On Monday, March 2, I attended a reception in Brussels at which new European Data Protection Supervisor (EDPS) Giovanni Buttarelli and Assistant Supervisor Wojciech Wiewiórowski presented their strategic plan for the next five years. Entitled “The EDPS Strategy 2015-2019: Leading by Example,” the document represents a key moment in the work of the EU’s leading data protection regulator.
In the 11 years since Peter Hustinx originally established it, the EDPS has come to enjoy a worldwide reputation both for policy work and for its supervision of data protection in EU institutions. The fact that there is a “changing of the guard” in its leadership has led to great interest in the EDPS’ new strategic plan.
The plan’s importance in the context of EU policy-making is demonstrated by the fact that the reception was attended by First Vice-President of the European Commission Frans Timmermans, the most powerful member of the commission after President Jean-Claude Juncker, and Claude Moraes, chairman of the Committee on Civil Liberties, Justice and Home Affairs (the LIBE Committee) of the European Parliament.
It was not many years ago that data protection was viewed with a combination of disinterest and disdain at the highest levels of the EU. But this attitude has changed completely following developments such as the entry into force of the EU’s Lisbon Treaty, the Snowden revelations and the growth of the Internet. As Vice-President Timmermans said at the reception, data protection is something that “we could easily get wrong, but that we have to get right.”
The new EDPS strategy paper follows a vision “for the EU to lead by example as a beacon of respect for data protection and privacy and to speak with single, credible and informed voice on fundamental rights in the digital world” (p.16). It identifies three major strategic objectives (namely “data protection goes digital,“ “forging global partnerships,” and “opening a new chapter for EU data protection”) and 10 action items.
The agenda set out in the strategic plan is bold and interventionist. It builds on the strong support for data protection rights of the Hustinx era while putting particular focus on Internet-related issues, international cooperation and the conclusion and effective implementation of the EU’s proposed data protection reform.
The plan places particular emphasis on online issues. As Buttarelli states in the Foreword, “big data will need equally big data protection.” This will include having the EDPS “be an epicenter for creative ideas and innovative solutions, customizing existing data protection principles to fit the global digital arena.”
The new EDPS sees the data protection challenges of the next few years as global in scope, and plans to address them on an international scale. This will include working on the ethical dimension of data protection, ensuring that data protection is included in international agreements and seeing to it that the EU speaks with a single voice in international discussion of data protection issues.
The EDPS will be a more proactive partner in discussions to enact the EU’s proposed new data protection framework than it has been in the past. It wants the reform to “seek workable solutions that avoid red tape, remain flexible for technological innovation and cross-border data flows and enable individuals to enforce their rights more effectively on and offline.” It will work to ensure that EU institutions are fully accountable for their data protection practices and that a clear and comprehensive set of criteria are established that law enforcement and national security authorities must respect.
The EDPS’ new strategic plan reflects a bold vision that views the next five years both as presenting particular challenges for data protection and creating opportunities for a more robust and yet flexible EU data protection framework that can be a model for the world. All eyes will be on Brussels over the next few years to see how the EDPS realizes its ambitious goals.