As we have previously posted, on January 25, 2012, the European Commission proposed comprehensive measures to reform the European data protection framework.  Among other things, the proposal would impose restrictions on the processing of personal data relating to children; create a breach notification requirement in the EU; require organizations employing 250 or more persons to designate a data protection officer; and increase the sanctions for data protection violations to up to two percent of an organization’s worldwide revenue.  The proposal also would expand the scope of the European data protection framework to non-EU companies that either process data pertaining to individuals residing in the EU to whom they offer goods or services or whose activities serve to monitor the behavior of such individuals.

Earlier this month, Covington lawyers hosted a webinar to discuss significant proposed reforms to the European data protection framework that have been put forward by the European Commission.  We received a number of excellent questions from those participating in the webinar.  Please click below to read the answers that Covington lawyers provided to these questions.

If a company has U.S. operations that target EU residents, as well as EU-based entities, what is the best way to approach the requirement that non-EU based entities designate a representative in one of the Member States where they target data subjects?

Under the new framework, EU data controllers will be supervised by the data protection authority of the Member State where the controller’s “main establishment” is based.  Each EU operation would have to comply with the regulation, and the data protection authority of the Member State where the company’s main establishment — understood as where the main processing decisions are made — is located will serve as the lead authority.

The U.S. business, insofar as it acts independently and as a separate controller, would also be subject to the regulation and expected to appoint a representative in one of the Member States where it targets data subjects, unless it is established in a third country offering “adequate” protection, is Safe Harbor-certified, or can avail itself of one of several exceptions (i.e., less than 250 employees or only occasional offering of goods and services in the EU).  If we assume that the US business is required to appoint a representative, it could appoint an affiliate in the EU to serve in this capacity.  And, to avoid having multiple European data protection regulators with jurisdiction over the company, it would be a good strategy to appoint the affiliate that is positioned as the company’s main EU establishment.

What are the implications of the European Commission’s proposal for international transfers of clinical trial data?

In its current form, the regulation does not contain specific provisions relating to international transfers of clinical trial data.  The regulation will probably abolish some of the exceptions that pharmaceutical research companies tend to rely on today.  For example, today, in France, data transfers restrictions do not apply to key-coded clinical trial data.  Likewise, the Netherlands has adopted a fairly narrow interpretation of the concept of personal data that excludes key-coded data.  These exceptions probably will not survive under the current, proposed regulation. 

The new definition of “personal data” makes it clearer that coded trial data are personal data and thus subject to the transfer restrictions.  This is the price companies will have to pay for the increased harmonization.

At the same time, the proposal does contain some terms that will benefit pharmaceutical research companies.  This includes the handling of BCRs, the simplified use of standard contract clauses and the possibility that industry sectors — including potentially the research sector — could obtain an adequacy decision in its own right, perhaps on the basis of an industry code.

How will enforcement be funded?

The proposed regulation only provides that data protection authorities have to be adequately funded, but it does not say how this will be done.  Member States will have to decide on this.  To our knowledge, self-funding purely on the basis of fines is not very common in the EU.

Two years after final approval is a short period of time to implement potentially significant technical changes.  What is the likelihood that, ultimately, there will be longer transitional periods for the most onerous requirements?

While the transitional period in the proposal is very tentative, a two-year period is not uncommon.  We do not anticipate this being made any longer.  That said, the regulation anticipates the adoption of implementing rules by the European Commission.  These could take some time to prepare and the relevant rules themselves could come with transition periods as well.  So, for some of the more detailed rules that we are likely to see in the future, the timeframes are likely to be even longer.

Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.