Antitrust Law Daily Wrap Up, PRIVACY NEWS: ABA Sections of Antitrust and International Law Provide Comments on EU Data Protection Draft Regulation, (Nov 27, 2012)

By Jeffrey May, J.D.

In a recently released comment to the Council of Europe Data Protection Commissioner, the American Bar Association Sections of Antitrust Law and International Law questioned the “significant expansion” of the territorial reach of European Union (EU) privacy law under a proposed data protection regulation. The sections submitted the comment on the Proposed Regulation of the European Parliament and of the European Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (the Draft Regulation) on November 21.

According to the comment, the Draft Regulation provides that the obligations of EU privacy law extend to entities outside of the EU if those entities (1) offer goods or services to data subjects in the EU or (2) “monitor the behaviour” of those data subjects, which would encompass online behavioral advertising or other activities commonly undertaken to compile information. The section suggest that the Draft Regulation maintain the limits on extraterritorial application of EU privacy laws currently embodied in the 1995 Data Protection Directive and carried out in current practice. Under the EU Data Protection Directive, entities operating outside of the EU are subject to the application of EU law only if they are either established within an EU Member State or they use equipment (particularly servers) located in the EU to collect information on EU data subjects, the sections explained.

Contextual Approach to Consent

The sections also recommend a contextual approach to user consent to the gathering, processing, and disclosure of their personal information. The Draft Regulation would require that consent be “explicit.” According to the sections, requiring a user to affirmatively indicate consent each time an interaction occurs may downgrade the user experience. A “contextual” standard that defines the consent obligation based on the context and privacy expectations of the transaction would preserve user control and choice while providing online operators the needed flexibility to preserve the online experience.

Data Breach Notification Obligations

While the sections noted their support for the adoption of a data breach notification requirement, they suggested certain modifications to the proposal. They questioned a requirement that notice be provided to the supervising authority within 24 hours after the data controller first becomes aware of the fact of a breach, if “feasible.” The sections recommended that “the initial notification deadline be set in such a way as to permit and encourage an investigation and planning process that realistically takes into account the challenges faced by any entity that suffers a data loss.” The sections also suggested that both the method of notification and the content of the notice be consistent throughout the EU.

Monetary Penalties

Lastly, the sections called for a reduction in the maximum fines for noncompliance and for a much lower threshold initially with later increases according to a multiyear schedule. The comment suggested that this would provide an opportunity for businesses to become familiar with the Regulation and its implementation in practice.

News: Privacy