EU ministers back key pillar in data reform bill

The European Commission backed the Italian compromise text as well.

“The presidency has succeeded in crafting a compromise that is a sound basis and that builds on the essential elements of the commission’s proposal,” said EU justice commissioner Vera Jourova, at her first ministerial meeting.

Jourova’s conciliatory tone marked a departure from her predecessor, Viviane Reding.

Member states last December complained of the complexity and administrative burdens of the one stop shop. Reding at the time accused ministers of using delay tactics to water it down.

Similar issues were raised again at Thursday’s meeting in Brussels but the mood has shifted, perhaps in part, because of the drawn out inter-state negotiations on the heavily lobbied bill.

The commission's plan allows companies to tackle EU-wide data cases through the data chief in the EU country in which they have their HQ, instead of dealing with 28 national regimes.

A single data protection authority would also be responsible for taking legally binding decisions against a firm. His or her final decision applies to all other member states.

In case things go wrong, a so-called European Data Protection Board (EDPB) would step in to make sure the rules are applied correctly.

The board acts as a kind of legal arbiter should a national data authority disagree with a decision that has been made by one of his or her peers.

The board’s final decision is legally binding.

But not everyone likes it, sparking drawn out debates in previous meetings that aimed to resolve the differences.

The biggest problems centre around three areas.

First, some member states like Ireland oppose giving the EDPB binding decision powers on transatlantic cases.

Ireland is home to big tech and Internet firms like Facebook, Apple, LinkedIn, Twitter, eBay, and PayPal. Collectively, they employ thousands of people.

The firms go to Ireland in part because of its low 12.5 percent tax rate and its relatively more business-friendly data protection authority.

Complaints by Ireland’s justice minister on Thursday struck out at the EDPB board.

“We consider that it would be all too easy for any or every cross border case to reach the EDPB board,” he said.

The minister said it would generate a queue of cross border cases awaiting the attention of the board.

“We estimate that three to four months may be required in order to finalise cases before this board,” he said.

Denmark also doesn’t like it.

They want to screen decisions made by other data protection authorities, which has a direct impact on them.

“If the one stop mechanism is to be binding or to be implemented in Denmark, before that happens it has to be adopted by the Danish supervisory authority,” pointed out the Danish justice minister.

Others, like the Netherlands, are unhappy about setting up a registry of main establishments in the EDPB.

The registry requires companies to inform data authorities where they have their headquarters.

“This is a register that involves a substantial administrative burden for companies,” said the Dutch minister.

The third sensitive point is proximity, where decisions are taken where the complaint was issued.

The UK fears the proposed model would push final data protection decisions up to the European level because of the powers endowed to the EDPB.

“The system will become complex, it will run into problems, and the inevitable solution is that it will be pulled upward to the EDPB, which will become the body for all of us,” said UK justice minister Chris Grayling.

The issues will be taken up by the incoming Latvian EU presidency. The hope is the bill, proposed some two years ago already, could be adopted by next summer.