Documents considered by the Committee on 23 March - European Scrutiny Committee Contents

13   Data protection in the European Union



COM(10) 609

Commission Communication: A comprehensive approach to personal data protection in the European Union

Legal base
Basis of considerationEM of 24 November 2010
Previous Committee ReportHC 428-xi (2010-11), chapter 13 (15 December 2010)
To be discussed in CouncilNot applicable
Committee's assessmentLegally important
Committee's decisionCleared


13.1  The European Commission published this Communication on 4 November 2010. The Communication outlines the Commission's views of the challenges facing the 1995 Data Protection Directive[74] and the Commission's key objectives for achieving a comprehensive approach to personal data protection. The Communication presages new legislation, citing Article 16 of the Treaty of the Functioning of the European Union as the legal base. This gives the Commission a power to bring forward legislation to regulate data protection when processed by EU institutions, bodies and agencies, and by Member States when carrying out activities "which fall within the scope of EU law"; and to regulate the free movement of personal data in the EU. The Communication makes proposals under the five headings: (a) strengthening individual's rights; (b) enhancing the internal market dimension; (c) revising the data protection rules in the area of police and judicial cooperation in criminal matters; (d) the global dimension of data protection; and (e) stronger institutional arrangements for better enforcement of data protection rules. The Communication is intended to serve as a basis for further discussions between the Commission, other European institutions and interested parties with a view to developing a new data protection legislative framework.

Previous scrutiny

13.2  In his Explanatory Memorandum of 24 November 2010, the Minister for State at the Ministry of Justice (Lord McNally) said that, in preparation for new legislative proposals from the Commission, the Government launched a call for evidence in July to seek views on how the Data Protection Act 1998, which implements the Data Protection Directive, was working. It closed in October and the responses were being analysed. At the same time, the Government published a provisional Post-Implementation Review (PIR) of the Data Protection Act, aimed to assess its costs and benefits. The PIR was being updated to take account of evidence received from the call for evidence.

13.3  The Minister reported that the Government's approach to legislative changes in the area of data protection would be informed by several factors. These included: a proper evidence base for the proposed legislative change; the resource implications for data controllers balanced against safer, more transparent data processing; the impact on the Information Commissioner's Office; the need to cater for the specific needs of law enforcement bodies because of the very different nature of law enforcement work; and the benefits to data subjects.

13.4  In our first Report on the Communication,[75] we asked for sight of a summary of the responses received from the call for evidence; the final PIR of the Data Protection Act; and a summary of the Government's response to the Communication. In the meantime the Communication remained under scrutiny.

Minister's letter of 28 January 2011

13.5  The Minister writes to say that the public consultation on the Commission's Communication closed on 15 January; the UK response to this Communication was submitted on 14 January; the Presidency intends to adopt Council Conclusions on the Communication at the JHA Council meeting of 24 February; the Commission is then expected to publish its final proposals along with a related Impact Assessment in mid-2011.

13.6  He says the Government has published its response to the Call for Evidence. The response summarises the evidence received between July and October 2010, involving around 160 written responses from a wide range of data controllers, including small businesses, large international organisations, consumer groups, local and central government Departments and members of the public. As well as the written responses to the published evidence paper, the Call for Evidence included a number of workshops and meetings with key interested parties which took place from August to October. Representatives from government Departments, the wider public sector, businesses and charities attended these workshops. The response also sets out the next steps and how the Government will approach the forthcoming European negotiations.

13.7  Some of the major issues for respondents to the Call for Evidence included the definition of personal data and the implications for research (including medical research); the types of personal data which should be categorised as "sensitive personal data"; the expense of complying with subject access requests made under section 7 of the Data Protection Act; making it mandatory for organisations to notify individuals and the Information Commissioner's Office when they breach the Data Protection Act; the uncertainty surrounding the role of consent in ensuring that processing of personal data is legitimate; and the effectiveness of the current systems in place to ensure lawful transfer of personal data to countries outside the European Economic Area.

13.8  At the same time as conducting the Call for Evidence, the Government published a provisional PIR of the Data Protection Act, which aimed to assess the costs and benefits the Act has generated. The Impact Assessment which accompanied the Call for Evidence has been updated to take account of evidence provided by respondents during the Call for Evidence process. The finalised PIR Impact Assessment is annexed to the response document. Although this has the primary purpose of assessing how the Data Protection Act has worked in practice, the findings of the PIR will contribute to the UK's overall evidence base for negotiations on a revised EU legal instrument.

Minister's letter of 9 March 2011

13.9  The Secretary of State for Justice (Mr Kenneth Clarke) writes to confirm that the JHA Council adopted Conclusions on the Commission's Communication on Friday 25 February 2011, a copy of which he encloses.

13.10  The Conclusions set out the Council's views on the general principles arising from the Communication and do not prejudice the need for careful and detailed consideration of any legislative proposals. Among other things, they recognise the specific nature of personal data processed in the field of police and judicial cooperation in criminal matters. As noted in the Government's response to the Communication, the UK believes that the Commission should not take a one-size-fits-all approach to the revision of the data protection rules and that any revision of the rules must cater for the operational needs of the specific types of processing such as that done by law enforcement bodies.

13.11  The Conclusions encourage the Commission to consider enhancing the rights of data subjects through increased transparency. The Government supports proposals to strengthen individuals' rights and enhance their control so that the collection and use of personal data is limited to the minimum necessary and that individuals are informed how, why, by whom and for how long their data is collected and used.

13.12  The Conclusions state that any new proposals put forward by the Commission must be accompanied by a robust cost analysis and that any resource implications for business must be proportionate to the benefits delivered by appropriate safeguards for the more transparent processing of personal data. Specific areas for further consideration include the role of self regulation and reviewing the current system of notification for data controllers.

13.13  The Conclusions contain recognition of the economic importance of international data transfers and note that the existing arrangements for the transfer of personal data outside of the EU have not been fully successful. The Conclusions encourage the Commission to improve the current mechanisms which allow for the international transfer of data.

13.14  The Minister concludes by saying the Government expects to see rigorous evidence based arguments for the Commission's legislative proposals, including a full impact assessment, which it anticipates will be published later this year.


13.15  We thank the Ministers for their letters, updating us on the UK and Council's response to the Commission's Communication, A comprehensive approach to personal data protection in the European Union, and take note of their content.

13.16  We now clear the Communication from scrutiny.

74   95/46/EC. Back

75   See headnote. Back

previous page contents next page

House of Commons home page Parliament home page House of Lords home page search page enquiries index

© Parliamentary copyright 2011
Prepared 31 March 2011