Commission raises prospect of EU data protection norm

Date: 17/06/1999

By Peter Chapman
EUROPEAN Commission officials are urging the EU standards body CEN to examine the scope for creating a Union data protection norm.

The move comes as firms from the EU and abroad struggle to comply with the terms of the Union's tough new data protection rules, which entered into force last October.

These stipulate that companies exporting personal data to another member state or beyond the Union's borders must comply with a raft of strict legal criteria. These include giving individuals the right to get information about themselves amended and to seek legal redress if they think the data is incorrect or has been misused.

Companies which fail to fulfil these requirements risk having their data trade blocked by a special EU committee of data watchdogs.

A Commission source said the institution had already met CEN, industry representatives and government officials to discuss how a common standard or other measures could boost compliance with the new directive amongst Union firms.

At their meeting, they examined Canadian proposals for the International Standardisation Organisation (ISO) to develop a world norm for data protection. Ottawa already has its own data protection standard based on existing Organisation for Economic Cooperation and Development (OECD) guidelines and is keen to see this approach adopted by other countries.

The Commission official said data experts had asked CEN to consider whether there was a need for an EU norm to implement the ISO standard but tailored to the EU marketplace. Another option, favoured by industry, would be for CEN to develop guidelines for firms on voluntary codes of conduct on electronic data protection.

Such codes would allow firms to continue trading data without having to get permission for each transaction, but only once this had been approved by the special 'Article 29' committee of Union data experts set up under the terms of the directive.

A CEN official said the Commission's own data protection experts favoured an EU norm similar to the Canadian one. But he added that the institution was opposed to imposing mandatory requirements on industry. Nor, he insisted, did CEN wish to force a standard onto firms, even if it was given the go-ahead to develop one.

"The message we want to get across is that we are not interested in forcing anything upon them. We do want industry to know we are there to help them comply with the directive if they need it," he added.

Moreover, he said, CEN was more likely to favour moves to help individual sectors draw up their own codes of conduct. This could be in the form of a CEN 'workshop agreement' rather than an EU norm.

"A lot depends also on whether the Article 29 committee recognises what we do. If they did not, then its credibility would be in question," he added.

CEN is expected to table its recommendations to the Commission at a follow-up meeting on the issue in September.

The move to boost EU companies' compliance with the directive comes as talks continue with the US over its approach to data protection. Washington is seeking Union approval for the voluntary 'safe harbour' schemes run by sectors of its industry, claiming that these offer similar basic levels of protection to those required under the EU rules.