The long-awaited European data protection reform has nearly reached the finish line in this whirlwind third week of December. On Tuesday, 15 December, the European Commission, Council, and Parliament reached a political agreement under pressure from the Council to wrap up the reform before the end of the year. On Thursday, just two days later, the compromise text was confirmed at an extraordinary Civil Liberties Committee (LIBE) session in Strasbourg, and on Friday, 18 December, the Permanent Representatives Committee confirmed the compromise texts of the data protection reform agreed upon with the Parliament. All in all, it’s been quite a week for a reform that’s been in the making for nearly four years.

On 25 January 2012 the European Commission announced its plan to overhaul the outdated European data protection framework. The objective of the reform is two-fold: to give citizens control over their personal data and to create a regulatory environment that fosters innovation and economic growth, key to the Commission’s Digital Single Market strategy. The reform package currently in the spotlight in Brussels consists of the General Data Protection Regulation (GDPR), which harmonizes EU data protection rules, and the Data Protection Directive, which applies general data protection principles for judicial and law enforcement cooperation in criminal matters.

The reform provides a single set of data protection rules that are valid throughout the EU, which means that they are applicable to any company or organization offering services to Europeans even if they don’t have an office on European soil. According to the Commission, the new European data protection rules “aim to protect the fundamental rights and freedoms of natural persons, and in particular the right to data protection, as well as the free flow of data”. Not all stakeholders agree that this is the case, however. Numerous privacy advocates have claimed that the rules are not stringent enough to adequately protect fundamental rights to privacy while many foreign companies and their relative lobbyists have argued that the rules create too many burdens and stifle investment.

Without a doubt, however, the GDPR represents a significant achievement in terms of privacy legislation. It will improve individuals' access to their own data and let them understand how it is processed. Thanks to the Regulation Europeans will be able to transfer their data between service providers more easily and will be able to have their data erased when it is no longer relevant among other benefits including a clarified right to be forgotten. A “one-stop-shop” will facilitate the once fragmented complaints procedure and will strengthen oversight.

It is also true that companies, both European and American, will have to seriously rethink the ways in which they use and share data, especially when it comes to transatlantic transfers, something which they are already doing in light of the recent Safe Harbor decision. Under the new rules, companies whose core business includes the processing of data will now need to appoint a data protection officer, an individual whose role is to ensure compliance with relevant data protection rules. They will also need to obtain explicit consent from users before processing personal data. If firms fail to comply with the new rules, they could face fines as high as 4% of global annual turnover, an astonishing increase from the measly fines they are now required to pay for non-compliance. Companies need not fret, however, as they still have plenty of time to adapt their business operations in order to comply with the rules which will likely come into force in mid-2018.

Europe has undoubtedly succeeded in its first objective of the reform. It has given European citizens control over their personal data, providing them with safeguards for their fundamental rights and freedoms. Only time will tell, however, if the reform will foster a thriving digital market (currently dominated by US service providers), and allow for the free flow of data which is all too important when it comes to stimulating innovation and economic growth.

• Francis
• Digital Single Market
• data protection
• European Commission
• reform