EU privacy law will extend to US social networks, vows Commissioner

US-based social networks should apply EU law to EU citizens, EU Commissioner Viviane Reding has said. EU privacy laws should apply to citizens' data regardless of where or how it is hosted or processed, she said.

Outlining the basis of data protection law reform, which Reding said was her "top legislative priority", Reding said that 'protection regardless of data location' was one of the four principles on which reform of data protection law would be founded.

"It means that homogeneous privacy standards for European citizens should apply independently of the area of the world in which their data is being processed," she said in a speech to a Privacy Platform meeting in Brussels. "They should apply whatever the geographical location of the service provider and whatever technical means used to provide the service."

Reding said that any company which wanted EU citizens as users must abide by EU laws, even if they were based elsewhere or outsourced data processing to companies based elsewhere.

"There should be no exceptions for third countries' service providers controlling our citizens' data," said Reding. "Any company operating in the EU market or any online product that is targeted at EU consumers must comply with EU rules."

Reding said that the planned reforms of data protection law would give privacy watchdogs in EU countries the powers to take action against such companies.

"For example, a US-based social network company that has millions of active users in Europe needs to comply with EU rules," she said. "To enforce the EU law, national privacy watchdogs shall be endowed with powers to investigate and engage in legal proceedings against non-EU data controllers whose services target EU consumers."

Reding said that she would take other actions in relation to privacy watchdogs' enforcement powers. She said she would make sure that they were more consistent across national boundaries within the EU.

Privacy law expert Rosemary Jay of Pinsent Masons, the law firm behind OUT-LAW.COM, said that the European Commission's ambitions could be hard to turn into reality.

"Most countries would rather be able to protect their citizens through their national laws and get frustrated that with some of these services they can't," said Jay. "The Commission has clearly wanted to do this for quite a long time, and it is a policy most governments would want to adopt."

"But the question is how do they do it," she said. "It is all very well to announce it as policy but if you want to make that law you have to go to draft your law in such a way that it is effective in having this extra-territorial impact and that will be the challenge."

Reding said that the Commission would give greater enforcement powers to national regulators to make the change work.

"To be effective, data protection rights need to actually be enforced," she said. "To make this possible I want to reinforce the independence and harmonise the powers of national data protection authorities in our 27 Member States."

Jay said that current law focused on where the data processor was based, so that it would not apply to a processor based wholly outside of the European Union.

The European Commission is already taking action against the UK, claiming that the Data Protection Act does not implement EU law properly, and one of its concerns is that it does not give the UK's Information Commissioner sufficient power.