Agreement on Commission's EU data protection reform will boost Digital Single Market

17 December 2015

The European Commission put forward its EU Data Protection Reform in January 2012 to make Europe fit for the digital age. An agreement was found with the European Parliament and the Council, following final negotiations between the three institutions (so-called 'trilogue' meetings).

More than 90% of Europeans say they want the same data protection rights across the EU – and regardless of where their data is processed: this will soon be a reality. The Reform package will put an end to the patchwork of data protection rules that currently exists in the EU.

Andrus Ansip, Vice-President for the Digital Single Market, said: "Today's agreement is a major step towards a Digital Single Market. It will remove barriers and unlock opportunities. The digital future of Europe can only be built on trust. With solid common standards for data protection, people can be sure they are in control of their personal information. And they can enjoy all the services and opportunities of a Digital Single Market. We should not see privacy and data protection as holding back economic activities. They are, in fact, an essential competitive advantage. Today's agreement builds a strong basis to help Europe develop innovative digital services. Our next step is now to remove unjustified barriers which limit cross-border data flow: local practice and sometimes national law, limiting storage and processing of certain data outside national territory. So let us move ahead and build an open and thriving data economy in the EU – based on the highest data protection standards and without unjustified barriers." 

Věra Jourová, Commissioner for Justice, Consumers and Gender Equality said, "Today we deliver on the promise of the Juncker Commission to finalize data protection reform in 2015. These new pan-European rules are good for citizens and good for businesses. Citizens and businesses will profit from clear rules that are fit for the digital age, that give strong protection and at the same time create opportunities and encourage innovation in a European Digital Single Market. And harmonised data protection rules for police and criminal justice authorities will ease law enforcement cooperation between Member States based on mutual trust, contributing to the European Agenda for Security."

The Reform consists of two instruments:

• The General Data Protection Regulation will enable people to better control their personal data. At the same time modernised and unified rules will allow businesses to make the most of the opportunities of the Digital Single Market by cutting red tape and benefiting from reinforced consumer trust.
• The Data Protection Directive for the police and criminal justice sector will ensure that the data of victims, witnesses, and suspects of crimes, are duly protected in the context of a criminal investigation or a law enforcement action. At the same time more harmonised laws will also facilitate cross-border cooperation of police or prosecutors to combat crime and terrorism more effectively across Europe. 

Clear modern rules for businesses

In today's digital economy, personal data has acquired enormous economic significance, in particular in the area of big data. By unifying Europe's rules on data protection, lawmakers are creating a business opportunity and encouraging innovation.

• One continent, one law: The regulation will establish one single set of rules which will make it simpler and cheaper for companies to do business in the EU.
• One-stop-shop: businesses will only have to deal with one single supervisory authority. This is estimated to save €2.3 billion per year.
• European rules on European soil– companies based outside of Europe will have to apply the same rules when offering services in the EU.
• Risk-based approach: the rules will avoid a burdensome one-size-fits-all obligation and rather tailor them to the respective risks.
• Rules fit for innovation: the regulation will guarantee that data protection safeguards are built into products and services from the earliest stage of development (Data protection by design). Privacy-friendly techniques such as pseudonomysation will be encouraged, to reap the benefits of big data innovation while protecting privacy. 

Benefits for big and small alike

The data protection reform will stimulate economic growth by cutting costs and red tape for European business, especially for small and medium enterprises (SMEs). The EU's data protection reform will help SMEs break into new markets. Under the new rules, SMEs will benefit from four reductions in red tape:

• No more notifications: Notifications to supervisory authorities are a formality that represents a cost for business of €130 million every year. The reform will scrap these entirely.
• Every penny counts: Where requests to access data are manifestly unfounded or excessive, SMEs will be able to charge a fee for providing access.
• Data Protection Officers: SMEs are exempt from the obligation to appoint a data protection officer insofar as data processing is not their core business activity.
• Impact Assessments: SMEs will have no obligation to carry out an impact assessment unless there is a high risk. 

Full press release

© European Commission