Data Protection Regulation nears completion, takes a balanced approach

Negotiators are confident that political agreement will be reached by the end of this year

The Data Protection Regulation is entering the closing stages and negotiators are now confident that they will reach political agreement before the end of the year.

Following last week’s trilogue negotiation, the EU Council has produced a consolidated document of the regulation including all the tentative agreements reached over the last 6 months of negotiations.

This is by no means the final version of the Regulation but it does give us an indication as to the direction of travel during trilogue. The consolidated text contains a number of positive movements for marketers.

We will be releasing a full analysis of the text at a later date once we have had time to digest it. Below is a summary of headline possible changes to the text.

The definition of consent does not include a reference to ‘explicit consent’ and uses a definition that is more in line with current practice and gives marketers more room for manoeuvre. Consent is defined as, “means any freely given, specific and informed indication of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, signifies agreement to personal data relating to them being processed”.

If this made it into the final version of the regulation it would be a big win for the marketing community.

Article 20 speaks about the data subjects’ right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects with significant impact. However, this right does not apply if the data subject has explicitly consented or if it is necessary for entering into a contract between the data controller and subject. This change in wording is a welcome step towards differentiating between profiling that has positive or negative effect on an individual.

In Article 6 the grounds for processing personal data are discussed and one them is the legitimate interests of the data controller. The legitimate interest clause has been kept the same as in the earlier Directive.

This means organisations can collect and access data, without consent, when there is a legitimate interest to do so and the appropriate safeguards are in place. This provision is supported by the Council, and differs from the European Parliament provision which would limit access to data for third parties.

However, the DMA still has a number of reservations with the text and believes it still does not represent the right balance between the legitimate interests of businesses and the privacy concerns of consumers. But, it is positive to know that the debate is moving in the right direction.

A comprehensive review of the consolidated text will be posted to the DMA website later this week.

If you want to read over the consolidated text then email our external affairs executive, Zach Thornton, and ask for a copy. His email address is Zach.thornton@dma.org.uk.