European Union officials reached agreement Tuesday on a pan-European digital-privacy law, creating a strict new legal framework that will have ripple effects globally on how companies can use individuals’ personal information.
After nearly four years of haggling and lobbying, negotiators agreed late Tuesday on a final text of the EU-wide bill, which will replace a patchwork of 28 different sets of national privacy laws, and boost the bloc’s paltry privacy penalties to potentially billions of euros, EU officials said.
Under the agreed text, fines would rise to a maximum of 4% of a company’s world-wide revenue, the officials added.
The text, which must be definitively approved by the European Parliament and EU governments before going into effect in two years’ time, is expected to tighten rules for getting online consent and create new responsibilities for cloud-services companies.
It is also expected to tightly restrict how analytics and advertising companies can re-use data harvested from individuals, for example after they purchased a product or signed up for a service.
The agreement on the law kicks off a new phase of fighting between regulators and companies over how to best tackle the vast amount of personal information that individuals generate when they do anything from visiting a website to walking past a Wi-Fi hot spot.
Privacy advocates hope Europe will become a model for the rest of the word, while some tech executives say the EU’s new rules will hobble their businesses.
“For the first time, a law is trying to put extensive limits around the pervasive generation of data that happens now by default,” said Eduardo Ustaran, a privacy lawyer for Hogan Lovells who works with U.S. tech firms. “Because business in general is becoming more data-dependent, every business will be affected.”
EU officials say the new law will lighten the administrative burden for companies, by allowing them to deal primarily with a single national privacy regulator that will allow them to operate across the entire EU. They also say that by creating a high privacy standard for firms operating in Europe, the continent can help create an environment where pro-privacy business models grow, becoming an advantage for individuals, for firms and for the region.
“The new rules will give businesses legal certainty by creating one common data protection standard across Europe,” said Jan Philipp Albrecht, a member of European Parliament who participated in the negotiations, adding that the rules “will give users back the right to decide [about] their own private data.”
Companies complain, however, that member states have weakened that harmonization by creating a new pan-EU board that will be able to overturn decisions by national regulators. They also say they believe that potential sanctions are too high.
Moreover, newer data-mining practices could be curtailed because companies may have to seek additional consent from users every time they want to reanalyze or re-purpose their data. A privacy policy in which a user simply checks a box and signs off on all uses of their data won’t be sufficient, said Martin Abrams, executive director of the Information Accountability Foundation, a think tank that is supported by technology companies.
Online advertising and data-analytics companies say their businesses could be hit. The new law is expected to include tighter rules on a practice dubbed “profiling,” which could complicate life for data-hungry brokerages and exchanges that use large pools of personal information including online browsing histories to tailor automated online offers to individuals.
The new law also includes potentially higher bars for requiring user consent across the online-advertising value chain. “The way it works now probably won’t be legal” in some cases, said one executive for an online-advertising measurement business. “It could potentially stop some interest-based online advertising models.”
The negotiations that ended Tuesday were between representatives of the Parliament, of EU governments and the European Commission, the bloc’s executive. Agreements reached in such negotiations are usually adopted without further amendment.
(Published by The Wall Street Journal - December 15, 2015)