EU data protection reform 'badly broken,' civil liberty groups warn

Something needs to change soon to save the EU's data protection reform, the groups said

Leaked documents show that the European Union's data protection is on its way to become an empty shell devoid of meaning, European civil rights groups warned Tuesday.

The EU is busy overhauling its data protection rules, which date back to 1995. The European Commission and the European Parliament have already agreed on a draft regulation that seeks to modernize data protection rules to take new digital technologies into account.

However, there is one more legislative body that has to sign off on the new rules: the Council of the EU, which consists of national ministers of EU member states.

Since the Parliament approved the draft with minor changes in March last year, the Council has been busy changing the text. Ministers are expected to agree on how they want to reshape the text by Summer.

However, new leaked documents show that the Council is trying to destroy key elements of the original proposal, European digital civil liberties group EDRi said. Working with civil liberties groups Access, the Panoptykon Foundation and Privacy International, EDRi published leaked Council proposals to amend the proposed data protection regulation on Tuesday.

Along with the documents, the groups published a side-by-side comparison of the Parliament's agreed text with the Council's proposed changes, as well as an analysis of the proposed changes.

The existence of the documents is no secret: They can be found in the Council's online document register, but cannot be accessed by the general public.

Under the proposals, crucial privacy protections are being drastically undermined by the Council, EDRi said in a blog post.

The Council declined to comment on leaked documents.

One of the proposed rights affected by the Council's changes is the right not to be tracked by companies online without consent. The Council for example suggests that failing to change the default settings in a browser to prevent tracking, or failing to change the settings back, constitutes consent to being tracked and profiled online, the groups said.

What's more, the Council proposes that data can be processed under an "legitimate interest" exception. This means that consent is not needed if the company feels that they have a legitimate interest in processing personal data, and would allow data to be passed on to third parties. They could then use the same exception to start processing data for reasons that are completely unrelated and incompatible with the original purpose, the groups said.

The Council also proposed deleting an article imposing concrete obligations on how people and especially children need to be informed in "concise, transparent, clear and easily accessible policies" about how their personal data is being used, the groups said.

Moreover, countries would be given the right to profile citizens for national security, defence and public security reasons as well as for "other important objectives of general public interest." That part of the original text drafted by the Commission was deleted by the Parliament but reintroduced by the Council.

"This is basically providing a blank cheque to governments which, under various excuses, may start to profile people based on their online political activities and prepare, for example, blacklists who do not fit with the profile of 'normal' citizens," the groups said.

Other issues with the proposals include a plan to let a company determine whether a data breach is of sufficiently high risk to warrant notifying its customers. This would undermine people's privacy and greatly reduce incentives for companies to improve data security, according to the groups.

Meanwhile, they say, the Council is also still trying to undermine the creation of a one-stop data protection shop that could make it simpler to resolve transnational disputes involving big companies in the EU. The ministers have been backpedaling on that proposal for a while though and have not changed their minds, the leaked docs showed.

They still want to involve national data protection authorities in every transnational dispute that would have to reach consensus, adding more bureaucracy and a time consuming step to a process that is meant to streamline current fragmentation, the groups said.

"Unless something is done urgently, the Council will simply complete its agreement," EDRi warned, adding that if the Council has agreed, only the Parliament could save the EU's data protection reform.

Justice ministers will meet on March 13 to discuss the data protection regulation. Documents that will be discussed by the ministers will be available on the Council's website as soon as the preparatory work for the meeting has finished, an official said.

Loek is Amsterdam Correspondent and covers online privacy, intellectual property, online payment issues as well as EU technology policy and regulation for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to loek_essers@idg.com

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Council of the European Unionregulationsecuritylegislationgovernmentdata protectionprivacy

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Loek Essers

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?