Slashdot Mirror

← Back to Stories (view on slashdot.org)

New EU Legal Privacy Framework: We're Not Kidding

Posted by Unknown on from the yes-you-can-have-a-pony dept.

An anonymous reader writes "Viviane Reding, Vice-President of the European Commission announced today a new regulation for data privacy in Europe (PDF) in replacement of a 1995 Directive. Recently, privacy laws have been under a lot of criticism for their practical inability to ensure a high level of protection to EU citizens. The new data privacy framework will bring a lot of changes: 24 hours security breach notifications, mandatory security assessments, end of notifications to local data privacy agencies, mandatory data protection officers and huge administrative fines: up to 2% of the annual worldwide turnover (that would have meant $1.2 Billion for Microsoft in 2008). Indeed that's 'the necessary "teeth" so the rules can be enforced.'"

37 of 243 comments (clear)

  1. So... by Joce640k · · Score: 4, Insightful

    Where do I sign up to vote "yes please"?

    --
    No sig today...
    1. Re:So... by Anonymous Coward · · Score: 4, Interesting

      Totally agree...this idea that businesses shouldn't be held responsible for their actions (or inactions) goes back to the business "revolution" of the 70s...the professional manager who operates without ethics, and who's only allegiance is to the shareholder (or their own salaries/bonuses)...it's about time governments started standing up for their citizens again....sign me up too!

    2. Re:So... by Xest · · Score: 5, Insightful

      My only dissapoint is the constant bandying about of the fines thing. They point out that 2% is massive in monetary value, well yes, it can be, but it's not enough of a deterrent.

      In the UK, for companies like Phorm, and ACS:Law, this would be zero deterrent to what they did, the fines shouldn't be capped percentage wise, as only a fine of perhaps 80% of annual revenue would've been enough to make Phorm and ACS:Law start behaving. The $1.2bn figure for MS sounds a lot less scary when you consider for someone like Andrew Crossley at ACS:Law who really has been in gross breach of the UK's data protection act, were he bringing in £250,000 a year with his personal one man business, would only see a fine of £5000, still leaving him £245,000 to take home. Where the fuck is the deterrent in that? You could write it off as the cost of doing business and just carry on doing it.

      Jail terms for owners/execs, or completely uncapped fines left to the decision of the judge as to what size fine to levy would be the only real deterrents. That's the biggest problem I see with this proposed law - there's no worthwhile deterrent for companies with no positive image to protect (e.g. Phorm) in the fines, they're toothless as proposed right now.

    3. Re:So... by Spad · · Score: 4, Insightful

      Note that it's 2% of turnover, not profit; a 10% fine would ruin a lot of businesses, which is not the intent of the law.

    4. Re:So... by TheRaven64 · · Score: 5, Insightful

      Although repeated infringements can quite easily ruin a company, and that is the intent of the law: companies should never be in the situation of deciding that ignoring a law and regularly paying the fines is just the cost of doing business.

      --
      I am TheRaven on Soylent News
    5. Re:So... by inviolet · · Score: 4, Interesting

      No it can't just be ignored. If these laws pass, every EU country will be forced to implement them. The European Commission has very sharp teeth indeed on stuff like this, and does not take kindly to companies trying to ignore its rules.

      Yep yep.

      As a US citizen now thoroughly ashamed of my society's behavior (esp. regulatory capture, as well as the all-classes corruption of the housing bubble), this news is the first time in my entire life that European society has seemed superior.

      It is quite a moment for me, coming as it is at the tail end of twenty years of staunch libertarian patriotism.

      --
      FATMOUSE + YOU = FATMOUSE
    6. Re:So... by xaxa · · Score: 4, Interesting

      As a US citizen now thoroughly ashamed of my society's behavior (esp. regulatory capture, as well as the all-classes corruption of the housing bubble), this news is the first time in my entire life that European society has seemed superior.

      The first time ever? That's incredible.

      Europe and the US have different views (to varying degrees) on many topics. Money, commerce, society, art, sex, the poor, the rich, military, environment, privacy, citizen rights and restrictions, punishment, education, transport, sport, patriotism, police, tax ...

      Pick any one of those and I'll be able to describe things I like about Europe (and dislike about America), and vice-versa.

    7. Re:So... by mrvan · · Score: 3, Informative

      In the Netherlands, there is a "knowledge worker" rule that says that if you can find a job that requires a degree and pays X% better than minimum (or modal?) wage, it's easy to get a working permit, plus you get a huge tax break (although I think there are cutting down on the latter). Any decent sized company will have someone in the HRM department who knows these rules and can help with the paper work.

      If you are here 5 years and pass a test you can apply for citizenship but that might require renouncing your US citizenship.

    8. Re:So... by Karl+Cocknozzle · · Score: 3, Informative

      Vote yes for more expansive government authority to protect you from something that would be no danger if you could just keep your mouth shut. Governments shouldn't be about protecting you from yourself.

      How would "keeping their mouth shut" prevent consumer data disclosures? Companies that aren't doing business "online" still hold a treasure trove of data about you, much of which I'd imagine you'd prefer was kept private. ...if they were under any obligation to disclose to you that they were holding information about you, that is.

      --
      Who did what now?
    9. Re:So... by delinear · · Score: 3, Insightful

      Do you think, when people lose their personal data because a company didn't secure it properly online or because an employee of that company had a laptop full of data and left it on a train, that's somehow the responsibility of the people and not the company? Short of becoming a hermit your data will end up in third party hands and you have very little control over what happens next, even if you give them the data in expectation of total privacy. Governments are some of the worst offenders when it comes to losing public data, and unfortunately there's not a lot you can do to avoid at least being in their databases.

    10. Re:So... by Opportunist · · Score: 3, Interesting

      I'm in risk management. The fine is pretty much already a deterrent, or rather, it's a good incentive to invest a few bucks in security.

      Security, or rather, anything related to heeding a law in a company, is a game of chances. What's my gain to break the law (or ignore it), what's the cost of the fine and how likely is it to happen. These are, in a nutshell, the things I deal with on a daily base. Yes, laws and following them is not a matter of "being good" or "doing no evil". It is simply and bluntly a matter of cost and benefit.

      2% annual revenue as budget is a wet dream for security and risk management. And while we won't get it (not by a longshot), we can now easily argue with the increased monetary risk when it comes to the question whether and how much investment is necessary for security.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    11. Re:So... by s73v3r · · Score: 4, Insightful

      Shut the fuck up, seriously. This idea that companies should not be held responsible for their actions is completely asinine.

      If you don't want companies to be held responsible, go find somewhere without "government intervention". I hear Somalia is lovely this time of year.

    12. Re:So... by gnasher719 · · Score: 4, Insightful

      You fine me 90% of my annual revenue? The same nanosecond a new company is created, which just happens to have the same board, who scoops up everything from the yard sale the company you fined has after going bankrupt, including all brands and patents. How do you plan to avoid that? Short answer, you can't. The company just went bankrupt due to the fine, in the bankruptcy process all liabilities get cut to a certain percentage and the new company can scoop up everything for a penny for the dollar. Yes, it's still some money lost, but we're a far cry from the 90% you wanted. if you're lucky, you get 1-2%. Which is pretty much where we're right now.

      Not that easy. If a company goes bankrupt and has sold on all kinds of stuff before the bankruptcy, all these sales can be invalidated, with more additional consequences.

      And think what would happen to a company like Google, or Facebook, or Apple, or Microsoft. Going bankrupt is not an option. If Google sold patents to Google v.2 for a dollar each, and then declares bankruptcy, surely Apple and others would go to the courts and offer twice the money.

    13. Re:So... by MysteriousPreacher · · Score: 3, Informative

      What you describe is possible, yet probitively difficult. Transferring assets with this intent, particularly if the old company becomes insolvent, is a criminal offence (at least in the UK). There is a whole raft of laws that make this process more complicated than slipping on a fresh pair of underpants. Granted though, fly-by-night operations could try such a thing, yet by your logic, pretty much all laws can be rendered useless.

      --
      -- Using the preview button since 2005
  2. Re:Doubt it will go anywhere by superglaze · · Score: 5, Informative

    No it can't just be ignored. If these laws pass, every EU country will be forced to implement them. The European Commission has very sharp teeth indeed on stuff like this, and does not take kindly to companies trying to ignore its rules.

  3. Re:Doubt it will go anywhere by houstonbofh · · Score: 3, Insightful

    I agree, but for a different reason. ACTA. This says that have to keep stuff secret, or not keep it, and ACTA says they have to keep it, and give it to the *IAAs. The media industry will not want this loophole.

  4. This is only proposed set of rules by jggimi · · Score: 3, Informative

    The article could be misinterpreted to mean this is a done deal as is.

    1. Re:This is only proposed set of rules by Teun · · Score: 3, Informative
      This applies to companies with more than 250 employees, I wouldn't call them small.
      A quick scan does not seem to forbid the outsourcing of this function meaning specialist companies will be available to manage oversee your privacy compliance.

      Important is the rule this Privacy Officer needs to be totally independent of the management.

      The easiest and for me obvious way for any company to lower the amount of effort controlling this privacy sensitive data is to only keep the absolute minimum of it.

      --
      "The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
  5. O2 by CheeseyDJ · · Score: 4, Interesting

    O2 must be glad they made their massive screw up before this came into effect...

  6. Re:data location? by Anonymous+Brave+Guy · · Score: 4, Informative

    Transferring personal data from inside the EEA to places outside like the US, where there are not such strong data protection rules, requires either the subject's consent or certain specific guarantees under a safe harbour agreement. Otherwise taking the data out is already illegal.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  7. Re:Doubt it will go anywhere by Anonymous+Brave+Guy · · Score: 5, Insightful

    That's roughly what a lot of people said before the EU went after Microsoft for anti-competitive behaviour, too. More than $1,000,000,000 in fines for defying sanctions later, those people had changed their tune.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  8. Re:This looks like a failure waiting to happen by Xest · · Score: 5, Insightful

    Well the obvious answer is that they can't if it really has no EU ties, just like they can't do anything about sites outside the EU hosting child porn currently.

    But that's just the way the world works, it's designed with that knowledge, but it wont protect companies like Facebook, Google, Apple etc. as they do have a prescence, and even if they withdrew that prescence they could potentially still harm those companies by preventing EU firms advertising with them for example.

    I'm sure firms will argue it'll cause some competitive disadvantage, but I'm not convinced that's true- I'd argue the opposite if anything, users across the globe should feel far more comfortable using companies that adhere to these rules, than those that don't.

    So I don't really see how it'll be a failure, it'll force all major online firms to adhere to it because they do have an EU prescence, and from there anyone else that doesn't comply will have the disadvantage of being much less attractive to customers. Who wants their data held by some fly by night company that has no restrictions on what it can do with that data when they can instead use a company with more ethical rules surrounding what it can and will do with your data?

  9. Re:Doubt it will go anywhere by Anonymous+Brave+Guy · · Score: 5, Insightful

    Perhaps you haven't noticed, but being associated with Big Media is pretty much toxic for politicians right now.

    Oh, and also in case you hadn't noticed, the EU hasn't actually signed ACTA yet. Technically they have until March next year, IIRC, though I expect someone will try to sneak it through in the very near future before the politicians realise it's too close to SOPA and PIPA (in some respects) and likely to cause similar grief.

    Also, while the European Commission (the unelected guys who seem to be behind the secret negotiations) still publicly support ACTA, whether they can get it through the European Parliament (the elected guys who recently got new teeth under the Lisbon Treaty and seem to be enjoying exercising their powers) is a different question.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  10. Re:Doubt it will go anywhere by Alkonaut · · Score: 4, Insightful

    No law like this will be passed on EU level unless it is absolutely certain that the core countries will adapt it without fuss.

  11. Re:data location? by SomeKDEUser · · Score: 3, Insightful

    Funny thing: some rights, you cannot sign away. So the EULA is irrelevant. For example, no contract of indentured servitude is legal. In the same way, you cannot sign away your right to privacy.

  12. Re:keeping it regional? by SomeKDEUser · · Score: 3, Informative

    It is completely within their remit. The part of the company paying is EU-based, but the fine is calculated based on worldwide activities.

  13. Re:data location? by SomeKDEUser · · Score: 4, Informative

    In most of Europe, we don't vote for judges. They are appointed and are quite immune to lobbyists. Also, most of Europe has a civil law system, and under that system, the laws do not get "interpreted" by the judges...

    It is a bug of the American system that judges are affected by lobbyists and get to decide what laws mean. This doesn't mean our system is better. This is just a bug we don't have.

  14. Re:You Can't Vote by Angostura · · Score: 3, Informative

    Apart from - you know - the fact that two of the more important EU institutions are the Council of Ministers and the Parliament - both of which contain people you voted for.

  15. Re:Doubt it will go anywhere by Zwerg_Sense · · Score: 4, Informative

    to be precise: The important part is a regulation, hence it does not need to be transposed into national law! It is mandatory for the member states to comply. It is down to the European Parliament to adopt it, which of course has representatives from every member state.

  16. Consent and EULAs by Animats · · Score: 4, Interesting

    One of the important rules is "If the data subject's consent is to be given in the context of a written declaration which also concerns another matter, the requirement to give consent must be presented distinguishable in its appearance from this other matter." In other words, merely consenting to a long EULA that involves transference of data isn't enough. There has to be a separate checkbox to allow redistributing data. EULAs that allow one party to change the terms at any time won't qualify, either.

  17. Re:You Can't Vote by TheRaven64 · · Score: 4, Informative

    The Council of Ministers doesn't contain anyone I voted for. It contains people selected by the leader of the political party that won the national election. Neither the candidate MP I voted for nor the one who was elected to represent me is a member of this party, so my MP does not have any say in their selection. MPs are not supposed to respond to comments or questions from people in other constituencies, so the people who 'represent' me in the CoM are not actually supposed to communicate with me at all, and I have no influence on their reelection.

    I am much better represented in the Parliament. I have 5 MEPs, one of whom does a very good job (although when the Welsh Nationalist is the sane one, you start to worry about the system), but at least there is one MEP who represents my views and is accountable to me there.

    Unfortunately, every time we try to push more power to the Parliament, the Eurosceptics manage to get it overturned...

    --
    I am TheRaven on Soylent News
  18. Re:Doubt it will go anywhere by mrvan · · Score: 3, Insightful

    EU law has direct force in national law, EU law trumps national law, and questions of interpretation of EU law are handled by the EU court, whose decisions are binding for the national courts. The EU is very far from toothless in areas where it has legal competence.

    If they are indeed replacing the '95 directive the "published document" will have the form of a EU directive, which member states are compelled to turn into national law. If they don't do so, the EC (or, I think, any citizen with standing) can sue them in the EU court for failing to comply.

    What you are referring to as toothless is probably in issue domains like foreigh affairs and defense, where the member states have full competence and the only thing the EU can do is try to forge some sort of consensus.

  19. Re:This looks like a failure waiting to happen by s73v3r · · Score: 3, Insightful

    Good fucking riddance. If they can't actually secure my private data, they shouldn't be in business in the first fucking place.

    You people always bitch and moan about "regulations being a burden!", but for some reason, you think it's completely fucking ok for companies to just not give two shits about someone's data.

  20. Re:You Can't Vote by TheRaven64 · · Score: 3, Informative

    Did you read my post? It's not that I didn't vote for the person who won - the person in my constituency who does represent me (even though I didn't vote for me, he is accountable to me and the other people in my constituency) has no say in selecting the people who go to the Council of Ministers. They are selected by the government (a coalition at this point, more commonly a single party with a majority) from the pool of their MPs.

    These ministers are not allowed to communicate directly with other the constituents of other MPs. This means that the people who is supposedly representing me at the CoM are not allowed to communicate with me. I am not supposed to write letters to them, and they are not supposed to reply. In contrast, I have 5 MEPs who represent me and even though I only voted for two of them (I think - one definitely, I can't remember about the others) they are all supposed to be available for direct communication with me.

    --
    I am TheRaven on Soylent News
  21. Re:Here's mine by chill · · Score: 4, Insightful

    art: US? Seriously? Have you ever BEEN to Europe?
    transport: US? Seriously? Where do you live that has better transit systems than most of (modern) Europe?
    punishment: US? Is that YOU getting punished or your desire for strict punishment on OTHERS? The latter -- US, the former, Europe.

    --
    Learning HOW to think is more important than learning WHAT to think.
  22. Re:You Can't Vote by Arancaytar · · Score: 5, Insightful

    And yet somehow, bureaucratic oppressive Europe got awesome privacy legislation. What did the democratic land of the free get? SOPA.

    Life is good here in the socialist hellhole. ;-)

  23. Re:Here's mine by Your.Master · · Score: 5, Interesting

    Every time I see that measured, it consistently shows the US having the least social mobility of all developed nations. For example, here: http://ftp.iza.org/dp1993.pdf and http://wrap.warwick.ac.uk/81/

    I do often see the claim that the US has an advantage here, but I have never, ever seen it backed up, while I have seen the counterclaim backed up.