Changes to the Draft EU Data Protection Legislation

The European Parliament has made several amendments to the European Commission’s original General Data Protection Regulation. The principal change is that consent will not be needed to process data if that data is “pseudonymous” (i.e. data which cannot be linked to an individual – e.g. a phone number without a name) or for direct mailing.

In addition consent will not be required if the use of the personal data meets the data subject’s ‘reasonable expectations’ based on his or her relationship with the data controller.

The Regulation still has to pass through the Council of Ministers and it is not expected to come into force until 2017.