On 4 December 2014, the EU Justice Ministers meeting in the Justice and Home Affairs Council reached a partial general approach on specific aspects of the draft Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), which the European Commission put forward in 2012 as part of a package meant to reform the current EU data protection regime (see Legal update, Personal data protection in the EU: European Commission adopts reform package and Personal Data Protection Reform Package: legislation tracker).

The partial general approach covers the question of the inclusion of the public sector in the scope of the General Data Protection Regulation (Article 1, Article 6, paragraphs (2) and (3), Article 21) as well as specific processing situations set out in Chapter IX, as well as the related recitals.

It also stipulates that the agreement was reached on the understanding that:

The Council also held a debate on the one stop shop mechanism on the basis of a proposal presented by the Presidency. A majority of ministers endorsed the general architecture of the proposal and the Presidency concluded that further technical work will need to be done in the coming months.

Ministers also concluded that the experts should explore methods for enhancing the "proximity" between individuals and the decision-making supervisory authority by involving the local supervisory authorities in the decision-making process. This follows an assessment made by the Council Legal Service at the end of 2013, that the model resulting from the technical work so far would confront data subjects with such a complicated system that it would be incompatible with the right to an effective remedy. The proposal put forward by the Council Presidency therefore tries to accommodate the concerns of the Council Legal Service and to enhance "proximity". It provides that the one stop shop mechanism should only intervene in important cross-border cases and will consist in a co-operation and joint-decision making between several data protection authorities concerned. The proposal states that the jointly agreed decision will be adopted by the data protection authority best placed to deliver the most effective protection from the perspective of the data subject. According to the Council, this means that, in practice, the local authority will adopt the decision in all cases where the complainant could be adversely affected by it, allowing him/her to have the decision of the data protection authority reviewed by his or her own court.

A first partial general approach was already agreed by the Council in June 2014, on the provisions on territorial scope, the respective definitions of "binding corporate rules" and "international organisations", and the transfer of personal data to third countries or international organisations.

The European Parliament adopted its position at first reading on the two proposals included in the Personal Data Protection Reform package in March 2014 (see Legal update, European Parliament vote approves draft data protection regulation).

Next steps: The two proposals under the Personal Data Protection Reform Package need to be adopted under the ordinary legislative procedure, which means both the Council and the European Parliament have to agree on the same final text. Under this procedure there is no time limit for the Council to adopt its position at first reading.

Sources: