Online news: EU proposes enormous data reform 25 January 2012

Huge reforms to the way data is used and stored on individuals and businesses have been proposed by the European Commission (EC).

The EC has suggested radical updates to the 1995 EU data protection rules designed to strengthen online privacy rights and boost Europe’s digital economy.

The reforms are also intended to simplify the implementation of the proposals, as currently all 27 member states have implemented the 1995 rules differently.

At the heart of the proposals for consumers is easier access to their data and the ‘right to be forgotten’, which would allow people to delete online data if there are no legitimate grounds for retaining it.

Businesses meanwhile, would face a single set of rules on data protection across the EU, designed to remove administrative burdens such as notification requirements, which the EU estimates will save businesses €2.3bn a year.

Firms handling data will have to notify a national supervisory authority of data breaches within 24 hours where possible, but will only have to deal with a single national authority in the EU country where they are headquartered.

Individuals would also be able to refer to the authority, even when their data is processed by a company based outside the EU.

Meanwhile, a new Directive would apply general data protection principles and rules for police and judicial cooperation in criminal matters, which would apply to both domestic and cross-border transfers of data.

Mike Bradford, director of consultancy Regulatory Strategies, said: “This is good news for pan-European businesses as the rules will be the same across all countries, which means less red tape and makes it easier to move data geographically.

“But credit industry players need to gear up for more explicit consent, data breach reporting, mandatory data protection officers with a degree of independence, individuals having rights to transfer their data from company to company. For organisations merely processing data for another business, they will now have direct data protection responsibilities.”

The proposals will now be passed on to the European Parliament and EU Member States meeting in the Council of Ministers for discussion. They will take effect two years after they have been adopted.