What changed in the new General Data Protection Regulation since the first position of the Council?

The new General Data Protection Regulation had a long history. It was maybe the regulation which attracted the biggest number of amendments in the Parliament and was one of those which were subject of the longest and most complicated negotiations. The EU regulations under the ordinary legislative procedure have to be approved by both the Parliament and the Council. There are several rounds until an agreement is found or a regulation is finally failing to be approved.

The negotiations centred around some new elements of the regulation, like the „one stop shop”, the possibility of a person and a company to have to deal only with one data protection authority (and the two, namely the one stop shop for a company and a person whose data that company uses, may be contradictory in an international setting), the extent of penalties, the liberty of member states to regulate further and the liberty of public services compared to economic actors in using personal data. The new concepts, „the right to be forgotten”, the concepts of „privacy by design” and „privacy by default” and mainly the „data portability” were also subject to long discussion concerning their definition, scope and practical applicability. The mechanical duty of notification to the data protection authority (which was actually required to a different extent in different countries) has given way in a lot of cases to a preliminary impact assessment.

I try to highlight here some of these aspects, comparing what the Council wanted (it published its position with a concrete text of the regulation the 24th February 2014) with the final text.

The final regulation contains 173 recitals which fix the main principles and considerations (and serve as a guidance concerning the „intention of the legislator” if interpretation of the text is needed).

First let’s examine the freedom of manoeuvre given to the member states:

In the Council position, the member states wanted to have the power to legislate ignoring some requirements if data are processed by public authorities. The new regulation frames this liberty: „Regarding the processing of personal data for compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Member States should be allowed to maintain or introduce national provisions to further specify the application of the rules of this Regulation.” Member state law can set out the circumstances for specific situations, „determining more precisely the conditions under which the processing of personal data is lawful”. This right extends also to processing of special categories of personal data (‘sensitive data’), i.e. data related to health, sexual orientation, religion, political views, membership in trade unions and similar data.

The regulation is not applicable for „activities which fall outside the scope of Union law, such as activities concerning national security” and also „when carrying out activities in relation to the common foreign and security policy of the Union”.

The most important exception is the „processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security and the free movement of such data, is the subject of a specific Union legal act... namely Directive (EU) 2016/680 of the European Parliament and of the Council”. If these authorities process data in the framework of other activities, the regulation is however applicable. An exemption for fraud prevention and detection, including tax evasion is also included in the regulation.

Limits to data portability were set in the new regulation: it „should apply where the data subject provided the personal data on the basis of his or her consent or the processing is necessary for the performance of a contract. It should not apply where processing is based on a legal ground other than consent or contract. By its very nature, that right should not be exercised against controllers processing personal data in the exercise of their public duties. It should therefore not apply where the processing of the personal data is necessary for compliance with a legal obligation to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller. The data subject's right to transmit or receive personal data concerning him or her should not create an obligation for the controllers to adopt or maintain processing systems which are technically compatible.”

A point in favour of economic actors – and deviating from the spirit of the old directive – was that direct marketing could be considered as legitimate interest. The new regulation formulated some limiting conditions to that: „the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.”

The impact assessment requirement was also sensitively limited to circumstances „where processing operations are likely to result in a high risk to the rights and freedoms of natural persons”. The result of this assessment will then determine whether consultation of the data protection authority is necessary (which was obligatory under the old regime for all processing operations involving „sensitive data”.

Special simplified requirements are applicable to small companies, and special codes of conduct can be issued by member states for these enterprises. In this the Council succeeded to make its position accepted.

Following the Schrems case, where the adequacy decision of the Commission about the Safe harbour agreement – which declared that persons have equivalent protection to that ensured by European legislation if their data are processed in the U.S. – was invalidated, the new regulation sets more precise conditions when the Commission can take such a decision.

The „one stop shop” , i.e. the possibility of persons to turn to one competent authority – preferably the one in their country - to deal with their complaints was also given precise conditions and the process described. There will be a “lead authority”, competent for the organisation processing the data, and other „concerned authorities” (among them the one with whom the complaint was lodged). Cooperation obligations are described. What is left from the power of the authority with whom the complaint was lodged is that „where the decision is to reject the complaint by the data subject in whole or in part, that decision should be adopted by the supervisory authority with which the complaint has been lodged.”

The Commission will participate in the new Data Protection Board's activities (which, as opposed to the solely consultative nature of its predecessor, the so-called „Article 29 working party” of national data protection authorities, can take binding decision (but these decisions are not binding on the European Data Protection Supervisor, who is the Data Protection Authority for EU institutions – this may change with the forthcoming regulation about processing of personal data in EU institutions which is now under preparation and should enter into force at the same time, i.e. May 2018, when the new GDPR enters into force) without voting rights and the European Data Protection Supervisor should have specific voting rights.

The amount of penalties and fines was fixed as a maximum of 4% (the Parliament proposed 5%) of turnover of the company infringing the rules but for certain offences only to 2%.

Specific rules for associations, in particular religious associations are also fixed.

There are of course a number of other changes compared to the system in force now, but here I only wanted to deal with some topics which were subject to discussion between the Commission (who prepared the original proposal), the Parliament (more prone to the interest of harmonisation and the fundamental rights of citizens – the rapporteur came from the Green faction) and the Council, representing more the interest of public administrations and enterprises.