Debate Shows Strong Support for Data Protection Revamp and Anti-Spying Report

When LIBE began its probe six months ago into U.S. mass surveillance, it was a sensitive issue, said Claude Moraes, of the Socialists and Democrats and U.K., who write the committee report (bit.ly/1ha4Cub). The document combines all the revelations by former NSA contractor Edward Snowden, and the various allegations and press reports, into the most in-depth inquiry anywhere in the world, he said. Among other things, the report calls for a “digital habeas corpus” to safeguard fundamental rights in the digital age through eight actions. Those include: (1) Adopting the data protection package this year. (2) Concluding an EU-U.S. umbrella agreement guaranteeing citizens’ privacy and data protection rights. (3) Suspending the safe harbor agreement for transfer of Europeans’ personal data to the U.S. (4) Developing a European strategy for information technology independence.

The issues the report raises are “crucial,” said Justice, Citizenship and Fundamental Rights Commissioner Viviane Reding. She updated lawmakers on what the European Commission is doing to address U.S. spying allegations. Among other things, it analyzed how safe harbor is working and gave the U.S. government a 13-point to-do list which must be addressed by summer, she said. U.S. and EU negotiators are still working on the umbrella data protection agreement, with the next round due in several weeks, she said. The EC is also working on a statement on a European cloud, and has introduced a proposal for network and information security to not only reduce the number of cyberattacks but also make surveillance and spying considerably harder, she said.

Many lawmakers voiced support for the report. “This is the very fabric of our democracy, the rule of law,” said MEP Sophie In ’t Veld, of the Alliance of Liberals and Democrats for Europe (ALDE) and Netherlands. MEP Sarah Ludford, of ALDE and the U.K., said she supports the report “with a few quibbles.” Ludford said its call for EU independence in the IT sector doesn’t sit well with the need for a global deal on privacy protections, and that she’s not sure what a European cloud entails. Asked how Europe can safeguard online privacy when the infrastructure and data are in the U.S., she said she wants data protection reform in both regions. The EU can’t guarantee the safety of data in European locations, so the EU and U.S. have to cooperate on better protections, she said.

European Conservatives and Reformists (ECR) will vote against the report, said MEP Timothy Kirkhope, of the U.K. It contains some of the most “irresponsible recommendations and threats” he’s ever seen, he said. The intelligence community must be accountable but the recommendations are wide of the mark, he said.

Lawmakers panned the Council for remaining silent and indifferent to U.S. spying. Governments’ reaction to the NSA revelations are a “deep disappointment,” said MEP Dimitrios Droutsas, of the Socialists and Democrats and Greece. Governments can’t do this on the scale they have done it without some sort of democratic intervention, without someone speaking out, said MEP Rui Tavares, of the Greens/European Free Alliance and Portugal. Parliament is speaking but no one’s listening, he said. The U.S. will start paying attention when the EU shuts off the data flow, he said.

The Council hasn’t been silent, said Greek Deputy Foreign Affairs Minister Dimitris Kourkoulas, speaking for the Greek EU Presidency. It and the EC set up the EU-U.S. ad hoc committee to examine surveillance activities that affect privacy in Europe, he said. More generally, it’s in the interest of both sides of the Atlantic to address this, because trust is the key to securing the functioning of the digital economy, he said. The only way to deal with that is to engage in constructive dialogue with the U.S., he said.

The data protection regulation (summary here: http://bit.ly/1oJpOKb) covers a wide range of issues, including consent for use of personal data and profiling that will have an impact on the digital arena. The proposal is “one of the most important” files Parliament has handled this term, said MEP Jan Philipp Albrecht, of the Greens/European Free Alliance and Germany, who wrote the legislative report. That Parliament negotiated a single EU data protection law out of 4,000 amendments and input from around the world shows that lawmakers take their constituents’ concerns about privacy seriously, he said. But more than two years after the European Commission proposed the regulation, the Council still hasn’t found consensus, he said. Any further delay “would be irresponsible,” he said. Without quick agreement on the measure, the only winner will be the huge data companies of Silicon Valley, he said. If approved, the regulation will set the “gold standard” for privacy worldwide, he said.

The regulation is part of a package, the second leg of which is a proposal for a directive on the processing of personal data in the context of police and judicial matters. The author of the parliamentary report, Droutsas of the Socialists and Democrats and Greece, said he’s aware some MEPs will vote against it. But he asked how they can support the NSA report and data protection regulation but oppose better privacy protections in the law enforcement arena.

The Council has publicly voiced support for both, said Kourkoulas. No other piece of legislation has been the subject of such intense discussion, he said. But governments haven’t made as much progress as the European Parliament because the ambitious package covers all organizations and companies in the 28 EU members, he said. The data protection proposal cuts across all areas of society, he said. The Greek Presidency is committed to moving the package forward because it’s “of crucial importance to the digital single market,” he said.

The current data protection directive has created a patchwork of national laws which has hindered businesses, especially smaller and mid-sized ones, said Reding. Leveling the playing field will allow European Internet companies to compete globally, she said. The proposal will also boost privacy protections for individuals, which will help close the rift between them and the companies with which they share their personal data, she said. Regulators will have strong investigative powers to deal with companies that refuse to play by EU rules, she said. The European Commission proposed fines of up to 2 percent of a business’s annual revenue, but the Parliament wants 5 percent, she said. Such fines will be a deterrent, Reding said.

A new era of technological developments requires a new era of data protection law, but not to the detriment of small companies, said Kirkhope of the European Conservatives and Reformists and U.K. But Moraes of the Socialists and Democrats and U.K. said the European Parliament has created a set of digital rights that also leaves room for the digital economy to grow. The data protection package isn’t perfect, particularly the provisions dealing with data transfers outside the EU, said In ’t Veld of the ALDE and Netherlands. She said she will support it nevertheless to show that the European Parliament stands up for the rights of citizens.