Next-to-Final EU Data Protection Regulations Published

The E-TIPS® newsletter previously reported that the Council of the European Union and the European Parliament had informally agreed to new data protection rules to reform the data protection regulations in the EU.  Although the official text of the EU General Data Protection Regulations (GDPR) has yet to be finalized, the version agreed upon on December 15, 2015 has been published by Statewatch. 

Based on the December 15, 2015 version of the GDPR, the new regulations will amend important aspects of the EU data protection regime, including:

• amending the concept of personal data by including examples of identifiers such as location data or online identifiers (Article 4(1));
• introducing the concept of pseudononymization (Article 4(3b));
• adding genetic data and biometric data as specific categories of sensitive data (Articles 4(10) and 4(11));
• restricting, in the absence of new valid consent, the processing of personal data to purposes compatible with the purpose for which the data was originally collected (Articles 6(1) and 6(3a)); and
• requiring parental consent for the processing of the personal data of a child under the age of 16 (or 13 if so provided by the laws of a Member State) (Article 8(1)).

Along with a multitude of other provisions, the GDPR also contains provisions relating to notice obligations for data controllers in the event of a personal data breach (Article 31) and the “right to be forgotten” for data subjects (Article 17). 

It should also be noted that the GDPR will have extraterritorial application to controllers and processors that are offering goods or services to persons in the EU, or monitoring such persons’ behaviour within the EU (Article 3).

The December 15, 2015 version of the GDPR is currently undergoing a legal review and can be expected to be adopted by the European Parliament and Council in the coming months, and is expected to come into force in 2018.  E-TIPS® newsletter writers are following the implementation of the new rules closely and will provide an update when the full texts of the Regulation and Directive are published.