Facebook, Google must obey EU data-protection law, Reding says

Facebook Inc., the most-visited U.S. website, Google Inc. and other U.S.-based companies would have to comply with stricter data-protection rules being planned for the EU, the region's justice commissioner said.

Any company active in the 27-nation region or any Internet- based product targeted at European consumers "must comply with EU rules," Viviane Reding said in a speech in Brussels today.

"Privacy standards for European citizens should apply independently of the area of the world in which their data is being processed," said Reding. "A U.S.-based social network company that has millions of active users in Europe needs to comply with EU rules."

Google, based in Mountain View, California, and Palo Alto, California-based Facebook are among several Internet companies under scrutiny in the EU for possible privacy-rule breaches over their use of personal data. Data protection officials from 30 European countries have pushed Google, Microsoft Corp. and Yahoo! Inc. to limit the amount of time they store search records. The same group has criticized Facebook for policy changes that could have harmed users' privacy rights.

In November, Reding proposed an overhaul of the EU's nearly 16-year-old data-protection policies to address online advertising and social-networking sites. The law, which the regulator will formally offer up later this year, may include stricter sanctions, such as criminal penalties, and the option for consumer groups to file lawsuits. Reding, 59, hadn't previously said how the rules would affect U.S.-based firms.

"National privacy watchdogs shall be endowed with powers to investigate and engage in legal proceedings against non-EU data controllers whose services target EU consumers," she said.

Revised EU data-protection rules will give people "the right, and not only the possibility, to withdraw their consent" for companies to collect and use their data to better market their products, said Reding.

It should be up to companies to prove why they need to keep user data, such as search records, rather than Internet users having to prove why collecting their data isn't justified, the commissioner said.

(Published by Bloomberg - March 16, 2011)