Privacy & Information Security Law Blog

On March 8, 2013, the European Union’s Justice and Home Affairs Council held legislative deliberations regarding the European Commission’s proposed General Data Protection Regulation (the “Proposed Regulation”).

Viviane Reding, Vice-President of the European Commission and Commissioner for Justice, Fundamental Rights and Citizenship, addressed the Council, noting that discussions are moving at “a fast pace” in the European Parliament with the lead committee (the Committee on Civil Liberties, Justice and Home Affairs) set to vote on the Proposed Regulation next month. Commissioner Reding is therefore optimistic that “all the elements are falling into place” to “make decisive political progress under the Irish Presidency.”

Commissioner Reding commented on a number of issues currently subject to significant debate. A key theme throughout her comments was that the current level of protection afforded by the EU Data Protection Directive 95/46/EC (“Data Protection Directive”) must be maintained or improved upon, and that the Proposed Regulation should not reduce the current level of protection.

Pseudonymous Data 

In relation to the proposal to add an additional category of “pseudonymized” data, Commissioner Reding emphasized that the definition of “personal data” in the current Data Protection Directive is very broad and has been interpreted by the European Court of Justice to include IP addresses. Commissioner Reding stated that the definition of “personal data” outlined by the Commission in the Proposed Regulation maintains this breadth and that “a narrow definition which would mean that some data protected in the past would no longer be covered in the future is out of the question. This would reduce the level of data protection in Europe.” Although she accepted that the Proposed Regulation should take into account new technologies which permit data to be processed pseudonymously, and that the Proposed Regulation should offer incentives to encourage data controllers to process pseudonyms instead of names where possible, she nonetheless emphasized that “pseudonymous data is personal data. It relates to an identified or identifiable natural person and has to be protected under the Charter and EU law. Risks to privacy remain and are real.” She noted in particular that the health sector often uses pseudonymous data in place of very sensitive personal data. She therefore concluded that while she is happy to work on the concept of pseudonymous data, a robust definition and robust safeguards are required, and she warned that “pseudonymous data must not become a Trojan horse at the heart of our Regulation.”

Risk-Based Approach 

Commissioner Reding welcomed a risk-based approach, but cautioned that attempts to define within the Proposed Regulation different levels of risk must be guided by the fundamental principle of simplicity, and that the rules must set standard criteria and parameters which provide legal certainty for all. She noted that prior consultation with the supervisory authority should be an exception, not the rule, in cases of processing presenting a high degree of risk, and warned that the Proposed Regulation must not create unnecessary layers of bureaucracy.

Exemptions for Small and Medium-sized Enterprises and the Public Sector 

Commissioner Reding highlighted that the Commission’s Proposed Regulation contains a number of exemptions for small and medium-sized enterprises. She also emphasized that the appointment of data protection officers (“DPOs”) does not have to be particularly burdensome, as DPOs can be either full- or part-time, may be internal or external, and there is no requirement to create a specific new position.

With regard to public access to governmental documents, Commissioner Reding recognized that this is an issue of “constitutional and cultural importance” and welcomed further debate.