EU Data Protection Rules 'Deeply Concerning,' Say Ecommerce Firms

A survey of ecommerce firms has raised 'deep concerns' about new European data protection laws on the horizon which they believe could severely hamper industry growth.

The UK-based IMRG and EMOTA - the European Multichannel and Online Trade Association - said a cross-industry survey of 90 firms showed the new regulations are expected to burden ecommerce retailers, curb the way they market to new or existing shoppers and restrict the manner in which data is held.

Walter Devenuto, president at EMOTA which represents 3,500 ecommerce and distance selling firms in 15 countries, said: 'We fully support a EU-wide harmonization of privacy regulations, but we urge policy-makers in Brussels to find practical solutions, which will help the European digital economy grow and compete globally, creating jobs and choice for EU citizens.'

He added: 'Businesses across the EU, small and large, are very concerned about the new data protection rules and we need to reassure them that consumer and business interests will be effectively balanced, avoiding excessive constraints in direct marketing and unnecessary administrative burdens for companies.'

The IMRG-EMOTA release lists five main areas of concern in areas understood to be under scrutiny by EU officials, highlighted below:



a. Over 70 per cent of respondents in the survey said a data protection framework based on 'explicit and specific consent (as opposed to the current 'unambiguous consent') will hamper the affect of sellers to improve the consumer experience and offer services. It could, for example, impede first contact or restrict marketing (for example product suggestions based on recent purchases)  - possibly making them illegal.

b. Almost 80 per cent of respondents said third-party access to data for legitimate business interest as crucial - for example, marketing, delivery and payment processing.

c. 90 per cent of respondents think some of the proposals - such as hiring a data protection officer- will be too burdensome. The obligations need to be clarified and duplication avoided.

d. 70 per cent of respondents said rules around profiling could severely restrict the ability of ecommerce firms to target customers.

e. 75 per cent of respondents called for a limitation of consumers 'right to be forgotten' and limitation of customer's access to data on themselves. Customers should only have the right to access the type of data they have introduced to the system themselves - as currently enshrined in the 1995 Data Protection Directive.

A planned vote by the European Parliament Civil Liberties, Justice and Home Affairs Committee on the EU's Data Protection Directive originally scheduled for April has been delayed until October.

Lawyers at Pinsent Masons said the delay reflected the complexity of the legislation and the difficulty achieving agreement on the wording of a new General Data Protection Regulation proposed last year. The firm's data protection law specialist Kathryn Wynn told Out-Law.com that concerns over the new legislation may be premature if the legislation becomes mired in detail.

'It may be that it gets to the stage that it is no longer possible to progress negotiations over the current draft Regulation because of differences over the detail. The European Commission may have to go back to the drawing board to either frame a new outcomes-focused Regulation or Directive to achieve the reforms necessary," the expert added.