LONDON (Reuters) - Additional rules may be needed to monitor growth in Big Data, or collection of high volumes of information, which could pose security, privacy and accountability risks, European Union regulators said on Monday.

An internet cable is seen at a server room in this picture illustration taken in Warsaw January 24, 2012. REUTERS/Kacper Pempel

Entire business sectors are being reshaped by building on data analytics and Big Data has the capability to transform the way products and services are provided, Gabriel Bernardino, chairman of the European Insurance and Occupational Pensions Authority, said.

Regulators worry that some customers will be classed as “undesirable” as firms are able to undertake more detailed analysis on them, EU banking, insurance and markets regulators said in a joint statement.

They launched a public consultation on the benefits and risks of Big Data for consumers and financial firms to see if more “regulatory or supervisory” actions may be needed.

“For example, consumers seeking household insurance for properties located in areas exposed to high risks such as floods, earthquakes or crime may have to pay very high premiums or might not be offered an insurance coverage,” they said.

Firms could increase prices based on data showing that a customer was unlikely to switch services. There is also a need to ensure that firms have adequate protection against cyber attacks on the data they hold, the regulators said in the statement.

Data is pulled from mobile phones, the internet and other sources in a bid to get new insights on customer behavior and predict future events more accurately.

The data is then used to tailor products to customers, such as by monitoring how they drive, or to inform investment decisions.

Big Data currently comes under broader EU rules on data protection, competition and consumer protection, but there are no rules written specifically for the sector.

There is no comprehensive information on how many banks, insurers and other financial firms use Big Data or on the market share of the key users and owners of Big Data technologies.

Financial firms are increasingly appointing “chief data officers” as cooperation agreements between financial firms and data providers proliferate, the regulators said.

“Big Data may lead to better and more informed decisions, more efficient processes and more appropriate services.”

The three regulators said the availability of data is likely to exponentially increase in the future and they would publish during 2017 their decision regarding next steps. </s> On May 25, the EU Data Protection Directive 95/46/EC on the protection of personal data will be replaced by a General Data Protection Regulation (GDPR). The preparation of this move has been long in the making, but it was suddenly put in the limelight by the "Facebook affair," the discreet use of personal data of millions of Facebook users by consulting firm Cambridge Analytica without their consent.

Speaking to Sputnik, Rebecca Cousin, partner at London-based law firm Slaughter and May, said that the new regulation is designed to expand the scope of EU citizens' data protection to companies based to foreign-based companies and toughen the financial consequences of leaking data to third parties.

"The new regime has extraterritorial effect so it will apply to companies who do not have an EU base if they offer goods or services to individuals in the EU or if they monitor their behavior. This will bring many more entities within the scope of the EU data privacy regime and we are therefore seeing companies from around the world assessing the impact of the GDPR on them and what steps they need to take to comply," she said.

In terms of financial penalties, Cousin, who co-heads the Slaughter and May Data Protection and Privacy practice, explained that companies will not only face a manyfold hike in potential losses if they fail to protect their customers' data, but also a greater number lawsuits by individuals as an outfall of greater awareness in the wake of the Cambridge Analytica scandal and the EU response.

"In the new regulation, sanctions are increasing with fines having a maximum of 4% of worldwide annual turnover (or EUR 20 million if higher). To give a comparison, the maximum level of fines in the UK is currently £500,000. The size of the fine is, therefore, a much greater deterrent for internet giant firms such as Facebook or Google, albeit the reputational impact has always been a strong deterrent. It will continue to be important for many companies. The fines go to the regulators as opposed to individuals bringing claims for damages. I expect an increase in civil cases against companies for data issues in part due to the greater awareness of individuals’ rights and claims companies are starting to promote the ability to bring these type of claims," she said.

The first basic question is to wonder why a directive, a European law, approved by the European Parliament and then transposed by each country into its national legislation, must suddenly be replaced by a European regulation, immediately applicable to all.

The reason is to eliminate delays and time losses that result from each country deciding on data flow regulations autonomously, often slightly different from the original directive, with some oversight by the European Commission, according to legal industry experts.

"Of course, nowadays such data can easily be transferred outside the Union to countries which do not necessarily guarantee an equivalent level of protection. In order to prevent these data from being used contrary to European rules, the Directive specifically targets "cross-border flows" (ie transfers of personal data outside the European Union). The directive prohibits such flows to third countries that do not provide a level of protection which it qualifies as "adequate". The European Commission is responsible for deciding whether a country provides such a level of protection. If this is not the case, the Directive nevertheless allows a transfer subject to compliance with certain conditions, for example where the controller provides 'adequate guarantees'," Says Jean-Francois Bellis, from the Brussels law firm Van Bael & Bellis, told Sputnik.

Until 2013, the United States was considered as "safe" with no transfer problems. Europeans lived under the "Safe Harbour" agreement between Brussels and Washington.

READ MORE: Too Much Profit in ‘Monetizing Our Privacy' for Facebook to Fear Regulation

But then, on June 6, 2013, Edward Snowden, a computer specialist working for the CIA and the NSA, revealed the scale of the surveillance that the NSA was doing on US and foreign networks, including social media. Europeans were listened in by the CIA. This was a huge scandal at the time. Snowden, the whistle-blower, sought refuge in Hong Kong and then Russia, where he has obtained asylum until 2020.

How Ireland Comes Into Play

With regards to the specifics of Facebook's presence in Europe, which until recently used Ireland as a base for its tax and revenue operations, experts explained that data transfers out of Europe to the United States have yet to be determined by the Court of Justice of the European Union (CJEU), which has yet to make a ruling on a five-year-old legal case against Facebook. The proceedings were initiated in 2013 following a complaint lodged by Austrian lawyer Max Schrems with the Irish data protection authority.

"Why Ireland? Because Facebook Ireland shared the European data with Facebook Inc in the United States. According to Mr. Schrems, the surveillance program of the US national security agency, which Edward Snowden had just made public, was incompatible with European fundamental rights and, as a result, according to Schrems, Facebook had to suspend cross-border data to the United States to the extent that it could potentially be subject to massive surveillance by the NSA. This procedure gave rise to a preliminary question to the CJEU, which in 2016 annulled the EU-US Safe Harbor," Jean-Francois Bellis said.

Of course, the European Commission, the US government and the companies involved tried to find a solution to enable the data flows to continue across the Atlantic.

READ MORE: Debate US Style: NRA Official Calls for Killing Supporters of Gun Regulation

Following the cancellation of the Safe Harbor agreement, Facebook Ireland abandoned the so-called "adequacy" system for a system of "sufficient guarantees" and has entered into a contract with Facebook Inc. incorporating the "Standard Contractual Clauses" of the European Commission. These Standard Contractual Clauses were recognized by the European Commission as offering "sufficient guarantees" for cross-border flow.

The Court of Justice of the European Union should, therefore, provide answers to a number of questions that will determine whether the Model Contractual Clauses can still be used for transfers of personal data to the United States. The importance of this decision is considered as thousands of companies make use of such Standard Contractual Clauses.

"The Irish court has the ability to refer questions of European legislation to the ECJ where it needs a ruling on the law in order to be able to apply it to the facts of the case. The only certainty now is that it won’t be a quick process to get the ruling of the European Court of Justice," Rebecca Cousin from Slaughter and May said.

I could be another two years before the European court gives an answer and states whether Facebook and the other internet giants can export European data to the United States. Urgent issues can wait a little longer. </s> Technology companies such as Google, Microsoft and Facebook will be forced to hand over users’ data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the European Union yesterday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The EU executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

“Electronic evidence is increasingly important in criminal proceedings,” said European Commission Vice President Frans Timmermans.

“We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice.”

On the frontline of the ongoing investigation into claims that Cambridge Analytica may have illegally harvested Facebook data for political ends, former CA boss Alexander Nix has refused to appear for a second grilling by British lawmakers, the MPs’ scrutiny panel investigating him said yesterday.

The ex-CA chief executive was due to appear today before parliament’s culture, media and sport committee over the British political consultancy firm’s highly controversial work. They wanted to probe inconsistencies in the testimony he gave before the committee on February 27.

Digital borders are a growing global issue in an era where big firms operate so-called cloud networks of giant data centers, which means that an individual’s data can reside anywhere.

Technology companies have found themselves torn between protecting consumers’ privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that US judges could issue warrants for data held abroad while giving firms an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement. </s> The European Union’s digital privacy law, known as the General Data Protection Regulation (GDPR), officially went into effect today. But some websites in the U.S. have decided to block their services entirely rather than adhere to the new regulations. Dozens of American newspapers are currently blocked in Europe and web services like Instapaper have suspended operations in the European Union for the foreseeable future.

First reported by the BBC, news sites owned by media companies like Tronc and Lee Enterprises are now totally dark in European Union countries. Some of those sites include the Los Angeles Times, the New York Daily News, the St. Louis Dispatch, the Chicago Tribune, and the Orlando Sentinel. Gizmodo was able to confirm that the websites were being blocked in Europe by using a VPN service that routed internet traffic through various European countries.

Internet users who visit sites like the L.A. Times receive a notification like the one below, explaining:

Attempting to reach a site like the Arizona Daily Sun from Europe gives you this notice:

The reaction to the blocks in Europe has been mixed, with some people blaming the European Union for enacting a law that they see as too burdensome on companies, while others wondered what these newspapers were doing with everyone’s data that would put them in violation of the GDPR in the first place.

Instapaper, a service that allows you to store newspaper articles in its app, announced earlier this week that it would be ceasing operations in Europe but said that it would “restore access as soon as possible.”

The GDPR was legislation passed in April of 2016 to ensure that internet users had more control over how their information was being used. Companies face enormous fines if they’re not in compliance with the data protection rules that have been laid out, which include providing more information to consumers on how data is being collected on them, and forcing companies to delete old data that’s no longer being used. At its most drastic, the EU’s Information Commissioner’s Office (ICO) has the power to fine large companies up to 4 percent of the company’s global annual turnover after the second offense. For large companies like Google and Amazon that’s in the billions of dollars. Under the new rules, lengthy user license agreements also must be in plain language and easy to understand.

And it’s not just tech companies that must comply with the law. Every organization that handles data on EU citizens, including banks, airlines, and insurance companies, must be in compliance. Today was the deadline for all companies to be in compliance with GDPR, but surveys show that anywhere from 60 to 85 percent of companies say that they’re not ready to be compliant today. It’s unclear how EU regulators will react, but so far they’ve showed no signs of being lenient. The companies did have over two years since the law’s passage to get their acts together.

Mark Zuckerberg, currently embroiled in scandal over Facebook’s mishandling of private user information, told members of European Parliament on Tuesday that his company would be ready to comply with the GDPR by today. But we really won’t know until these companies face some kind of audit. Best of luck with that, EU. Judging from Zuck’s performance earlier this week, Facebook doesn’t care too much about transparency.

Update, 7:55am: NPR appears to be giving Europeans a choice of either still being tracked with cookies and other tracking technologies, or just viewing NPR online in plain text.

Here’s what it looks like when you visit NPR.org from the UK:

And here’s what the website looks like if you opt out: </s> Theresa May said the plans demonstrate that the age of self-regulation is over

New rules will see social media companies being legally required to protect users, with bosses potentially held personally liable if they do not comply.

The proposed measures form part of a government plan to make the UK one of the safest places in the world to be online.

Charities and campaigners have been calling for greater regulation, following concerns over the growth of violent content, encouraging suicide, disinformation and the exposure of children to cyber bullying and other inappropriate material.

Those two groups have welcomed the plans, although a trade body has warned they may be too broad in scope to be effective.

The proposals on online harms, drawn up by the Home Office and Department for Digital, Culture, Media and Sport, say a regulator will be appointed to ensure companies meet their responsibilities.

These will be laid out in a new mandatory duty of care, which will require firms to take more responsibility for the safety of users and be more proactive in tackling the harm caused on their platforms.

The regulator - either a new body or an existing one like OFCOM - will have the ability to hit companies with "substantial" fines, block access to their sites and "potentially impose liability on individual member of senior management".

Prime Minister Theresa May said the plans, contained in a government white paper which will now go out for a 12-week consultation, demonstrate that the age of self-regulation is over.

"The internet can be brilliant at connecting people across the world - but for too long these companies have not done enough to protect users, especially children and young people, from harmful content," she said.

"That is not good enough, and it is time to do things differently.

"We have listened to campaigners and parents, and are putting a legal duty of care on internet companies to keep people safe.

"Online companies must start taking responsibility for their platforms, and help restore public trust in this technology."

Home Secretary Sajid Javid said firms had a "moral duty" to protect the young people they "profit from".

"Despite our repeated calls to action, harmful and illegal content - including child abuse and terrorism - is still too readily available online," he said.

"That is why we are forcing these firms to clean up their act once and for all."

Children's charity NSPCC, which has campaigned for tough regulations, welcomed the proposals.

Chief executive Peter Wanless said they would mean the UK is a "world pioneer" in protecting children online.

Javed Khan, chief executive at Barnardo's, said they had "long called for new laws to protect children online, just as we do offline, so they can learn, play and communicate safely".

But Daniel Dyball, UK executive director at trade body the Internet Association, sounded a warning about the "extremely wide" scope of the proposals.

"The internet industry is committed to working together with government and civil society to ensure the UK is a safe place to be online," he said.

"But to do this, we need proposals that are targeted and practical to implement for platforms both big and small."

The proposals will cover any company that allows users to share or discover user-generated content or interact with each other online.

Ministers also want the regulator to be able to force social media companies to publish annual transparency reports on harmful content and how they are addressing it.

The likes of Facebook and Twitter already do this.

Responding to the proposals, Facebook's UK head of public policy Rebecca Stimson said: "We have responsibilities to keep people safe on our services and we share the government's commitment to tackling harmful content online.

"As Mark Zuckerberg [Facebook's founder] said last month, new regulations are needed so that we have a standardised approach across platforms, and private companies aren't making so many important decisions alone."

She added that although Facebook had trebled the number of staff tasked with identifying harmful material and continued to review its policies, "we know there is much more to do".

"New rules for the internet should protect society from harm while also supporting innovation, the digital economy and freedom of speech," she continued.

"These are complex issues to get right and we look forward to working with the government and Parliament to ensure new regulations are effective."

The government's final proposals will be published after the consultation has ended. </s> BRUSSELS : The EU’s flagship new data protection laws came into effect on Friday but hit an early hitch as several major US news websites were blocked to European users.

The Los Angeles Times and Chicago Tribune newspapers were among those inaccessible on the other side of the Atlantic following the entry into force of the General Data Protection Regulation (GDPR).

Separately Facebook and Google already face their first legal cases under the new law after an Austrian privacy campaigner accused them of effectively forcing users to give their consent to the use of their personal information.

The EU has billed the GDPR as the biggest shake-up of data privacy regulations since the birth of the web, saying it sets new standards in the wake of the recent Facebook data harvesting scandal.

But it has also been blamed for a flood of emails and messages in recent weeks as worried firms rush to request the explicit consent of users.

It led to the hashtag #HappyGDPRDay taking off on social media as people sarcastically celebrated the end of the deluge of spam.

Even though the rules were officially adopted two years ago, with a grace period until now to adapt to them, companies have been slow to act, resulting in a last-minute scramble this week.

Companies can be fined up to 20 million euros ($24 million) or four percent of annual global turnover for breaching the strict new data rules for the EU, a market of 500 million people.

Several firms experienced real-world problems over complying with the EU laws, with US newspapers owned by the Tronc group, formerly known as Tribune Publishing, saying that they were blocked to Europeans for now.

“Unfortunately, our website is currently unavailable in most European countries,” said the message carried by the LA Times, Chicago Tribune, New York Daily News, Baltimore Sun and Orlando Sentinel. “We are engaged on the issue and committed to looking at options that support our full range of digital offerings to the EU market. We continue to identify technical compliance solutions that will provide all readers with our award-winning journalism.”

Local US newspapers owned by Lee Enterprises, including the St. Louis Post Dispatch and Arizona Daily Sun, were also out of reach, explicitly blaming the GDPR.

The European Commission insisted that it was not responsible for the blackout of some US sites, saying it was “proud to set high data protection standards” for the bloc’s 500 million citizens.

“We have seen the press reports, but it is not for the Commission to comment on individual companies’ policies in terms of offering services in the EU,” a spokesman said in an emailed comment to AFP.

“We expect all companies to fully comply with the General Data Protection Regulation as of today. With the new rules in place, EU data protection authorities will watch over their correct application across the EU and ensure full compliance.”

Meanwhile campaigner Max Schrems said he had launched four court cases on Friday under the new law.

They target Google in France, picture-sharing site Instagram in Belgium, WhatsApp in Germany and Facebook in his native Austria.

The problem with all these sites, he said, is with the pop ups that have been appearing on them in recent weeks, asking users to agree to new terms of use, adding that this amounts to a system of “forced consent” from users.

A previous case brought by Schrems against Facebook triggered the collapse of a previous EU-US data sharing agreement.

Brussels says the new laws put Europeans “back in control” of their data.

“When it comes to personal data today, people are naked in an aquarium,” said EU Justice Commissioner Vera Jourova.

The law says individuals must explicitly grant permission for their data to be used. It also establishes their “right to know” who is processing their information and what it will be used for; and gives them the “right to be forgotten”.

Parents will decide for children until they reach the age of consent, which member states will set anywhere between 13 and 16 years old.

The case for the new rules has been boosted by the recent scandal over the harvesting of Facebook users’ data by Cambridge Analytica, a US-British political research firm, for the 2016 US presidential election.

Facebook chief Mark Zuckerberg said as he apologised to the European Parliament on Tuesday over the scandal that his firm will be “fully compliant” with the EU law. </s> A cluster of U.S. news websites has gone dark for readers in Europe as the EU’s new privacy laws went into effect on Friday. The ruleset, known as General Data Protection Regulation (GDPR), outlines a robust set of requirements that internet companies collecting any personal data on consumers must follow. The consequences are considerable enough that the American media company Tronc decided to block all European readers from its sites rather than risk the ramifications of its apparent noncompliance.

Tronc -owned sites affected by the EU blackout include the Los Angeles Times, The Chicago Tribune, The New York Daily News, The Orlando Sentinel and The Baltimore Sun. Some newspapers owned by Lee Enterprises also blocked European readers, including The St. Louis Post Dispatch and The Arizona Daily Star.

While Tronc deemed its European readership disposable, at least in the short-term, most major national U.S. outlets took a different approach, serving a cleaned-up version of their website or asking users for opt-in consent to use their data. NPR even pointed delighted users toward a plaintext version of their site.

While many of the regional papers that blinked offline for EU users predominantly serve U.S. markets, some are prominent enough to attract an international readership, prompting European users left out in the cold to openly criticize the approach.

Those criticisms are well-deserved. The privacy regulations that GDPR sets in place were first adopted in April 2016, meaning that companies had two years to form a compliance plan before the regulations actually went live today. </s> The European Parliament on Tuesday voted in favor of a controversial new law that will bring sweeping reforms to how copyrighted content posted online is governed. The legislation was adopted with 348 votes in favor and 274 against.

For proponents of digital rights, the decision comes as a huge blow after over a year of campaigning to uphold what they see as the integrity of the internet. Member of the European Parliament Julia Reda, one of the most vocal critics of the directive, said on Twitter that the vote signals a "dark day for internet freedom."

Years in the making, the EU Copyright Directive has been heavily debated and divisive among politicians, as well as a cause of concern for the tech industry. One part of the proposal in particular -- Article 13, which will govern the way copyrighted content is uploaded to the internet -- has many in the tech community throwing their hands up in despair.

Under the law, internet platforms will be liable for content that users upload, a burden that will fall heavily on some of the most popular online services.

"YouTube, Facebook and Google News are some of the internet household names that will be most directly affected by this legislation," the European Parliament said in a statement.

The effects of the law may be felt well beyond Europe's borders, given the global nature of the internet and the need for tech companies to come up with policies that can be broadly applied. That's what happened after the EU enacted the privacy-focused General Data Protection Regulation, or GDPR, in May 2018.

Critics said legislators had turned a deaf ear to a wide range of experts and to the general population.



"In a stunning rejection of the will [of] five million online petitioners, and over 100,000 protestors this weekend, the European Parliament has abandoned common-sense and the advice of academics, technologists, and UN human rights experts, and approved the Copyright in the Digital Single Market Directive in its entirety," said rights group the Electronic Frontier Foundation in a blog post.

Before the text can be adopted in European law, it must next be approved by the Council of the European Union. It's still possible that the directive may not be passed by the Council, but that would involve at least one key country changing its mind. A vote is expected to take place April 9.

After EU member states themselves accept the text of the directive, it will take effect after publication in the official journal and member states will have two years to implement it.

A second section of the directive, Article 11, says search engines and news aggregators will be charged to display snippets of news they're linking to (known as a link tax). That will be another source of frustration for tech companies.

Back in January, Google said it may have to pull its news service from Europe entirely if the directive passes in its current state. Screenshots captured by Search Engine Land showed how Google news results could appear in Europe if Google doesn't pay the tax. (Spoiler alert: They're just a bunch of empty boxes.) Google didn't immediately respond to a request for comment following the outcome of the vote.

The European Parliament says that the directive is meant to ensure that longstanding rights and obligations of copyright law also apply to the internet. Article 13 dictates that anyone sharing copyrighted content must get permission from rights owners -- or at least have made the best possible effort to get permission -- before doing so.

"This directive is an important step towards correcting a situation which has allowed a few companies to earn huge sums of money without properly remunerating the thousands of creatives and journalists whose work they depend on," Axel Voss, the European Parliament rapporteur, said in a statement.

In order to enforce this, internet platforms will likely have to use upload filters to evaluate anything they put online. Even the wealthiest online services such as Facebook and YouTube, which have spent years developing this technology, haven't been able to prove pre-moderation of content is a foolproof method for preventing content from surfacing online that shouldn't be there.

Ahead of the vote on Tuesday, EU Commissioner for the Digital Single Market Andrus Ansip pointed out that nothing in the text of the legislation stipulates the use of upload filters. But it's hard to imagine a way in which tech platforms and social networks could otherwise realistically comply with the rules.

But the copyright directive also stopped short of some of the restrictions many had feared. It will, for instance, allow uploading of material to noncommercial sites such as Wikipedia and to open-source platforms including GitHub. Startup platforms also will face light obligations than more established ones, which may soften the blow for those worried that only the biggest and wealthiest may be able to afford to comply with the legislation.

And the wacky, creative side of the internet got a reprieve.

"We listened to the concerns raised and chose to doubly guarantee the freedom of expression," Voss said. "The 'meme', the 'gif', the 'snippet' are now protected more than ever before." </s> Technology companies such as Google, Microsoft and Facebook will be forced to hand over users' data to European law enforcement officials even when it is stored on servers outside the bloc, under a law proposed by the EU on Tuesday.

The law would allow European prosecutors to force companies to turn over data such as emails, text messages and pictures stored online in another country, within 10 days or as little as six hours in urgent cases.

The European Union executive says the proposed law, which would apply to data stored inside and outside the bloc, is necessary because current legal procedures between countries to obtain such electronic evidence can drag on for months.

"Electronic evidence is increasingly important in criminal proceedings," said European Commission Vice-President Frans Timmermans.

"We cannot allow criminals and terrorists to exploit modern and electronic communication technologies to hide their criminal actions and evade justice."

Digital borders are a growing global issue in an era where big companies operate so-called cloud networks of giant data centres, which mean that an individual's data can reside anywhere.

Technology companies have found themselves torn between protecting consumers' privacy while cooperating with law enforcement. The political pressure has intensified after Islamist-inspired attacks across Europe in recent years.

The United States recently moved to address the same problem, passing a law making it clear that U.S. judges could issue warrants for data held abroad while giving companies an avenue to object if the request conflicts with foreign law.

Prosecutors and police will have to ask a judge to approve their request for electronic evidence where it concerns more sensitive data, such as the actual content of messages, emails, pictures and videos.

They will also be able to ask companies to ensure electronic evidence is not deleted while they prepare their so-called production order.

Fraught with complexity

The proposal will apply only in cases where crimes carry a minimum jail sentence of three years. In cases of cybercrime there will be no minimum penalty requirement.

Where companies find themselves in a conflict-of-law situation because the country where data is stored forbids them from handing it over to a foreign authority, they will be able to challenge the seizure request.

However, such extraterritorial rules are fraught with complexity, legal and privacy experts warn.

In the United States, for example, certain companies are prohibited from disclosing information to foreign governments, while in Europe consumers' data privacy is strictly protected and companies are restricted in how they can transfer data outside the bloc.

"The Commission is proposing dangerous shortcuts to allow national authorities to obtain people's data directly from companies, basically turning them into judicial authorities," said Maryant Fernandez Perez, senior policy adviser at campaign group European Digital Rights.

CCIA, a tech association that includes Google and Facebook, welcomed the proposal but said it only offered a limited mechanism for addressing the risk that companies find themselves torn between two conflicting national laws.

"We welcome today's proposals, which can help authorities obtain digital evidence more effectively and with more transparency and legal clarity," said Alexandre Roure, CCIA Europe's senior manager.

Ultimately, the Commission hopes to start talks with the United States on a deal to help law enforcement authorities to seize evidence held on each other's territories.

"We always think it's useful to have an EU-US coordinated approach instead of a French-US approach, a Belgian-US approach because that leads to fragmentation," a Commission official said.
Regulators in the European Union initiate a "public consultation" on Big Data looking at whether more regulation or supervision of the collection of high volumes of information on individuals is appropriate.