Privacy Law and Policy Reporter
As noted in last issue's account of the 1995 European Privacy Directive (2 PLPR 82), the European Parliament made some last minute amendments to the PLPR 82), the European Parliament made some last minute amendments to the Council of Ministers' 'common position' draft in June, before the Directive became EU law on 25 July.
At the annual Privacy Laws and Business Conference in Cambridge, England in July, these amendments were explained. Although generally described as 'minor', several of the amendments need to be noted, either because they may have implications in relation to data transfer to non-EU countries, or because they indicate important features of the EU model, which is (despite many reservations) being seen as the new world standard in data protection.
A change to the 'recitals' or preamble (recital 41) emphasises the delicate balance in the origins of the Directive between free trade and individual rights by inserting 'business confidentiality' as an interest to be protected in implementing these rights.
The crucial definition of 'controller' (of personal data) in art 2(d) has been changed to include natural or legal persons which alone or jointly with others determine the purposes and means of processing. This is an important safeguard against avoidance of responsibility.
The explanation of the scope of the directive in art 3 now ensures that the exclusion of processing concerning the 'economic well being of the state' is restricted to processing operations bound up with 'questions of state security'. This means that EU member states will find it more difficult to argue that the Directive, including the third country transfer provisions (arts 25 & 26) will not apply to some categories of official processing of personal data - thereby strengthening the protection given to individuals.
The provision for exemptions or derogations relating to the media (art 9) has been narrowed to apply to processing for journalistic purposes or the purpose of artistic or literary expression only if they are necessary to reconcile the right to privacy with the rules governing freedom of expression.
The art 26 derogations from the art 25 third country transfer controls, already substantially expanded in the evolution of the draft Directive, have been further widened to allow transfers that are legally required (not just necessary) on important public interest grounds or in relation to legal claims.