EU: Official presentation of the planned European Data Protection Regulation

On 1/25/2012, EU Justice Commissioner Viviane Reding officially presented the proposal of the European Commission for a revision of the Data Protection Regulation. The revision includes a regulation that will replace the current Directive 95/46/EC as well as a directive that regulates data processing by the police and the judiciary.

In December 2011, the working document of the draft regulation was circulated on the internet. The basic tenor of the Commission’s proposal was already known when the document was officially adopted by the Commission on 1/25/2012.

The Commission’s proposal was referred to the Council of the European Union and the European Parliament on 1/27/2012, as these European institutions have the actual legislative power to carry out the ordinary legislative procedure here (formerly known as the co-decision procedure). The Parliament and the Council will now examine the draft and submit changes. If the institutions fail to reach an agreement on legislation within two readings, a Conciliation Committee will be formed. Within the framework of this last reading, both the Council and the Parliament may reject the proposal.

Since the Commission’s proposal does not aim to regulate data protection as it is currently done in the form of a directive that allows for discretion on the national level, but rather in a regulation that would be directly applicable in Member States, the Member States would lose much of their national authority over data protection. It remains to be seen how this impending loss of competence of the Member States will affect the legislative process. It is, however, certain that the Commission’s proposal is already being hotly debated as well as sharply criticized with regard to content. Observers estimate that a final decision is not expected within the next eighteen months..

Nevertheless, companies should look into the possible rules of the Data Protection Regulation in advance. Above all, proposed rules such as a regular data protection impact assessment require significant preparation time to implement on the corporate level.

For more information:

ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_de.pdf

ec.europa.eu/justice/newsroom/data-protection/news/120125_en.htm