New EU data protection rules must be flexible...

a joint event at the European Parliament to discuss a European Commission-proposed regulation aimed at updating privacy laws for the digital age. It’s “essential” that the new measure strike the right balance between data protection and creating economic and social opportunities and benefits from technology and data, the trade associations said. The future rules should let responsible companies “unlock the potential of personal data to drive new digital services that consumers are demanding,” which will generate economic growth and jobs, they said. The draft regulation, which seeks to harmonize the 27 fragmented data protection regimes, could speed the digital single market for telecom services, giving Europeans better online experiences, they said. Moreover, a consistent data protection level will boost consumer trust and confidence while ensuring people’s private data are protected, they said. The objectives of safeguarding the right to privacy and business needs aren’t mutually exclusive, said ETNO Board Chairman Luigi Gambardella. ETNO welcomes the effort to reform data protection rules to make them more harmonized and consistent and to create a system that takes into account the “inherently global dimension of data processing,” he said. The organization believes all companies processing data of EU citizens should comply with EU rules, wherever their geographical location, he said. But ETNO also wants a risk-based approach used in the final version of the regulation, he said. It would tie obligations set on businesses to the nature of the data they handle and their reasons for processing it, keeping in mind the importance of not hampering digital innovation, he said. ETNO also believes responsible companies, which have always complied with privacy rules, shouldn’t be overburdened with rules, he said. A stronger risk-based approach could entail such measures as cutting administrative burdens on small and mid-sized companies, and allowing a bigger role for codes of conduct and certification mechanisms, he said. For example, the use of “pseudonymous data,” which is particularly helpful in research and online behavioral advertising, should be encouraged because there’s a lower risk of privacy violations, he said. However, giving data controllers the incentive to use such data should be balanced with fundamental rights protections and accountability, he said.