On Friday 10
October, the European Union justice ministers agreed on part of the data
protection regulation reform. This is great news for SMEs as the exemption for
businesses with fewer than 250 employees is in the text agreed on. As a result,
SMEs and microbusinesses will not have to appoint an independent data
protection officer or undertake privacy impact assessments.
On 13 October 2014,
ESBA spoke to the assistant of Sean Kelly MEP, Kevin Keary, to follow up on
these developments. He confirmed that they also received the update that the
exemption will stay in the regulation. However, there is no update yet as to
whether this exemption applies to all businesses or whether only to the
non-data-driven ones. Further details on the specifics may come out during the
course of the week or the latest when trilogue negotiations start again.