In 1913, Parliament was debating the Welsh Church Disestablishment Bill. F. E. Smith described it as “a Bill which has shocked the conscience of every Christian community in Europe”. This prompted a stinging rebuke from G.K. Chesterton: was it remotely plausible that, say Breton fishermen, or Russian peasants, had the slightest interest in any of this?
“ Do they, fasting, trembling bleeding
Wait the news from this our city?
Groaning, ‘That’s the Second Reading!’
Hissing ‘There is still Committee!’
If the voice of Cecil falters,
If McKenna’s point has pith,
Do they tremble for their altars?
Do they, Smith?”
A hundred years later, the European Parliament is debating data protection reform. To suggest that every citizen of the Union is hanging on the words of Jan-Philipp Albrecht or Viviane Reding would invite Chestertonian derision. But there must be a number of businesses that are trembling (if not perhaps fasting or bleeding, as yet) at talk of fines of up to 100 million Euros (or 5% of global turnover, whichever is the greater) for breach of the new requirements. And the level of interest among ordinary citizens, at any rate in some countries in the EU, should not be underestimated.
The above reflections are prompted by the news that the LIBE Committee of the European Parliament has adopted an agreed position on the proposed new Regulations and Directive. This gives a mandate for the rapporteurs – MEPs Jan-Philipp Albrecht and Dimitrious Droutsas – to negotiate with the EU Council on Parliament’s behalf.
The full text of the proposed version of the legislation approved by the LIBE Committee has not been made public. However, this press release from the Commission indicates that there are some important differences between the Commission’s original proposal in January 2012 and the text being put forward by the LIBE Committee. Notably, the Committee is proposing maximum sanctions of 100 million euros or up to 5% of annual worldwide turnover, as compared with 1 million euros or up to 2% of annual worldwide turnover.
The Committee also wishes to strengthen the territorial scope of the reforms. The Commission’s original proposal was that in specified circumstances the Regulation should apply to the processing of personal data of subject residing in the Union, by a controller not established in the Union. The Committee is proposing that the Regulation should apply to the processing by a controller or processor not established in the Union.
The Commission’s proposal was that this extra-territorial reach of the Regulation should apply where the processing activities were related to the offering of goods and services to data subjects in the Union, or to the monitoring of their behaviour. The Committee is proposing that the Regulation should apply to the offering of goods or services to data subjects in the Union irrespective of whether a payment of the data subject is required. So, on the Committee’s text, a social networking site established outside the EU would be caught if it offered membership to individuals in the Union, even if membership was free. The Committee also proposes that the Regulation should apply to the monitoring of such subjects (not just to the monitoring of their behaviour).
The Committee’s text also would prohibit disclosure outside the EU of personal data processed in the EU, where such disclosure was ordered by a non-EU court or tribunal, unless the transfer was authorised in advance by the relevant EU national data protection authority. So, it would appear, if a US court ordered disclosure of personal data about UK citizens, then a US company that complied with that order without the prior authorisation of the ICO would be in breach of the Regulation and could be fined.
Media and online comment (see e.g. here and here) has suggested that the European Parliament’s current approach – strengthening the protection for data subjects, in particular in relation to international transfers – is partly a reaction to the revelations by Edward Snowden about the disclosure of personal information to the NSA.
The next step will be for the Council to decide on its position. There will be a Council discussion between heads of state and government on 24th – 25th October, relating to the digital single market, followed by a meeting of Justice Ministers on data protection reform on 4th – 5th December. There will then be a “trilogue” between Parliament, the Council, and the Commission. The President of the European Commission has called for a final text to be agreed before the European Parliamentary elections in May 2014 – though it seems likely that there will be a further 2 years or so before the new legislation comes into effect.
Timothy Pitt-Payne