We are the voice of insurance and long-term savings | Contact us

European Parliament key vote on data protection summary and next steps

The European Parliament’s (EP) Civil Liberties Committee has adopted its report on the Data Protection Regulation.

In a vote on Monday 21 October, the results revealed 49 votes in favour, 1 against and 3 abstentions.

MEPs also voted that the EP could enter trilogue discussions, as soon as the Council of Ministers reaches its general approach.

Taking the floor during the vote, EP Rapporteur Jan Phillip Albrecht confirmed that it is the EP’s intention to start trilogue negotiations as soon as possible, with a view to reaching an agreement that could be adopted by the EP plenary in April 2014, ensuring the legislative process for this file is finalised before the EP elections.

Key issues

The ABI is still waiting to receive the official consolidated text voted through. However, we understand that the compromises voted on were identical to those leaked prior to the vote – the text of which can be found here. 

Profiling – Article 20

Significant improvements have been made to this Article, with MEPs voting to ensure that individuals can be subject to profiling. They have moved from an outright ban on profiling to a right to object to profiling, similar as the one enshrined in the current 1995 Directive.

Furthermore, MEPs clarified that individuals can be profiled if it is necessary for entering into, or performance of, a contract, or if profiling is expressly authorised by a Union or Member State law, or if consent has been obtained for profiling from the data subject.

The ABI also welcomes the amendments proposing that data protection controllers and processors disclose information on ‘the logic of profiling’ have not been included in the final compromise text.

However, we remain concerned at changes that state that ‘profiling which leads to measures producing legal effects…shall not be based solely or predominantly on automated processing and shall include human assessment, including an explanation of the decision reached after the assessment’. The ABI believes this is too onerous and we will continue to use future opportunities to get this removed.

Conditions and lawfulness of processing – Article 6-9

Significant improvements have been made to these Articles. In particular, the ABI welcomes the deletion of the concept of ‘significant imbalance’ and the introduction of the recognition that withdrawal of consent might result in the termination of the services provided.

Furthermore, both Articles 6 and 9 acknowledge that processing of data can be done if the processing is necessary for the performance of a contract or with the data subject’s consent.

The ABI is concerned by Recital 32 which could have some implications for the insurance industry, for example in the provision of joint policies for life insurance or additional drivers for motor insurance.

This addition states that ‘Consent cannot be given for the processing of personal data of third persons’. This was a late addition that only made it into the Recital and not the Article. The ABI is awaiting confirmation on whether this was removed before the vote.

However, we have already raised this point in our submission to the Ministry of Justice call for evidence and in our bilateral meetings with MoJ and the UK Attaché.

Data portability – Articles 15 and 18

Article 18 on data portability has been deleted and merged with article 15. The ABI welcomes this change.

Despite disappointment with the insertion of a reference to ‘meaningful information about the logic involved in any automated processing’ in Article 15, the wording remains high level and mirrors current requirements in the 1995 Directive. This means the addition should not impose further obligations on data controllers and processors.   

The ABI will continue to lobby against Article 18 in Council, and ensure that in trilogues any reference to provisions from Article 18 are deleted (including provisions such as para 2(a) of Art 15 in the EP text).

Right to Erasure – Article 17

This Article has also been improved. The ABI welcomes this change in the title from the ‘right to be forgotten’ to the ‘right to erasure’ and the changes made to Recital 53.

The ABI hopes that, during trilogues, the following amendment made to Recital 53 will be clearly expressed in the text of the Article too: ‘the right of erasure should not apply when the retention of personal data is necessary for the performance of a contract with the data subject, or where there is a legal obligation to retain this data’.

Breach notifications – Article 31

MEPs have introduced greater proportionality to this Article. While Recital 67 still aims to define ‘undue delay’ as 72 hours, the text of the Article has been improved by an outright deletion of specific time frames. Moreover, there is now a clear acknowledgement that ‘the information may if necessary be provided in phases’.

Next steps

As the EP now has a mandate to enter trilogues, all attention will now be focussed on Council. At the Council meeting on 24-25 October, the Data Protection Regulation will be high on the agenda.

The ABI will continue to keep members updated with developments.

Update:

Council is now under pressure to reach agreement in December. Should this agreement be reached, trilogues will begin.

It is likely that there will be significant political pressure to try to reach a final text quickly, in order to have it adopted by the EP Plenary in April 2014, ensuring the legislative process for this file is finalised before the EP elections. If this occurs the implementation is likely to be 2016/2017.


Last updated 01/07/2016