New EU Data Protection Regulations Agreed Upon

The Council of the European Union and the European Parliament have informally agreed to new data protection rules that will reform current data protection regulations in the EU. 

The European Commission proposed a General Data Protection Regulation and a Data Protection Directive in January, 2012.  The new regulations, expected to come into force in 2018, seek to harmonize the data protection laws across the 28 Member States, reduce administrative burdens for companies operating in the EU, and facilitate the exchange of data between law enforcement authorities in the EU.

While the official text of the regulations has yet to be published, the European Commission has indicated that the new regulations will:

• clarify the “right to be forgotten”;
• create a single data protection supervisory authority;
• require large companies to appoint a data protection officer (small and medium enterprises will be exempt from this requirement);
• require companies to notify data subjects and the data protection supervisory authority in the event of a high risk data breach; and
• expand enforcement powers and provide increased fines for companies violating the regulations (up to 4% of their global annual turnover).

ETIPS® newsletter authors are following the implementation of the new data protection regulations closely and will provide an update when the official Regulation and Directive are published.

For press releases about the new data protection regulations, see:

1. European Commission Questions and Answers – Data Protection Reform
2. December 15, 2015 European Commission Press Release
3. December 15, 2015 European Parliament Press Release

Summary By: Michael House