According to a summary issued by the Commission, the justice ministers agreed to the following basic components of the data protection reform package:
- establishment of a single set of rules on data protection across the EU
- application of the rules to companies outside the EU that offer services within the EU
- development of a "one-stop shop" or single supervisory regulator for companies operating in multiple member states
- strengthening the so-called right to be forgotten, while recognizing it is not absolute
- fines for data protection violations of up to 2% of global annual turnover.
Critics of the Council's 200-page agreement cautioned that the devil was in the details, claiming that many of the dozens of amendments introduced by the ministers would significantly undermine the current level of protection. How these amendments will fare in the trilogue discussions, and whether a final agreement can be reached by December 31, 2015, remains to be seen.