Reform of Data Protection at the European Level

27 April 2016 - Consuelo Álvarez

On Thursday 14th April, the European Parliament approved a legislative package on data protection, consisting of a new Regulation and a new Directive, both intended to give citizens control of personal data and which will guarantee throughout the European Union certain standards of protection adapted to the digital era.   This draft legislation updates and modernises the 1995 Data Protection Directive (95/46/EC). The Regulation will enter into force 20 days after its publication in the  Official Journal of the European Union and will be directly applicable in all Member States from spring 2018.

The main aspects of the new Regulation include:

  1. the right to “be forgotten”, through rectification or suppression of personal data;
  2. the need for “clear and affirmative consent” of the person concerned to the processing of personal data;
  3. “portability”, or the right to transfer data to another service provider;
  4. the right to be informed if personal data has been hacked;
  5. clear and comprehensible language on privacy policies; and
  6. fines of up to 4% of the overall turnover of companies in the case of breach.

Furthermore, a Directive of the European Parliament and the Council has been approved relating to the protection of natural persons (individuals) insofar as concerns the processing of personal data by the competent authorities, for the purposes of prevention, investigation, detection or prosecution of criminal offences or enforcement of criminal sanctions, including protection and prevention against threats to public security, which will be applied to cross-border trade within the EU and will establish mínimum standards for the processing of data in each country in order to protect persons involved in police investigations or court proceedings increasing the level of security in information exchanges between authorities and facilitating the proceedings. This Directive will be of limited application to the United Kingdom and Ireland and Denmark will have six months from the date of its final adoption to decide if it will transpose the Directive into its national law.    

Complete  press release

For more information, please contact Consuelo Àlvarez