News: The new General Data Protection Regulation from the EU, which found a compromise late December, and is expected be finally agreed upon in January 2016, has some good and some bad news.
Individuals have clear rights: for example you can demand erasure of all your information if you have left a service, or take away in an easily readable format the data you’ve given a business provider.
Children under 13 will need parent consent. Each country can decide if they want parent consent between 13-16 years.
The very broad and undefined ‘legitimate’ interest provision, including for third parties can still circumvent consent altogether.
Collective redress is only possible in countries where provisions for collective redress exist in national legislation.
There is a serious risk of dis-harmonisation, since there are many exceptions allowing Member States to pass their own laws, e.g. Article 21 allowing countries to introduce legal exceptions to this law based on a loosely defined “general public interest”.