply and effectively, and argument rages over whether and to what extent this might undermine human rights.

If you are concerned about how the new European legislation might affect you or your business, don’t hesitate to get in touch with Victoria or Michelle on 01787 277742.  Or emailvictoria@tuffillverner.co.uk  or michelle@tuffillverner.co.uk