European Union Justice Commissioner Viviane Reding has confirmed that we can expect to see a draft of the eagerly awaited new Data Privacy Directive in January.

The new rules are likely to significantly strengthen the rights of individuals. According to a press release issued jointly last week by Reding and Germany’s Federal Minister for Consumer Protection, Isle Aigner, “consumers in Europe should see their data strongly protected, regardless of the EU country they live in and regardless of the country in which companies, which process their personal data, are established.”

The press release sets out three key changes to the current rules. The first is that the new laws will apply to any online business that directs its services at EU consumers, irrespective of where the business or data is located. While that is fine in theory, and is aligned to the approach at least some other consumer protection laws take, it will only be effective if the laws can be enforced against overseas entities.

The second is that EU law should require the explicit consent of consumers before their data is processed. Does this mean the end of the legitimate interests exception, which enables non-sensitive personal data to be processed if it is in the legitimate interests of the data controller… provided that those interests are not overridden by the rights and interests of the data subject? A move to explicit consent for all processing is not likely to be welcomed by industry nor improve a consumer’s online experience, with frequent requests for consent interrupting browsing activity.

Finally, it looks like the widely discussed “right to be forgotten” will be enacted in some form, as the press release states that consumers should generally have the right to delete any personal data at any time, especially data they post on the internet themselves. Whether this is technically achievable will depend on the scope of the actual provisions; this has been discussed in this earlier blog post and by others.

The ball still is very much in play, but based on this glimpse of the new regime, we can expect a significant response by industry as they grapple with the real impact to online business if they have to address these three issues.