EU data protection: “More exceptions than rules”

EU-wide data protection standards are the goal of the reform that the Council and Parliament in Brussels are currently working on. A total of 3,133 amendment motions were submitted to Parliament, and the fax at the submission office was reportedly overwhelmed by the flood. We will see how the data protection debate will play out over the next two months, because the LIBE commission will be meeting on April 24 and 25.

A trend that the motions seem to be showing is that the representatives are pushing for more exceptions than rules. "When all of the proposed exceptions are taken together, then there is practically nothing left of the law," the initiative europe-v-facebook.org wrote in a press release.

For example, the conservative negotiator Voss (CDU) suggests exempting all "small enterprises" from the law (AM678). This would mean that the law would only apply to 3.8 percent of all companies. "Why should customers have fewer rights from small companies? There is nothing like this in our legal system otherwise. No one would suggest having consumer protection laws only apply to major companies," said Max Schrems. He continued, "Imagine that you only got a guarantee on a product from Amazon, but not from a local retailer. That would be ridiculous."

"It would be harder to confront Facebook than it is now"
Schrems also criticized that some of the requested changes would make cases like that of the Viennese student against Facebook "more difficult than they are now." "Our experience has shown that major companies use every exception, ambiguity and latitude for judgment to make things difficult for users and government authorities," Schrems said. The most proposals to water down the data protection regulations came from conservatives and liberals, who want to lower the data protection level considerably, he said.

, the lobbying efforts of the US IT industry are another factor that swayed some representatives – as shown by the fact that many passages in the amendment submissions were copied straight from the lobbying papers.

An especially sensitive issue in terms of the exceptions can be found in Article 6. This covers cases in which data may be processed due to "legitimate interests" even without the permission of the individuals in question and without any legal or contractual basis. But these "legitimate interests" are not defined. While some want to define these cases exactly, there is a large group that wants to extend this exception even further. "You don`t have to be a genius to see the problems that this will bring. The industry will not need long to claim `legitimate interests` to obtain the IP addresses of users. The way that the proposed amendments are worded, my ISP can also forward my information upon request. The agitation surrounding ACTA was surreal in comparison."

Protests like against ACTA hoped for
Schrems hopes to see "public pressure and protests" like against the international trade agreement ACTA. "We recommend at least sending e-mails to your EU representative," Schrems said. Citizens can participate in data protection campaigns like wirwollendatenschutz.at and privacycampaign.eu. "Protecting personal information and the privacy of the people in Europe must be a top priority for our elected representatives, and the laws passed to this end must not be diluted or neutered by industrial lobbying," the organizers of wirwollendatenschutz.at said.