EU Data Supervisor Alarmed by Threats to Access Rights

Proposed new EU rules on data protection threatened public access to documents and freedom of expression. Data protection supervisor Peter Hustinx called for a "substantive provision" to safeguard these rights, while member states were reluctant to give more power to the Commission.

A balance of rights at risk

Privacy is a good thing, and so is the right of citizens to look over the authorities' shoulders. That difficult balance, along with freedom of expression, might be severely tilted by a new data protection regime, critics claimed. The proposed reform was launched by commissioner Viviane Reding in January and was at first received with enthusiasm by civil society and various NGOs. European Digital Rights (EDRi), for one, welcomed the proposal, and even the Pirate Party — usually a harsh critic of EU data legislation in the European Parliament — gave the initiative its preliminary blessing. But as the substantial proposal, 91 articles explained across 119 pages, was analysed, conflicts of interest surfaced and grew into a major dispute.

From directive to regulation

The reform would replace a directive — EU law to be implemented by member states — with a regulation, binding EU law for all once adopted. This one-size-fits-all approach aimed at creating a level marketplace for companies and equal treatment of citizens across the EU, so that exactly the same rules would apply to Italian and Finnish companies as to Romanian and British citizens. That premise was first received positively by commentators.

Two threats to access rights

But as Peter Hustinx, the European Data Protection Supervisor, pointed out, member states had widely diverging laws and practices in this area. While the EU had a right, laid down in the Lisbon Treaty, to harmonise data protection laws, that competence did not extend to harmonising national access laws. A one-size-fits-all data protection regime might therefore have two grave effects: member states might find their national access laws restricted by new data protection rules; and in the access rules for the EU institutions, then being renegotiated, considerations of data protection would gain heavier weight than the right of access. The Commission's own acknowledgement of such a clash is set out in a report on new data rules colliding with fundamental rights.

Hustinx's proposed safeguards

To counter these threats, Hustinx suggested that a "substantive provision" be written into the proposed regulation, stating that personal data held by public authorities may be disclosed where provided for by other laws and where necessary to reconcile data protection with the right of public access. He was also unhappy with the Commission's defence of freedom of expression in article 80, under which member states were to provide exemptions for journalistic, artistic or literary expression — good, but not good enough, in his view. He proposed two amendments: to drop the references to journalistic, artistic and literary purposes and refer only to the general freedom of expression, arguing that in today's media landscape every citizen can act as a public watchdog through a blog; and to ensure that freedom of expression and the protection of personal data were reconciled without either being impaired, by keeping the wording of the existing data directive, which allowed derogations only where necessary to reconcile both rights. The proposed regulation's wording was weaker.

Support across member states

Although Hustinx's critical remarks on access rules and freedom of expression were, in his words, quite well hidden in his 85-page opinion, they were well received in some member states. The Danish presidency greeted them as useful for the ongoing negotiations on new access rules. In Sweden, the Ministry of Justice warned the Swedish Parliament of a potential conflict between the proposed data regulation and the country's constitution, with its historical safeguards for the freedom of the press and the right of access to public documents. "We are of course very pleased with his opinion. Peter Hustinx is a man of great integrity and he has shown a vivid interest to protect openness," said David Törnberg of the constitutional section of the Ministry of Justice. "This is very much in line with our reasoning," said Elisabeth Wallin, a legal expert at the Swedish Data Inspection Board. The Constitutional Committee of the Swedish Parliament, the Riksdagen, found the choice of a regulation in breach of the principle of subsidiarity — that the EU should not legislate at a higher level than necessary — and recommended that Parliament send a reasoned opinion on the matter to the EU institutions.

Even though Sweden, and to a lesser extent Denmark, was regarded by some member states as a transparency fundamentalist, similar criticism of the proposed data regulation was raised around the EU. The French Senate adopted a reasoned opinion on 4 March stating that the proposal gave too much power to the Commission, and the German Bundestag was reported to be preparing similar statements.

A clear majority at the first negotiations

When civil servants from member states met for a first round of negotiations in Brussels on 8 March, the critics formed a majority over the chosen form of legislation. According to the official summary of discussions, a "significant number" of delegations stated they would have preferred a directive, while only "a few" supported the Commission's choice of a regulation. The discussion of the content stopped short after article 4, leaving 81 other articles uncommented so far. "These are complicated matters, with effects for almost all part of society. We've only seen the start of a long and an intense battle," a delegate commented afterwards.

Frequently asked questions