EU data law ‘runs contrary’ to AE

European regulation deman­ding explicit consent for data processing runs counter to the requirements of auto-enrolment, a lawyer warns.

The European Commission announced proposals last week to enhance data compliance protection throughout Europe which would require organisations to gain explicit consent for processing personal data – instead of assumed or inferred consent (PP Online 29 January ).

Allen & Overy senior professional support lawyer Helen Powell said the regulation conflicts directly with auto-enrolment, which requires employers and trustees to auto-enrol employees into a pension scheme without their consent.

She said: “The data protection regulation is saying you must have explicit consent so no form of implied consent would be valid – it must be a specific affirmative act or a signature on a piece of paper essentially.

“Auto-enrolment specifically says you can’t do that.”

Powell said employers will be covered by an exemption to the European Union regulation because they are complying with a legal obligation, but trustees face a “huge black hole”.

She said: “With auto-enrolment all the legal requirements fall on the employer not on the trustee, so if trustees can no longer be covered by any form of implied consent then what are trustees to do?”

She said the government needed to publish guidance or an exemption for trustees as soon as possible – with large employers already preparing for auto-enrolment’s introduction later this year.

The EU regulation will also give individuals the right to ask businesses to move their records to alternative service providers and companies who lose data will have to publicly report the breach to the information commissioner and could face a heavy fine of up to €1m (£830,000) or 2% of annual worldwide turnover.