European Parliament Committee On Industry, Research And Energy Publish Opinion On The Proposed General Data Protection Regulation

Author:Ms Cynthia O'Donoghue
Profession:Reed Smith

Following the lead of the Committee on Civil Liberties, Justice and Home Affairs (LIBE), which already released its draft report ( see our prior blog), 20 February, the European Parliament Committee on Industry, Research and Energy (ITRE Committee) published its Draft Opinion on the proposed General Data Protection Regulation (the "Regulation"). This opinion has been submitted to LIBE, which has the task of consolidating amendments and voting on its own report at the end of April.

In the Draft Opinion, rapporteur Seán Kelly outlined his substantial support for the European Commission ("the Commission") proposal suggesting that the changes should help avoid excessive administrative burdens for enterprises, and introduce a greater degree of flexibility, especially in terms of accountability and the notification requirements to supervisory bodies. The ITRE Committee, however, proposed significant amendments to the Regulation in an attempt to ease restrictions on companies by focusing on corporate governance, the use of impact assessments, and bringing increased clarity to the provisions. It has recommended significant alterations to the most contentious provisions, such as consent mechanisms; the rights of access, portability, and to be forgotten; the 24-hour breach notification requirement; and the sanctions regime.

Stressing the potential for over-reliance on consent, the ITRE Committee felt the overuse of consent may be unhelpful or even damaging to privacy protection, and would prefer that consent not be seen as the "primary or most desirable means of legitimising the processing of personal data." Instead, the ITRE Committee would prefer that use of consent be limited to where necessary in the correct context, for instance, when "only when data subjects can meaningfully and easily provide and revoke it." Furthermore, the ITRE Committee also suggested that the consent should be proportionate given the type of personal data being processed and the purpose as determined "through an appropriate impact assessment." Where no impact assessment is conducted, the ITRE Committee envisages that a default requirement of explicit, informed consent would continue to apply. This recommendation could result in implied consent being available as method of processing data, such as when an individual seeks the services of an organisation where no contract is entered. The ITRE Committee also proposed that broad consent with an option to withdraw it at any...

To continue reading