The December agreement between EU bodies on the reform of data protection rules across the EU heralds a new era for the fundamental right to data protection for individuals across the region. Marking the 10th European Data Protection day on 28 January, FRA looks forward to the stronger protection and safeguards that the rules will provide.
As FRA reported in its publication ‘Access to data protection remedies in the EU Member States’, people across the EU have become victims of data protection violations brought on by the widespread use of information and communication technologies by public and private bodies. It underlined the need for the EU’s reformed data protection rules to come into effect to better protect individuals and to strengthen the powers of the national data protection authorities that were set up to protect data and privacy in the EU.
Under the new rules, the existing right to data protection will be strengthened and individuals will have more control over and easier access to their personal data. Creating a data protection framework with strong safeguards that allows for future technological developments will also rebuild trust in how personal data are being processed.
The rules also apply to the processing of data by law enforcement authorities. Such authorities will have to comply with the principles of necessity, proportionality and legality, and provide appropriate safeguards for individuals when handling personal data.
The ongoing discussion about enhanced internal security measures in light of recent terrorist attacks, such as the use of passenger name records or data from the EU’s Schengen Information System, may also impact fundamental rights. Data protection therefore needs to be hardwired into all security measures. For example, plans to enhance the existing European Criminal Records Information System (ECRIS) for sharing criminal records between EU Member States in relation to non-EU nationals needs to ensure personal data are protected and inaccuracies can be easily corrected. These were some of the views of FRA’s recent assessment of the fundamental rights implications of such a possible future system.
The new rules will in part contribute to better internal security and will apply to both purely domestic processing and cross-border transfers of personal data. By harmonising the 28 different national legislations, the common rules on data protection will enable law enforcement and judicial authorities to cooperate more effectively and more rapidly with each other. It will facilitate the exchange of personal data necessary to enhance security under conditions of legal certainty, fully in line with democratic principles and the Charter of Fundamental Rights. As the reform means the rules will apply all across the EU, the lack of understanding and awareness about data protection also identified in FRA’s data protection remedies report should also be addressed.
In addition, national data protection authorities will have greater power, an issue that was identified by FRA in its comparative report from 2010. For example, under the new rules they will be able to fine companies who do not comply with EU rules. They will also supervise data processing by law enforcement authorities and will play a key role alongside the European Commission in ensuring the rules are applied uniformly across the EU.