Mediaboss Marketing

When the European Union Data Protection Protection Directive was passed in 1995, the concepts of data, data privacy and storage, and the potential for misuse of that data were very different. The internet, furthermore, was still young and the Directive, in any case, was largely based on the UK's own Data Protection Act of 1984.

A lot, obviously, has changed since then. And the challenge of regulating data as those shifts have taken place - the growth of the internet, social media, cloud computing and big data, for example - has been compounded by the different ways in which the Data Protection Directive has been implemented across the 28 countries of the EU.

What is perhaps most notable about the EU's approach to data protection legislation today is that the changes it is proposing to make will not be made in the form of a new directive, but rather in the form of a "regulation", directly applicable to member states.

"A regulation is different from a directive because a directive is a set of principles that have to be translated into local laws. A regulation comes straight from Europe. Once it is passed at a European level, it is effective immediately in each country," says Andrew Dyson, a partner and specialist in data protection at law firm DLA Piper.

That approach is double-edged. On the one hand, it means that the EU will be legislating directly in terms of data protection Europe-wide - and presumably doing so more and more in this way in future - yet it will also prevent the complaint that directives, when translated into UK law, have been "gold plated" by over-zealous drafting.

The hope, adds Dyson, speaking at Computing's recent IT Leaders' Summit in London, is that it will provide organisations - particularly ones operating across the EU - with more certainty in terms of their pan-European IT infrastructures, cloud computing, and the way in which those organisations process data across the EU. "It's quite a significant change of tack and, I think, quite helpful," says Dyson.

Global ambitions

One of the positive aspects of the proposed regulations is that organisations operating across Europe will only need to deal with one regulator - not every information commissioner in every country in the EU that they operate. "The intention is that you will just go to your 'lead' regulator in your headquarters country and deal with them exclusively for the whole of Europe," says Dyson.

However, following the Edward Snowden revelations, he warns, the momentum is behind stricter controls that may impede developments in social media, given the personal information that is provided in exchange for the use of such applications, and big data.

All of this, though, is not just on a pan-European level. Taking a leaf out of US lawmakers' books, proposals currently under consideration are extra-territorial in scope. If an EU citizen orders something from a US website, for example, the personal data generated by that transaction does not currently come under the scope of EU data protection laws. But under the data protection regulations currently being considered, EU data protection laws would apply to citizens' personal data regardless of where in the world that data is being stored and/or processed, warns Dyson.

Read more from the original source:
Will the EU data protection regulations shoot down cloud social media and big data?