New EU data protection draft somewhat limits right to be forgotten


A new draft European Union data protection directive would place some limitations on the right to be forgotten, but would nonetheless impose pan-European and international limits on the handling of personal data that many companies have already characterized as onerous.

The new draft (.pdf), introduced Jan. 7 by German European Parliament representative Jan Philipp Albrecht of the European Green Party, amends a version first introduced a year ago by EU Justice Commissioner Viviane Reding.

"Users must be informed about what happens with their data. And they must be able to consciously agree to data processing--or reject it," Albrecht said, according to multiple press reports.

Albrecht's modified directive would still grant Europeans the right to have their personal data erased should they withdraw consent or object to the processing of their personal data, but adds language preventing exercising the right to be forgotten on companies that have legally published personal data.

"If a publication of personal data took place based on legal grounds...a 'right to be forgotten' is neither realistic nor legitimate," the Albrecht draft says in an explanatory note. A proposed new clause would also specify that the processing of personal data that takes place as a result of freedom of expression, the media, or the arts, "within the limits of Union or nation law," would override individual data protection rights.

The directive would apply to all EU citizens, regardless of where the company that processes their data is located, says a Jan. 8 European Commission memo (.pdf). According to changes made in the Albrecht draft, "it would be sufficient that a company aims at offering its goods or services to individuals in the EU," the memo says.

The Albrecht draft would also extend the scope of the directive to any offering of goods and services, regardless of whether offered free of charge or not.

A coalition of Internet industry trade associations dubbing themselves the Industry Coalition for Data Protection issued Jan. 9 a statement critiquing the Albrecht draft, calling it a missed opportunity "to reconcile effective privacy safeguards with rules protecting the conduct of business--both fundamental rights under the EU charter."

The parliament Committee on Civil Liberties, Justice and Home Affairs will likely vote on the data protection directive by the end of February. 

For more:
- download the Albrecht draft (.pdf)
- download an European Commission memo on the draft (.pdf)
- see incredible photographs of the abandoned Buzludzha Monument in Bulgaria on The Bohemian Blog

Related Articles:
Right to be forgotten should be limited, says European Parliament vice president
EU data proposal would likely lead to search engine filtering, says ENISA
E.U. emphasizes data ownership, portability