The General Data Protection Regulation
for some time now we have awaited the arrival of the General Data Protection Regulation (GDPR), and now the end is in sight.
In this article we outline the key events that will happen over the next six months, each of which are important milestones in the gradual bringing on of the GDPR into law.
Council Draft & Trilogue
ON the 15th and 16th June, the Council of the EU is due to reach an agreement on its preferred draft of the GDPR, thus formally kicking off the trilogue process between the Commission, Parliament and Council, over the next 6 months. This timeline was set down by the Parliament and it will be interesting to see if there is a commitment to meet it.
The Easy Wins
During July it is expected that the trilogue will agree some easy wins, where there is less difference. These areas are the territorial scope of the GDPR (Article 3), and international data transfers (Chapter V). There is one gotcha in this timeline, and it refers to the Parliament's introduction of a restriction on the disclosure of personal data following a request from a non-EU court et al. This is a very political hot potato and could cause difficulty.
The Core Issues
In September, after the summer break, the trilogue gets its teeth into the real core issues of the GDPR, namely:
- the data protection principles including processing and consent (Chapter II);
- individual rights, including the right to be forgotten and issues around profiling (Chapter III);
- the obligations on data controllers and processors (Chapter IV).
These three areas are hugely significant and will have the greatest affect on all stakeholders for years to come. What will be interesting to watch will be Parliament's take on the risk approach which the Council has proffered in its draft. Politically, if Parliament accepts this approach we will be well on our way to an end date, otherwise we will see this process drag on.
One Stop Shop
October will bring the trilogue to the One Stop Shop consideration, which has been of intense focus and interest to date and as initiated by the Commission, supported by Parliament and hotly debated by the Council. What is more, the Council's agreed position is a million miles away from the Commission's. However what is interesting is that there is consensus on the fines. A well known Dublin solicitor stated publicly, recently, that he believes when all is said and done that the overall legislation may not be a million miles from the 1995 position, except for a large increase in fines, related to a percentage of turnover. That alone will be very significant to companies everywhere.
At this point, likely towards the end of the year if all goes well to date, the focus will be on certain issues such as personal data and employment, research and exemptions. Following this we are in wrap up phase and preparing for sign-off and other operational considerations.