by richardh
26. January 2012 17:00
The European Commission (EC) announced a major change to the way Data Protection will be governed in a draft Data Protection Directive released yesterday.
This is serious news for any company that owns or processes data. Whilst this directive is only at draft stage, and there is a lot of lobbying to go that we might reasonably expect to take at least a couple of years, draft directives have a history of progressing to becoming law across all member states.
At the heart of the EC's intention is to simplify various complicated and disjointed laws in the various European member states, and to create one consistent directive ensuring fairness in a world that has changed enormously with regards to data and personal privacy in recent years.
According to James Mullock, Head of Technology at Osborne Clarke, the key points of the draft directive include:
- Explicit consent required in advance and on an opt-in basis
- The right to be forgotten
- An obligation to notify data protection authorities after a data breach
- Fines of up to 2% of global turnover
Concerns have been raised over quite what explicit consent means and how the right to be forgotten might adversely affect the operation of suppression files. Quite how all these changes might affect data cleansing is yet to be seen.
The DMA are claiming that the move towards an opt-in only regime for offline direct marketing has been softened compared to earlier versions however they warn against complacency as this could easily be reinstated in later versions. They have promised a fully analysis of the consequences to their members later this week.
For more information the EC has a comprehensive selection of press releases, factsheets and the full draft directive at http://ec.europa.eu/justice/newsroom/data-protection/news/120125_en.htm