The European Commission, led by Vice President Viviane Reding announced major changes to the EU’s 1995 Privacy Directive that include a “right to be forgotten” under which consumers will be able to delete their data if there are no legitimate uses for it and also provides for greater data portability for consumers moving from one online provider to another. The Commission is also moving forward with requiring express consent for data processing.
While the proposal streamlines some compliance obligations, the proposal has caused a stir with its requirement of 24 hour notice of any data breach and its penalty provisions of up to 2% of the global annual turnover of a company. If approved by the European Parliament, the new rules would go into effect in 2013.
In addition, Google has raised concerns about the right to be forgotten, explaining that giving people too much power to control information about them online would make privacy rights trump the right to free expression, he argues, and would turn third-party Web services like Google into de facto censors.