The European Parliament has approved new data protection legislation in the EU, bringing to an end four years of negotiations on reforming the data protection directive dating from 1995.
The General Data Protection Regulation introduces, among other things, a "right to be forgotten", where personal data no longer in use or relevant must be deleted, as well as the right to transfer personal data to a new service provider. Organisations will need to obtain a 'clear and affirmative consent' from individuals before processing their personal data, explain in clear language their privacy policies and inform people when their data has been hacked. National data protection regulators will also have more powers of enforcement, including the ability to issue fines of up to 4 percent of a company's global annual turnover.
The legislation passed by parliament also includes a Data Protection Directive governing the handling and transfer of personal data by law enforcement authorities, including across EU borders. EU states will have two years to transpose the new rules into their national laws, with certain opt-outs in the UK, Ireland and Denmark.
Source: http://www.telecompaper.com/news/eu-parliament-approves-data-protection-legislation--1138510