The Government has accused the European Commission of wildly under-estimating the full cost to businesses of its proposed new data laws, while exaggerating the benefits of creating a single law to govern across the EU.
The criticism is included in a Ministry of Justice document containing a summary of responses it had received to its call for evidence on the Commission’s proposed data protection reforms.
The draft General Data Protection Regulation (119-page/589KB PDF) was published by the Commission in January, although ministers from the EU member states and the Commission have already begun revising its content.
Pledging to work to “try to better quantify the costs and benefits of the Commission’s proposals on the UK economy”, the MoJ said “this assessment of the impact will help to inform the UK’s negotiations with the EU and … it is our intention to publish our analysis” before the end of the year.
The MoJ said that it would try to negotiate major changes to the commission’s draft plans in order to make the proposed regime less burdensome for businesses.
It cited a number of example, including the proposal to force all companies with more than 250 staff to employ data protection officers. While the Commission has estimated that the cost of employing data protection to be €320m each year across the EU, the MoJ estimated that the cost to businesses in the UK alone could be £147m.
Meanwhile the plan to ensure that existing information firms hold complies with the new laws “would have a financial impact”. One respondent from the media industry estimated that it would cost £10m to £15m to comply with the “data minimisation principle”. Under the Commission’s draft proposals organisations processing personal data must make sure that information is “adequate, relevant, and limited to the minimum necessary in relation to the purposes for which they are processed”.
Under the proposals, organisations operating in the EU would also have to obtain explicit, freely given, specific and informed consent from individuals for processing personal data. Consent would not be able to be gleaned through silence or inactivity and must be obtained through a statement or “clear affirmative action” before it can be said to have been given.
Last week, the DMA hit back at calls for the EU to stand firm on new data laws, vowing to continue its fight against the legislation as many of the proposals carry an “unfair burden” on business.
Related stories
DMA strikes back at EU data chief
EU told to ‘stand firm’ on data laws
Savvy public know power of data
Industry pushes value of DM sector
New EU data laws ‘to cost millions’
