We recently reported on the excitement surrounding the breakthrough vote by European Parliament on 21 October which put the delayed overhaul of European data protection rules back on track.

Following this landmark vote, Peter Hustinx, European Data Protection Supervisor, issued a press release, stating, “It is essential that the European Union acts quickly so that political agreement is reached before the European Parliament Elections. We look to the Council to maintain the momentum with equal vigour and purpose.” Peter Schaar, the German Federal Commissioner for Data Protection and Freedom of Information, similarly commented in a press release, “I hope that the governments of the 28 EU Member States represented in the Council conceive this as an opportunity to decide rapidly the reform of data protection…. [T]he success of the reform should be a top priority!”

However, section 8 of the European Council Conclusions of 24/25 October has indicated that the impetus for reform has yet again been halted in its tracks, with the anticipated date for adoption of the EU General Data Protection Framework pushed back from Spring 2014 to 2015.

Despite this delay, commentators including UK Prime Minister David Cameron, have indicated that ‘more haste less speed’ is the best approach to take. This is in light of dangerous loopholes exposed in the Regulation that could render it ineffective if adopted in its current form. Concerns focus on:

  • Vague definitions, such as ‘pseudonymous data’ and ‘legitimate interest’, that could allow companies to exonerate themselves from compliance with legislation
  • Extended circumstances where organisations could process data unrestricted without obtaining consent
  • Soft-touch approach to rules surrounding data profiling and corporate tracking
  • Anti-data transfer clause set to eliminate U.S. Safe Harbor, preventing U.S.-based companies from indiscriminately passing on the personal details of EU citizens to U.S. law enforcement and intelligence agencies, and significantly restricting EU-U.S. data transfer

Controversially plenary debate and vote on the legislative package has been bypassed in favour of secrete tripartite negotiations, conducted between the European Commission, the European Parliament and the Council of Ministers behind closed doors. While avoiding public commentary and criticism may speed up the legislative process, commentators such as Miriam Artino of Quadrature du Net have described this tactic as “obscure hijacking of the democratic debate,” adding “the regrettable choice to enter into secrete tripartite negotiation could significantly weaken the Regulation.” The absence of transparent debate raises alarms that much of the positive provisions of the Regulation achieved so far could be watered down even further in a hurried attempt to meet the promise of adopting the legislative package before the end the current legislature.