EU officials have finally agreed on the wording of the new General Data Protection Regulations (GDPR) following three years of negotiations and draft documents.
Although the changes, which aim to set some kind of data protection consistency around the whole of Europe, haven't been formally agreed upon yet, approval will be top of the EU Parliament's agenda when they meet later in the month.
At this point, it will get the go ahead to become law from 2018 in all 28 member states, replacing often misaligned laws around the continent.
Some of the most notable changes in the GDPR proposals include more rigorous regulations for getting consent to collect data, increasing the age of consent from 13 years to 16 years old, removing information from company servers when Right to Be Forgotten requests are granted, requiring companies to tell EU authorities if a data breach occurs within 72 hours of it happening and establishing a single national office where complaints about data protection can be made.
The regulations will also include provisions for fining companies up to four per cent of their global revenues if they do not comply, which supporters believe will motivate organisations to reassess their data protection policies.
"The most critical change brought about by the GDPR is that jurisdiction is not a physical or geographical barrier jurisdiction will be measured digitally, meaning that companies outside of the EU will be affected by these new regulations by virtue of collecting data that belongs to an EU citizen," attorney Joseph D. McClendon told the National Law Review.
"With fines for non-compliance being set at 4 per cent of a company's global revenue, the financial impact to companies like Google, Facebook, Apple, and Microsoft for non-compliance can potentially result in billions of dollars in fines alone."
