Companies based outside the European Union must abide by its data-protection rules, justice ministers have agreed, weeks after the bloc's top court told Google that citizens have the "right to be forgotten".
"Data-protection law will apply to non-European companies if they do business on our territory," EU Justice Commissioner Viviane Reding told reporters after the meeting in Luxembourg on Friday.
Ministers are haggling over the finishing touches to a planned overhaul of privacy rules drafted before last month's EU court ruling, which said Google must erase personal information where fundamental rights are harmed by the posting of information online when there's no public interest in it being available.
While the recent ruling "helps us" in confirming that companies must apply EU privacy rules, the courts shouldn't be the ones to make European law, Reding said.
The EU is seeking to increase the powers of data-protection watchdogs to impose fines for violations. Revelations of widespread US spying on EU citizens, including politicians such as German Chancellor Angela Merkel, have added to the clamour for privacy safeguards. Talks on the EU's new data- protection package "have clearly moved from dormant to dynamic" and should be finalised later this year, Reding said.
Ministers also agreed on Friday on terms for companies transferring data outside the EU. The EU and the US must still hash out a so-called safe harbor agreement to govern data transfers between companies in both places.
Reding said the last sticking point was on the terms of a national security exemption for transfers and the US had accepted EU demands on 12 other points.
"I want to make it very clear that an exemption is exceptional," Reding said.
Reding will hold talks with US Attorney General Eric Holder in Athens on June 25 and will ask the US to allow Europeans to sue in US courts over violations involving misuse of data, she said.
Technology companies are asking for changes to the Freedom of Information Act to improve privacy safeguards and such a reform would be an opportunity to give the "same possibility for judicial redress" to Europeans, she told reporters.
European ministers remain divided on aspects of the revamped EU law. France opposes a planned one-stop shop that would allow one regulator to take EU-wide decisions on privacy, the country's representative at the talks, Philippe Etienne said, according to an Internet broadcast of the meeting.
European privacy watchdogs said in a statement on Friday they will set up guidelines to help "develop a common approach on the implementation" of the right-to-be-forgotten ruling.
While they welcomed Google's move to develop a form to handle requests to remove information from search results, they said it's too soon to say "whether the form is entirely satisfactory."