After the final vote of the Council of the European Union earlier in November, the legislative process for the adoption of an EU Regulation on the free flow of non-personal data has finally come to an end.
Regulation (EU) no. 1807/2018 (Non-Personal Data Regulation or NPDR) will enter into force at the end of December 2018 and become directly applicable in the EU within six months after its publication in the Official Journal of the European Union.
This new piece of legislation aims to strengthen the principle of free circulation of non-personal data in the EU for the benefit of businesses and the public alike, with a view to foster the European data economy and the future Digital Single Market.
In other words, EU institutions are saying that everyone has the right to store and process data wherever they want in the EU, as long as such data is a non-personal nature and data protection rules are fully respected.
The new NPDR does not affect the current legal framework already established under the General Data Protection Regulation (GDPR) and the ePrivacy Directive. In fact, data protection levels are expected to remain completely unaffected by this new regulation coming into effect, so there will be likely no new regulatory obligations to comply with after the NPDR becomes fully applicable.
Why should non-personal data be regulated, do we really need a new regulation?
The goal of the NPDR is to advance the EU market for non-personal data and bring down all existing barriers to the free movement of such data across the EU. To do so, legislators deemed necessary to adopt a specific piece of legislation that could harmonize a generally unregulated sector into a consistent set of rules applicable at an EU level.
In fact, the NPDR was originally designed to set the basis for the promotion of the free flow of non-personal data as a fifth fundamental freedom of the EU, aside already existing ones concerning the free movement of persons, goods, services and capitals.
In particular, the NPDR has two main targets: data localization restrictions put in place by Member States' authorities and vendor lock-in practices in the private sector. Such targets are expected to be eliminated (or at least largely reduced) thanks to the provisions of the NPDR, with an overall beneficial effect to the public sector and the European economic ecosystem.
For instance, the new rules will ban data localization restrictions imposed at a national level on the storing or...