Europe's New Data Protection Rules

 

 

 

 

A: Today many people, especially young people, are not aware of privacy policies when they create profiles on social networks. At the same time, adults are unaware that their search data can be used by online advertisers. The rules are clear – they require informed consent — but these rules are not being applied uniformly. That is why we need to reform the personal data legislation that dates back from 1995 – the pre-Internet age – to adapt it to the new Internet age. What is needed is clear, plain language informing the citizen what is happening with their data, how and when it is used, what the citizens' rights are and what they have to do to exercise these rights.

 

A: The right to be forgotten will be a central pillar of my reform proposals. People should be able to have their data deleted when data is no longer necessary for legitimate purposes. This should be a right and not only a possibility. The burden of proof should not be on the consumer but on data controllers. The companies that collect the data have to prove why they have to keep the data, rather than individuals having to prove that collecting their data is not necessary. When there has been a data breach – that means that people's data have been unlawfully accessed – companies should have to notify consumers without delay. I have done that already in the telecom sector and am planning to extend it to the Internet now.

 

 

 A: We have already achieved number portability in the telecom sector. Portability of consumers’ data from social networking sites — be it photos or friends' contacts — will be included in the new data protection rules.

 

A: I will make up my mind on the final form of the proposed legislation in the coming weeks and present it to the Council of Ministers and to the European Parliament. Then it will depend on their speed. Member states will also have to individually adapt national rules so it can take some years before the new rules are put into effect.

 

 

A:  We know that one of the big problems today is the patchwork of legislation and interpretation of law in the European Union. Compliance costs companies some 2.9 billion euros per year in unnecessary fees. We want to get rid of this and have one data protection rule for all of Europe. The law will be the same for all 27 member states.

 

A.  National data protection authorities will enforce the rules. That is why a central pillar of the reform is the strengthening of national data protection authorities and ensuring they work very closely together. They must have the rights tools to act, including the possibility to sanction data breaches. Sanctions could be financial or administrative. This will give the legislation the necessary teeth so the rules can be enforced.

 

 

A. Europe is really a front runner in the way it protects the personal data of the individual. Of course, we need to work very closely together with other regions. Dialogue with the U.S. is essential to data protection issues. U.S. Senators John Kerry and John McCain recently proposed a commercial privacy bill of rights, arguing that the U.S. government must act to level the playing field for all collectors of personal data. This shows that things are moving in the U.S. and this is encouraging indeed.

 

 

A: Absolutely. For the last several years I have been going to Davos to meet the IT and media governors on this topic. Data protection is moving higher and higher on the agenda. I am again expecting a busy couple of days in Davos.