Among other things, the proposed General Data Protection Regulation aims at substantially reducing fragmentation, administrative burden and cost and to provide clear rules, simplifying the legal environment. This article argues that considerable work is needed to achieve those goals and that the proposal fails to provide either substantial legal certainty or simplification, that it adds administrative burden while leaving ample risk of fragmentation. In particular, the proposal misses the opportunity of strengthening data protection while achieving substantial simplification through abolishing the controller/ processor distinction and allowing transfers with no reduction of the controller’s liability. Large parts of the proposal depend entirely on clarification through delegated acts issued by the Commission. Prospects for those being adopted look dire. Failing either delegated acts or substantial redrafting, those parts may become dead letter or worse. There is a highly problematic obligation to “demonstrate compliance” with the law. The proportionate alternative to a number of other obligations on controllers, such as to maintain various documentation, appoint data protection officers etc, is to include such obligations as possible behavioural sanctions in case of a proven breach of the law. The proposal also appears to raise issues regarding freedom of movement. The impact assessment largely fails to demonstrate a need and net benefit from the proposed additional obligations. It also appears to severely underestimate the costs of the proposals, partly due to what appears to be arithmetic errors. The proposal does interestingly and rudimentarily put a value on personal data, but the approach could be extended.
Contents
- Articles
-
Requires Authentication UnlicensedThe Proposed New EU General Data Protection RegulationLicensedSeptember 10, 2013
-
Requires Authentication UnlicensedEffective Methods for Cross Border IP Enforcement in the Technology, Media and Telecommunications SectorLicensedSeptember 10, 2013
-
Requires Authentication UnlicensedCase LawLicensedSeptember 10, 2013
-
Requires Authentication UnlicensedUpdatesLicensedSeptember 10, 2013
-
Requires Authentication UnlicensedAbout the AuthorsLicensedSeptember 10, 2013