MEP Jan Philipp Albrecht has released a draft report on the European Commission’s proposed update to the 1995 Data Protection Directive supporting a robust framework and recommending more stringent measures, The New York Times has reported, inciting mixed reactions from government and industry. Albrecht’s report, containing 350 proposed amendments to be discussed in plenary, would increase data subjects' rights—rewording the “right to be forgotten” as “a right to erasure and to be forgotten”—expand the proposal’s scope of non-EU-based controllers and expand the concept of “personal data.”

The report suggests the “legitimate interest” provision—allowing companies to process personal data without consent if the reasons for doing so trump the individual’s right to privacy—should be used only in exceptional circumstances. While EU Justice Commissioner Viviane Reding welcomed the report, industry has reacted less favorably. Facebook’s head of EU Policy, Erika Mann, said that “some aspects of the report do not support a flourishing European Digital Single Market,” and the Industry Coalition for Data Protection said Albrecht’s report “missed an opportunity to reconcile effective privacy safeguards with rules protecting the conduct of business—both fundamental rights under the EU charter.”

Monika Kuschewsky, CIPP/E, special counsel at Covington & Burling, told The Privacy Advisor those expecting a “conciliatory report searching for compromise and practical solutions will be disappointed” as the report’s amendments aim to strengthen individuals’ and authorities’ rights and “reinforce existing or impose additional obligations on companies.” Field Fisher Waterhouse’s Eduardo Ustaran, CIPP/E, expects “heated negotiations with the Council of the EU and other stakeholders.”

Commissioner Giovanni Buttarelli, deputy European Data Protection Supervisor (EDPS), spoke recently on the EDPS’ first official position on Albrecht’s report, noting that in the EDPS’ view, “the data protection package is a huge and necessary step forward for data protection in Europe. We appreciate any further contribution aimed to ensure a full comprehensiveness of the two legal instruments—the regulation and the directive—to increase the level of protection ensured by the directive as well as solutions aimed to improve some provisions of both legal instruments which need to be adjusted, clarified or fine-tuned.”

Buttarelli also noted in his talking points for the LIBE meeting that “we are in an important phase where there is no room for mistakes. This is why at the EDPS we will continue to follow all further developments and contribute to the debate also through additional, formal contributions, where necessary.” Editor's Note: The IAPP web conference Draft Report on New EU Data Protection Regulation—Strict Requirements Proposed will offer expert analysis on the draft report.

--With IAPP Staff