An important agreement on data protection law was reached in the European Parliament last night. The law places stricter requirements on organizations that process data from European citizens.

After a long parliamentary session of seven hours, the agreement was not announced until 11:47 p.m. via press release. European member states have agreed on a set of rules that the Data Act proposes to better protect the data of European citizens. The underlying goal is to take control of data away from companies and give it back to citizens.

In principle, the data law applies to all companies that collect and process data from customers, but the European Commission mainly focuses on Big Tech. The major espionage scandal unearthed by whistleblower Edward Snowden in 2013 sent Europe on the alert that American companies have too much leeway with European citizens’ data. The law gives citizens the opportunity to decide what a company can and cannot do with their data.

Free data transfers

Another interesting part of the legal text is that the data should be given more freedom of action. This is intended to counteract the principle of “vendor lock-in” with the Data Protection Act. Cloud providers like to make it difficult for their customers to switch providers. The release of the data requires a complex procedure and is often associated with data loss.

These free data transfers turned out to be one of the biggest stumbling blocks for companies in the IT industry. Siemens and SAP, among others, complained that business secrets could be disclosed simply by opening all the data, which could lead to considerable economic damage for the supplier. The text of the law provides a small concession, allowing companies to withhold data if they can objectively demonstrate that disclosure would be harmful.

Blooming data economy

Thierry Breton is pleased that Parliament has reached an agreement. The Internal Market Commissioner said on Twitter that is “a milestone in reshaping the digital space that will lead to a thriving data economy that is innovative and open by European standards”.

The goal is far from being reached. The Commission and Parliament must now formally pass the law, after which companies will be given a 20-month transition period to adapt. It will therefore be several years before the law actually comes into force. A first, important hurdle has been cleared.