EU Completes Privacy Measure; US Deal Questioned

The European Parliament has adopted new data protection legislation, following four years of sometimes tortuous negotiation. Meanwhile European data regulators have expressed doubts about the Privacy Shield framework for data transfers with the US, laid out in February.


With the adoption of the GDPR (General Data Protection Regulation), businesses in EU member states - and those wishing to operate in the EU or monitor the behaviour of its citizens - now have two years to prepare for compliance. In addition to existing EU privacy laws, the new statute introduces potential fines for transgressors of up to 4% of worldwide turnover; extension to cover companies based outside but operating within the Union or analysing its citizens' data; increased requirements for notification and stronger rights to object regarding data held; limits on automated profiling of subjects; more admin regarding privacy impact assessments for changes in company policy; requirements for data portability; and the enshrinement of the so-called 'Right to be Forgotten'.

The EU says the new law will 'ensure that the fundamental right to personal data protection is guaranteed for all' - and will stimulate the Union's Digital Single Market 'by fostering trust in online services'. The changes are also expected to stimulate the legal profession by generating a large volume of new litigation.


Meanwhile European data regulators on the Article 29 Working Party have expressed doubts about the EU-US 'Privacy Shield' introduced in February as a successor to the defunct 'Safe Harbour' legislation, covering the transfer of data between the two and giving US companies and government agencies new obligations to guarantee protection for personal data. The regulators said the latest version needs further amendments to address the bulk collection of information.

Safe Harbour was ruled unlawful by a European court in 2015 and the new set-up was brought forward rapidly, by EU standards, in the sudden absence of a framework. Privacy Shield has found some support - including from Microsoft, in the last week described it as a 'step in the right direction'. However the Working Party expressed concerns that US authorities may still get easy access to the mass of data available on EU citizens and said there was a lack of clarity in the Shield about the automated processing of data.

All articles 2006-23 written and edited by Mel Crowther and/or Nick Thomas, 2024- by Nick Thomas, unless otherwise stated.