PLEASE NOTE: Our website uses a technology called cookies to improve your experience. One of the cookies we use is essential for parts of the site to operate and may have already been set. You may delete and block all cookies from this site, but parts of the site will not work. For more information see our privacy policy.

To accept cookies from this site (and hide this notice) please check this box and click the continue button.

HomeThe IssuesOur ServicesOur TeamPublicationsTestimonialsNewsletterContact us

Reding sticks to her guns over tough new data protection Regulation

Despite a “battering” from both within and without the European Commission EU Commissioner Viviane Reding has proved to be a lady not for turning.

Keeping to her own scorching pace – and apparently ignoring most of the plaints from colleagues that the proposals are potentially damaging to the European economy – she has published the final draft Regulation on which future legislation will be based .

Reding has always made it clear that she is looking for more harmonisation. She wants for “high, common European standards” and believes that companies who direct their services to European consumers should be subject to EU data protection laws or be prevented from doing business. The new draft keeps to this “extra-territorial” approach but companies with less than 250 employees which only occasionally sell into Europe will not now have to appoint a local representative.

Despite the amendments, there is no question that the Regulation as now drafted would have a fairly “seismic” effect on marketing. It’s all in there, from the requirement for explicit consent (i.e. from a “clear affirmative action”), to the universally unpopular “right to be forgotten”. Penalties for infringement could be an eye-watering 1 million Euros or 2% of global turnover.

If the definition of consent stands, marketers will have to get opt-in or rely on the “legitimate interests” condition for processing (itself a slippery balancing act between the rights of the Data Controller and those of the Data Subject).

Add to that the rules on compulsory breach notification (where feasible in 24 hours) and the appointment of data protection officers for businesses over 250 employees and the cost of implementation will soar.

The battle lines are set and Direct Marketing Associations throughout Europe are already primed to get this Regulation significantly amended but they may have an uphill struggle. The industry needs to be in a position to quantify the impact of the Regulation – and especially the ramifications of the tougher consent requirements – in real terms. To get the attention of the regulators there will need to be hard facts about the businesses - and more importantly jobs - which will be put at risk.

Other recent items: