Businesses will need to obtain explicit prior consent from individuals before processing data about them and give them the right to have their data deleted at any time especially if they post data on the Internet themselves, according to a statement from European Union Justice Commissioner, Viviane Reding. There has been expectation for some time that the EU’s data protection laws are about to be overhauled. That step is imminent. Reding expects to introduce proposals for the new rules by the end of January 2012.
In her statement, Reding said consumers should be more “empowered”. She also issued a warning that cloud computing service providers would face stricter provisions. Cloud computing refers to the making available of software and data on a network such as the Internet rather than on the user’s own servers.
This statement will send shockwaves through businesses. Currently, there are a number of grounds on which organisations can process data. They include if it is for their legitimate interests and it does not cause the data subject unwarranted harm. The statement is short so something may be lost in the translation, but at face value it suggests that the only grounds for processing data will be with explicit consent and that consent must be given in advance. That could prevent many businesses from functioning efficiently if they need to obtain explicit consent first every time.
The new laws will also look to address the problem of social media site users saying something embarrassing and then never being able to remove it later, leaving them in an awkward position when a prospective interviewer checks them out on the web before a job interview. There has not yet been any clarity over users’ position when someone else posts a comment, photo or video clip about them on the web without their consent – if someone is featured in someone else’s posted content, will the subject be able to pull it?
Further, the statement issues a warning for cloud computing service providers, but does not give any indication about how exactly their businesses may be affected.
Overall, the statement leaves more questions than answers and is not particularly helpful for businesses looking to plan ahead to the new regime. They will have to watch this space over the next few weeks to see what the impact will be.
The statement can be found here: http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/11/762&type=HTML.