Changes in EU online data rules may impact HK traders

A Greek retailer has been quoted as saying, “if there is a limitation on the way data can be used, based on what is outlined at the time of collection, almost every aspect of business communication will be made illegal. For example, companies will not be able to make product proposals based on previous purchases, since this data manipulation is almost never outlined, although common sense dictates that it is practised both online and offline.”

It has been revealed from the survey that almost 80% of the companies felt that third-party access to personal data, based on “legitimate interests”, was vital to a well-functioning online market and to the quality of customer experience. Moreover, 90% of the companies concluded that hiring a Data Protection Officer would be too burdensome in terms of cost.

Moreover, although the proposed Regulation eliminates the registration obligation, i.e. the obligation to register with a local data protection authority, it replaces this obligation with, among others, increased responsibility and accountability of data controllers and processors. In practical terms, a vendor of goods online collecting the personal data of its individual customers, would normally be deemed a data controller.

In consequence, Hong Kong traders may well find themselves in this position. The draft Regulation provides, for example, that data controllers must actively adopt policies and implement appropriate measures showing compliance with the Regulation. Such measures shall in particular include keeping a variety of documentation. This is expected to increase the administrative paperwork and burden of companies.

Although the Commission’s proposal exempts companies with less than 250 employees from this obligation (but only if data processing is just an ancillary activity), parliamentary committees have proposed eliminating this ‘carve-out’ for SMEs, arguing that the documentation requirement should apply to all companies. With regard to the proposed reforms, there has been heavy lobbying from many companies and from the U.S. as well.

Despite this, the European Commission has remained persistent over its wishes to revise the current law. The EU’s chief data protection supervisor, Peter Hustinx, has cautioned that excessive lobbying and “red herrings”, throwing people off the intended path, could lead to the collapse of the revision of the Directive. The EU’s Justice Commissioner, Viviane Reding, in a speech to Member States’ Justice Ministers on 6 June 2013, said that the reforms would facilitate growth by harmonising the EU’s national rules and generate trust through up-to-date legislation while addressing the data privacy concerns of citizens. She also said, “I count on the European Parliament and on the incoming Lithuanian presidency to resist, alongside the Commission, all attempts by those who are still trying to weaken data protection standards in Europe.”

Both the European Parliament and the Council of the EU must approve the Commission’s proposal in order for it to be adopted. The proposed Regulation is currently at committee stage of the European Parliament, where around 4,000 amendments have been submitted by Members of Parliament. The legislative process could be concluded in 2014, with the Regulation coming into force two years thereafter. 

HKTDC