Draft Data Protection Rules Spark Debate: Mandatory Localization and Parental Consent for Minors on Social Media

Brussels, October 26, 2023 – Proposed new data protection rules within the European Union are generating significant controversy, with mandatory data localization and strict parental consent requirements for minors using social media platforms at the heart of the debate. The draft, leaked earlier this week and currently under internal review by the European Commission, aims to strengthen the bloc's already robust General Data Protection Regulation (GDPR). However, critics argue the proposed measures could stifle innovation, hinder cross-border data flows, and impose impractical burdens on businesses.

The most contentious element is the proposed mandatory data localization. The draft suggests that all personal data collected from EU citizens must be stored within the EU's geographical boundaries. Proponents argue this would enhance data sovereignty and security, making it easier for authorities to enforce data protection laws and reducing the risk of data breaches involving data transferred outside the EU.

However, opponents warn that such a measure would significantly increase compliance costs for companies, potentially forcing smaller businesses out of the market. Furthermore, it could limit the efficiency of cloud computing services, which often rely on data centers located outside the EU for optimal performance and cost-effectiveness. Concerns have also been raised regarding the potential impact on data security, arguing that concentrating data within the EU might create a larger, more attractive target for cyberattacks.

Equally controversial are the proposals regarding minors' use of social media. The draft reportedly mandates explicit parental consent for any child under the age of 16 to create and use a social media account. This surpasses the current GDPR's age of consent, which varies across member states. While advocates claim this would better protect children's online privacy and safety, critics argue it is overly burdensome and difficult to enforce effectively. Questions remain about how platforms would verify parental consent and the potential impact on children's access to online education and social interaction.

The tech industry has already expressed significant concerns, with several major social media companies stating the proposals are unrealistic and potentially unlawful. They highlight the complexity of implementing such strict measures and the potential for legal challenges. The draft also faces opposition from some civil liberties groups who argue that mandatory data localization could hinder freedom of information and expression.

The European Commission has yet to officially release the draft, and the final version is expected to undergo significant revisions following internal discussions and consultations with stakeholders. The legislative process is likely to be lengthy and contentious, with the final rules potentially impacting the digital landscape in Europe for years to come. The coming months will be crucial in determining the balance between enhancing data protection and maintaining a competitive and innovative digital market within the EU.