Business calls for harmonised rules on data protection

Viviane Reding, EU commissioner in charge of the issue, says "data protection rules must be updated to keep abreast of technological change to ensure the right to privacy" with rules struggling to keep apace with new developments such as social network sites, targetted online advertising and Radio Frequency Identification (RFID).

She says is in favour of the 'right to be forgotten' online (the right to permanently remove that embarrassing photograph of yourself from Facebook) and wants all companies targeting EU customers to abide by EU data privacy rules.

While improved data protection is an end to itself, policy-makers underline that it is also essential for turning the EU into a digital economy.

Simply put, people will not carry out more economic activities online unless their trust increases. At the moment, 70 percent of citizens, according to a recent EU statistics, are concerned that their data can be misused by a third party.

New data protection proposals will have implications across a broad range of society – including consumers, internet and telecom providers, social networks, publishers, advertisers and police and justice authorities.

Harmonisation

One of the main calls from businesses has been for simplified, harmonised rules. But the current law governing the area is a directive as opposed to a regulation. This means member states can interpret how it should be implemented, leading to a patchwork of standards across the bloc. The data protection authority in Germany considers IP addresses to be personal data, for example. This is not the case elsewhere.

Another consequence of the 15-year-old law - drawn up in the digital world's infancy - is the lack of clarity international companies operating outside the EU. For instance, it is not clear which privacy rules applies if a company is using EU-based equipment to process data but has otherwise no presence in the EU.

"Maximum harmonisation is crucial for the ISP industry in Europe," said Oliver Sueme, vice-president of the European Internet Service Providers Association.

Due to legal uncertainty and administrative costs, an unnamed European ISP company he cites spends €1 million a year on a legal team, privacy officers and administrative fees. This comes atop the technical systems needed to ensure privacy.

Barbara Kirchberg-Lennartz, data security officer for German airline Lufthansa, notes that "even in Europe, we can never be sure which law applies."

"Our data declarations on our website are getting longer and longer because we have to explain so many things," she said.

Software giant Microsoft, keen to convince Europeans to use and trust cloud computing (remote data storage), says strict laws are needed for people to make the switch.

"We want a framework of law that is known, clear stable - even if it is strict that doesn't matter. If everyone knows what the law is, people will go to the cloud and put their service safely in a country other than their own," says John Vassallo, the company's Europe vice-president.

Cookies

Other companies are also keeping a strong eye on Reding's data privacy plans. Internet search giant Google, with its vast advertising revenue streams, is keen to stress the fundamental role advertising plays in keeping online services free.

"Online advertising does not need to be at odds with data protection," said Marisa Jimenez, the company's European privacy policy council, at a recent hearing in the European Parliament.

Noting that behaviourial advertising - where business targets advertise individuals according to their search history, much to the chagrin of consumer rights groups - only represents a "tiny fraction" of Google's business, she warns against demonising cookies, the enablers for such advertising.

Cookies store information about a user's web history, allowing for the practical gains of storing user preferences, creating shopping baskets, or just remembering when you are logged on to a website.

Jimenez has an ally in European publishers. Christoph Fiedler, director of European affairs at the German federation of magazine publishers, says that "cookies play an important role in measuring readership." And knowing online readership is the basis for attracting advertising, which usually represents the bulk of revenue for publications online.

Press freedom

Additionally, Fiedler warned the commission about the implications for press freedom that a change to the directive could bring.

If publishing or storing information about a corrupt politician or about somebody's connections with an extremist group falls under the data protection rules, "this will mean the end of press freedom."

He said it is important that the legality of whether some personal information should be published should be based on media law and not data privacy law.

Meanwhile consumer rights groups, who have been thrilled by Reding's statements on privacy, suggest there should also be liability rules for consumers who have suffered due to privacy breaches.

"When a consumer suffers damage, to whom should he complain," asks Kostas Rossoglou, legal officer at the European Consumers Organisation BEUC.

Complexity

Even as interest in Reding's proposals builds, the only thing that is certain is that it will be complex to enforce.

Reding's 'right be forgotten' already has Google's global private counsel Peter Fleischer scratching his head. On a personal blog he asks: "If I post something, and someone else copies it and re-posts it on their own site, do I have the right to delete it?" or "If someone else posts something about me, should I have a right to delete it?"

The e-privacy directive coming into force on 25 May also illustrates the problems with the issue. To date, no EU government has drawn up guidelines on how the directive, aimed at giving consumers more control over how their web browsing is tracked, will be enforced.