As we have previously posted, on January 25, 2012, the European Commission proposed comprehensive measures to reform the European data protection framework.  Among other things, the proposal would impose restrictions on the processing of personal data relating to children; create a breach notification requirement in the EU; require organizations employing 250 or more persons to designate a data protection officer; and increase the sanctions for data protection violations to up to two percent of an organization’s worldwide revenue.  The proposal also would expand the scope of the European data protection framework to non-EU companies that either process data pertaining to individuals residing in the EU to whom they offer goods or services or whose activities serve to monitor the behavior of such individuals.

Earlier this month, Covington lawyers hosted a webinar to discuss significant proposed reforms to the European data protection framework that have been put forward by the European Commission.  We received a number of excellent questions from those participating in the webinar.  Please click below to read the answers that Covington lawyers provided to these questions.

If a company has U.S. operations that target EU residents, as well as EU-based entities, what is the best way to approach the requirement that non-EU based entities designate a representative in one of the Member States where they target data subjects?

Under the new framework, EU data controllers will be supervised by the data protection authority of the Member State where the controller’s “main establishment” is based.  Each EU operation would have to comply with the regulation, and the data protection authority of the Member State where the company’s main establishment — understood as where the main processing decisions are made — is located will serve as the lead authority.

The U.S. business, insofar as it acts independently and as a separate controller, would also be subject to the regulation and expected to appoint a representative in one of the Member States where it targets data subjects, unless it is established in a third country offering “adequate” protection, is Safe Harbor-certified, or can avail itself of one of several exceptions (i.e., less than 250 employees or only occasional offering of goods and services in the EU).  If we assume that the US business is required to appoint a representative, it could appoint an affiliate in the EU to serve in this capacity.  And, to avoid having multiple European data protection regulators with jurisdiction over the company, it would be a good strategy to appoint the affiliate that is positioned as the company’s main EU establishment.

What are the implications of the European Commission’s proposal for international transfers of clinical trial data?

In its current form, the regulation does not contain specific provisions relating to international transfers of clinical trial data.  The regulation will probably abolish some of the exceptions that pharmaceutical research companies tend to rely on today.  For example, today, in France, data transfers restrictions do not apply to key-coded clinical trial data.  Likewise, the Netherlands has adopted a fairly narrow interpretation of the concept of personal data that excludes key-coded data.  These exceptions probably will not survive under the current, proposed regulation. 

The new definition of “personal data” makes it clearer that coded trial data are personal data and thus subject to the transfer restrictions.  This is the price companies will have to pay for the increased harmonization.

At the same time, the proposal does contain some terms that will benefit pharmaceutical research companies.  This includes the handling of BCRs, the simplified use of standard contract clauses and the possibility that industry sectors — including potentially the research sector — could obtain an adequacy decision in its own right, perhaps on the basis of an industry code.

How will enforcement be funded?

The proposed regulation only provides that data protection authorities have to be adequately funded, but it does not say how this will be done.  Member States will have to decide on this.  To our knowledge, self-funding purely on the basis of fines is not very common in the EU.

Two years after final approval is a short period of time to implement potentially significant technical changes.  What is the likelihood that, ultimately, there will be longer transitional periods for the most onerous requirements?

While the transitional period in the proposal is very tentative, a two-year period is not uncommon.  We do not anticipate this being made any longer.  That said, the regulation anticipates the adoption of implementing rules by the European Commission.  These could take some time to prepare and the relevant rules themselves could come with transition periods as well.  So, for some of the more detailed rules that we are likely to see in the future, the timeframes are likely to be even longer.