Web users to be given greater control of personal data

People will have easier access to the data held on them by companies, can have it removed from the web and not have it used to profile them for advertising and other purposes under an agreement reached by EU ministers.

It should be more difficult too for companies and individuals to use a person’s data to produce a profile of for instance their health, their performance at work, their economic situation, and their personal preferences.

Existing rules are years out of date and the proposed new law should allow people to better control what happens to their personal data but at the same time allow businesses to make the most of the opportunities offered by the internet by streamlining regulations.

However, getting this far has taken more than three years with countries deeply divided over what was needed. And they now have to get the European Parliament to agree the new rules over the coming months.

Countries were deeply divided between those who favour more stringent rules and those like Ireland with the headquarters of a large number of multinational social media and search engine companies like Google.

The aim is to create the same rules in every EU state which the commission says will save businesses around €2.3bn a year; ruling on complaints will be done at national level through regulators in each state.

The plus side is that anybody with a complaint will be able to make it in their own language to their own national regulator which will then take it up with the regulator of the country where the relevant company is based. Ireland’s regulator is expected to be among — if not — the busiest under the system as the country has so many internet companies headquartered that deal particularly with personal data, such as Facebook.

The Government objected to the fact that a regulator in any other state can demand a review of decisions which will be carried out by a board made up of all the national regulators. Data Protection Minister Dara Murphy said that he was reasonably happy with the outcome — especially as the appeals system will be reviewed in two years.

Ireland has been in the spotlight on the issue, with some countries accusing the country of being too much on the side of multinationals.

The authorities will have increased powers to enforce the rules and can fine companies up to €1m or up to 2% of their global annual turnover — which is less than demanded by some bodies.

For the first time companies will have to prove that their level of personal data protection is up to EU standards, even if the company is based outside the EU, once they are dealing with the data of EU citizens.