As business continues to expand globally, the European Union is taking affirmative steps to enhance and consolidate its already strict privacy laws and regulations. Underthe EU Data Protection Directive 95/46/EC3 ("Directive 95/46’"), each EU Member State establishes, implements and enforces its own regulatory structure consistent with guidance provided in Directive 95/46. In November 2011, a draft version of proposed changes to Directive 95/46 was circulated within the Commission, and was leaked widely (the "Draft Version"). In late January 2012, the European Commission formally announced proposed revisions to Directive 95/46 that centralize rule making and enforcement activity, and imposes new administrative sanctions and fines. Any organization that conducts business in the EU, and/or removes personal data from the EU or among its Member States, should be aware of these important developments.

New EU Data Protection Framework

Intense negotiations by the European Commission over the last two years culminated on January 23, 2012 with the release of proposed revisions to Directive 95/46 (the "Proposed Regulation"). Supporters and critics alike agree that, in over 600 pages of detailed text, the European Commission is recommending radical steps including the following key points:

One Set of Consistent Rules. The Proposed Regulation would repeal the existing Directive 95/46, and replace it with a single set of regulations that specifically overrides national laws of the EU Member States. Policymaking power would be shifted awayfrom the Data Processing Authorities (“DPA”) of the EU Member States to the European Commission in Brussels. The Article 29 Working Party would cease to exist,and a European Data Protection Board (“EDPB”) would be established to help guide the Member States as they adjust to operating under one set of rules and one supervisory authority. There are also consistency rules designed to prevent the Member States from going back to diverging sets of rules. As an example, if a DPA takes an action that has an impact outside of its territory, the DPA will take a draft measure to the EDPB. The EDPB can render an opinion on it, and DPA would be urged to take their opinion into consideration. If the DPA ignores it, then it may be escalated up to the European Commission, which may suspend the measure...

Please see full alert below for more information.