13 Data protection in the European
Union
| (32163)
15949/10
COM(10) 609
| Commission Communication: A comprehensive approach to personal data protection in the European Union
|
| Legal base | —
|
| Department | Justice
|
| Basis of consideration | EM of 24 November 2010
|
| Previous Committee Report | HC 428-xi (2010-11), chapter 13 (15 December 2010)
|
| To be discussed in Council | Not applicable
|
| Committee's assessment | Legally important
|
| Committee's decision | Cleared
|
Background
13.1 The European Commission published this Communication
on 4 November 2010. The Communication outlines the Commission's
views of the challenges facing the 1995 Data Protection Directive[74]
and the Commission's key objectives for achieving a comprehensive
approach to personal data protection. The Communication presages
new legislation, citing Article 16 of the Treaty of the Functioning
of the European Union as the legal base. This gives the Commission
a power to bring forward legislation to regulate data protection
when processed by EU institutions, bodies and agencies, and by
Member States when carrying out activities "which fall within
the scope of EU law"; and to regulate the free movement of
personal data in the EU. The Communication makes proposals under
the five headings: (a) strengthening individual's rights; (b)
enhancing the internal market dimension; (c) revising the data
protection rules in the area of police and judicial cooperation
in criminal matters; (d) the global dimension of data protection;
and (e) stronger institutional arrangements for better enforcement
of data protection rules. The Communication is intended to serve
as a basis for further discussions between the Commission, other
European institutions and interested parties with a view to developing
a new data protection legislative framework.
Previous scrutiny
13.2 In his Explanatory Memorandum of 24 November 2010, the
Minister for State at the Ministry of Justice (Lord McNally) said
that, in preparation for new legislative proposals from the Commission,
the Government launched a call for evidence in July to seek views
on how the Data Protection Act 1998, which implements the Data
Protection Directive, was working. It closed in October and the
responses were being analysed. At the same time, the Government
published a provisional Post-Implementation Review (PIR) of the
Data Protection Act, aimed to assess its costs and benefits. The
PIR was being updated to take account of evidence received from
the call for evidence.
13.3 The Minister reported that the Government's approach
to legislative changes in the area of data protection would be
informed by several factors. These included: a proper evidence
base for the proposed legislative change; the resource implications
for data controllers balanced against safer, more transparent
data processing; the impact on the Information Commissioner's
Office; the need to cater for the specific needs of law enforcement
bodies because of the very different nature of law enforcement
work; and the benefits to data subjects.
13.4 In our first Report on the Communication,[75]
we asked for sight of a summary of the responses received from
the call for evidence; the final PIR of the Data Protection Act;
and a summary of the Government's response to the Communication.
In the meantime the Communication remained under scrutiny.
Minister's letter of 28 January 2011
13.5 The Minister writes to say that the public consultation
on the Commission's Communication closed on 15 January; the UK
response to this Communication was submitted on 14 January; the
Presidency intends to adopt Council Conclusions on the Communication
at the JHA Council meeting of 24 February; the Commission is then
expected to publish its final proposals along with a related Impact
Assessment in mid-2011.
13.6 He says the Government has published its response to
the Call for Evidence. The response summarises the evidence received
between July and October 2010, involving around 160 written responses
from a wide range of data controllers, including small businesses,
large international organisations, consumer groups, local and
central government Departments and members of the public. As well
as the written responses to the published evidence paper, the
Call for Evidence included a number of workshops and meetings
with key interested parties which took place from August to October.
Representatives from government Departments, the wider public
sector, businesses and charities attended these workshops. The
response also sets out the next steps and how the Government will
approach the forthcoming European negotiations.
13.7 Some of the major issues for respondents to the Call
for Evidence included the definition of personal data and the
implications for research (including medical research); the types
of personal data which should be categorised as "sensitive
personal data"; the expense of complying with subject access
requests made under section 7 of the Data Protection Act; making
it mandatory for organisations to notify individuals and the Information
Commissioner's Office when they breach the Data Protection Act;
the uncertainty surrounding the role of consent in ensuring that
processing of personal data is legitimate; and the effectiveness
of the current systems in place to ensure lawful transfer of personal
data to countries outside the European Economic Area.
13.8 At the same time as conducting the Call for Evidence,
the Government published a provisional PIR of the Data Protection
Act, which aimed to assess the costs and benefits the Act has
generated. The Impact Assessment which accompanied the Call for
Evidence has been updated to take account of evidence provided
by respondents during the Call for Evidence process. The finalised
PIR Impact Assessment is annexed to the response document. Although
this has the primary purpose of assessing how the Data Protection
Act has worked in practice, the findings of the PIR will contribute
to the UK's overall evidence base for negotiations on a revised
EU legal instrument.
Minister's letter of 9 March 2011
13.9 The Secretary of State for Justice (Mr Kenneth Clarke)
writes to confirm that the JHA Council adopted Conclusions on
the Commission's Communication on Friday 25 February 2011, a copy
of which he encloses.
13.10 The Conclusions set out the Council's views on the general
principles arising from the Communication and do not prejudice
the need for careful and detailed consideration of any legislative
proposals. Among other things, they recognise the specific nature
of personal data processed in the field of police and judicial
cooperation in criminal matters. As noted in the Government's
response to the Communication, the UK believes that the Commission
should not take a one-size-fits-all approach to the revision of
the data protection rules and that any revision of the rules must
cater for the operational needs of the specific types of processing
such as that done by law enforcement bodies.
13.11 The Conclusions encourage the Commission to consider
enhancing the rights of data subjects through increased transparency.
The Government supports proposals to strengthen individuals' rights
and enhance their control so that the collection and use of personal
data is limited to the minimum necessary and that individuals
are informed how, why, by whom and for how long their data is
collected and used.
13.12 The Conclusions state that any new proposals put forward
by the Commission must be accompanied by a robust cost analysis
and that any resource implications for business must be proportionate
to the benefits delivered by appropriate safeguards for the more
transparent processing of personal data. Specific areas for further
consideration include the role of self regulation and reviewing
the current system of notification for data controllers.
13.13 The Conclusions contain recognition of the economic
importance of international data transfers and note that the existing
arrangements for the transfer of personal data outside of the
EU have not been fully successful. The Conclusions encourage the
Commission to improve the current mechanisms which allow for the
international transfer of data.
13.14 The Minister concludes by saying the Government expects
to see rigorous evidence based arguments for the Commission's
legislative proposals, including a full impact assessment, which
it anticipates will be published later this year.
Conclusion
13.15 We thank the Ministers for their letters, updating
us on the UK and Council's response to the Commission's Communication,
A comprehensive approach to personal data protection in the
European Union, and take note of their content.
13.16 We now clear the Communication from scrutiny.
74 95/46/EC. Back
75
See headnote. Back
| 
