#alternate Ars Technica ← → 0 ____________________ * Forum * IT * Gadgets * Business * Security * Tech Policy * Apple * Gaming * Science * Cars View Full Site * Ars Technica * Ars Technica UK * Dark on light * Light on dark IFRAME: mobile-login Law & Disorder / Civilization & Discontents EU takes important step towards agreeing updated data protection rules Final negotiations to reconcile differences on external data flows likely to be tough. by Glyn Moody - Jun 15, 2015 2:58 pm UTC Login to bookmark 4 [Banderas_europeas_en_la_Comisión_Europea-640x438.jpg] The head office of the European Commission, one of the three political bodies involved in revising the EU's data retention rules. Amio Cajander Justice ministers of the European Union's 28 member states have agreed their general approach on the European Commission's 2012 proposal for a radical overhaul of the EU's data protection regulations, which currently date from 1995. Since the European Parliament has already given its overall endorsement of the Commission's plans, the final haggling over a common, compromise text can now begin in the trilogue meeting between the Commission, the European Parliament and the Council of the EU (representing the member states), which will take place next week. The Council's general approach on the data protection regulation includes a number of key elements, some of which may, however, be modified during the coming negotiations with the European Parliament and European Commission. First of all, a single set of rules on data protection will be valid across the EU. This contrasts with the current situation, where each of the member states has its own implementation of the broad principles. The unified approach will make life easier for EU companies, since they won't need to grapple with multiple data protection regulations. The European Commission claims this move will save businesses around €2.3 billion a year. The new rules will establish a "one-stop shop" approach for both businesses and citizens. This means, for example, that individuals will only have to deal with their home national data protection authority, in their own language, even if their personal data is processed outside their home country. The national authorities will be given new powers, including the ability to impose some serious fines on companies that breach the rules: penalties of up to 2 percent of their global annual turnover. The new data protection rules will also strengthen the EU's "right to be forgotten," but not simply in the sense that it has been used hitherto. As previous articles on Ars have reported, this "right" has typically been claimed by those who wish to stop incorrect or irrelevant information appearing in search engine results. What is proposed under the new data protection rules is rather different: "When you no longer want your data to be processed, and provided that there are no legitimate grounds for retaining it, the data will be deleted. This is about empowering individuals, not about erasing past events or restricting freedom of the press." Other benefits for ordinary citizens include a right to data portability, so that personal data can be moved between services, and a right to be informed when personal data has been compromised: "companies and organisations must notify the national supervisory authority of serious data breaches as soon as possible (if feasible within 24 hours) so that users can take appropriate measures." One of the most contentious areas concerns the application of EU data protection laws to foreign companies—particularly US ones like Facebook and Google. Here's what the European Commission says will happen under the revised directive: "companies based outside of Europe will have to apply the same rules. We are creating a level-playing field." It then goes to say: "rules for international transfers of data are streamlined, through simplified approval of binding corporate rules. This will foster international trade while ensuring continuity of protection for personal data." The big question is: what exactly does that last statement mean in practice? If the rules for transferring data outside the EU are "streamlined," that suggests that the protections accorded them elsewhere—for example, in the US—will remain weak, as at present. That's something that the European Parliament has said it wants to change, particularly in the light of Edward Snowden's leaks about the NSA's Prism programme. It is precisely issues like external dataflows that are likely to provoke the greatest disagreement in the coming trilogue negotiations, which will seek to draw up a common text. It is by no means clear whose vision on such matters will prevail: those wanting to "streamline" data flows, or those who want to enhance privacy protection for citizens' personal data when it is collected and used by companies outside the EU. Expand full story Reader comments 4 You must login or create an account to comment. * Share - * Tweet * Email * Google - * Reddit - [glyn-moody-bw-100px.jpg] Glyn Moody / Glyn Moody is Contributing Policy Editor at Ars Technica. He has been writing about the Internet, free software, copyright, patents and digital rights for over 20 years. @glynmoody on Twitter ← Older Story Newer Story → You May Also Like * Condé Nast UK Privacy Policy & Cookie Statement | Terms & Conditions | Contact Us | © Condé Nast UK 2016 [p?c1=2&c2=15335235&cv=2.0&cj=1]