Firms Brace for New European Data Privacy Law

Facebook, Apple, Google, Amazon and I.B.M., individually and through industry groups, have all sought to actively participate in a legislative process that could give half a billion consumers the right to withhold basic personal details while using the Web, putting a major crimp in the financial model that makes those business run.

On Monday, their European counterparts showed up in force at a conference in Berlin to discuss the potential law, which is expected to come to a vote sometime next year. Representatives from European Aeronautics Defense Space, BMW, Daimler and Rovio Entertainment, the creator of mobile apps like Angry Birds, filled a hotel meeting room and tried to figure out how new rules would affect them.

Even nontech companies like UBS, the Swiss bank, were among the 70 attendees at the Pullman Hotel Scheizerhof near the Tiergarten central park, as the new regulations are expected to affect virtually every type of business.

The effort to create strict new online privacy protections in Europe is motivated by a desire to rein in the data use of social media companies like Google and Facebook, said Ian Walden, a professor of information and communications law at the University of London and a speaker at the conference.

“But the problem is this proposal is going to create a whole new layer of regulation for the vast majority of businesses that have nothing to do with social media,” he said. “They are going to see their compliance loads increase greatly with very little benefit.”

The measures would prohibit the use of a range of standard Web tracking and profiling practices that companies use to produce targeted advertising, unless consumers gave their explicit prior consent. The bill would also grant European consumers a fundamental new right: data portability, or the right to easily transfer an individual’s posts, photographs and video from one online service site to another.

The measures, as well as the creation of an E.U.-wide data privacy regulator, were originally proposed last year by Viviane Reding, the European justice commissioner.

They are now contained in a bill sponsored by Jan Philipp Albrecht, a member of the European Parliament from Hanover. But the fate of the bill, meant to revise an 18-year-old statute, remains murky.

The lead parliamentary committee for the bill is struggling to schedule more than 3,000 amendments to the proposal and has already pushed back a vote from the end of this month until June. Negotiators in the upper house of Parliament are at odds over basic concepts, like the requirement for businesses to obtain prior consent before collecting Web data and proposed penalties for violators, which would be set at up to 2 percent of a company’s annual sales.

“I think at this point, there will be a set of new rules, they will be uniform, and they will raise the level of data protection from where it is now,” said Thomas Lehnert, the director of data protection for EADS Deutschland, who participated in the conference.

EADS, which employs eight full-time data protection officers in 17 countries, may have to hire many more such officers in almost all of its jurisdictions, he said. “I think we are talking about a multiple of what we have now,” Mr. Lehnert said.

U.S. interest in the European deliberations remains significant. About a third of the data-protection officials attending the conference were representatives of U.S.-based companies. Exxon Mobil, Aon, Amway and Procter Gamble were present, as were the global law firms of Hogan Lovells, Taylor Wessing and Latham Watkins.

Other countries are watching as well. Lawmakers in South Africa are in the final stages of completing a six-year effort to create the country’s first comprehensive data protection laws, which will be tailored to the new E.U. rules, said Robby Coelho, a lawyer at Webber Wentzel, a law firm in Johannesburg.

“South Africa wants to have internationally recognized data protection standards to attract businesses to the country,” Mr. Coelho said.

Likewise in the Middle East, the overseers of international free trade zones in Qatar and Dubai plan to adopt data protection laws that mirror European rules, said Justin Cornish, a lawyer at Latham Watkins in Dubai, who also attended the Berlin conference.

“There is an expectation that data protection laws around the world are going to become more stringent, and Europe is leading the way,” Mr. Cornish said.

Article source: http://www.nytimes.com/2013/05/14/technology/firms-brace-for-new-european-data-privacy-law.html?partner=rss&emc=rss