EU’s new states face data rap

By Karen Carstens

Date: 01/07/04

MOST of the new states have failed properly to implement two pieces of EU legislation on data protection, law firm Linklaters warned this week.

The European Commission said it was considering legal action against some states while Linklaters' experts warned that the inadequate state of data protection law could drive away businesses.

When they joined the EU on 1 May all ten countries had implemented the 1995 data protection directive. Eight had implemented all or some of the 2002 'e-privacy' directive aimed at preventing internet fraud and combating spam, compared to nine of the EU-15.

But Linklaters found that the new states had "mis-implemented" some of the key provisions of the data protection directive such as the core definitions of who is a 'data controller' and what constitutes 'sensitive personal data', how to enforce the directive, and the rules governing international transfers of personal data.

Linklaters partner Christopher Millard said companies may find it impossible to marry their internal systems with the "inconsistent national data protection regimes within the EU". The upshot, he said, was that some "may decide to locate key processing hubs elsewhere" while "others may be tempted to ignore specific local rules that appear to be inconsistent with the directives".

The report criticises many legal loopholes in Hungary's 'place of establishment' rules. Slovenia's are "even more unusual", it adds.

A Commission official said legal proceedings against some countries could be launched before the summer holidays.

Law firm Linklaters has warned that most of the new Member States have not properly implemented two pieces of European Union legislation on data protection.

http://www.linklaters.com/Pages/Index.aspx http://www.linklaters.com/Pages/Index.aspx

---