A view from Brussels: Is governance better served by legal uncertainty?

This week made one thing stand out over the rest for me: 10 years into the EU General Data Protection Regulation, the privacy profession still needs to settle on the basics of the law.

Accounts vary, but there are between 80 and 100 European laws relevant to digital responsibility. For context, one comparative study of regulatory density found that chemical companies are subject to roughly 70 applicable laws, while automotive companies face more than 180. By comparison, digital responsibility could be considered to fall in the middle-to-lower range of the regulatory spectrum. "It could be worse," as the saying goes. 

By many accounts, the GDPR is a well-designed law and its principles, in theory, could be relatively future proof. Is the law perfect? Probably not, no law can claim to be. As heavily criticized as it was during its first years, a majority of practitioners today would agree it has solid foundations, from its risk-based approach to the controller/processor concepts. 

What was striking to me this week was seasoned data protection officers debating the very GDPR article that lays the foundation for their role. Ten years after its adoption, Article 39 still triggers debate about action verbs such as "to inform, advise and monitor compliance." 

It is more than just semantics and raises significant equity, accountability and responsibility questions. That resonated particularly true in discussing the articulation between DPO tasks and internal audit team's responsibilities during a Munich IAPP KnowledgeNet. A small group of attendees workshopped on these notions and the conflict of interest they encounter. 

Each had different interpretations of the GDPR, different internal structures in their organization. No two DPOs reached the same conclusions about tasks and responsibility allocation. 

The fluidity is undeniably there. The profession is still debating what the GDPR means for complex organizations — and for those less complex, too, for that matter. How fascinating when there is so much guidance, jurisprudence, regulatory decisions or professional shared experience to draw from. 

Is it a good or bad thing? The debate shouldn't be this Manichean, but it invites a reflection: can the privacy profession ever land on a commonly agreed interpretation of the GDPR? Should it even aim for that? 

Legal certainty is an ally for accountability and governance. It provides clarity and an authoritative voice. But what our profession is making clear is that governance needs to be adaptable within the boundaries of the law. It is increasingly compelling to organizations less because it meets the letter of the law, and more because it is effective and practical.

Perhaps the discomfort caused by the lack of legal certainty is the source of headaches and endless debates, but it might be the very thing that allows digital responsibility professionals to navigate a balancing act that is increasingly perilous.