Don’t bet on anything happening for at least a couple of years on U.K. adequacy post-Brexit, advised European Data Protection Supervisor Giovanni Buttarelli at the launch of his annual report in Brussels Feb. 26. During his briefing, the EDPS cast doubt on the future of the Privacy Shield agreement and called on the EU to continue to be an "ambassador" to the world on data protection.

Buttarelli hailed the fifth annual report of the EDPS as the first of a new era. “We are approaching the first anniversary of the [EU General Data Protection Regulation], but there is a little bit of unfinished work,” he said, not least on the ePrivacy Regulation.

“Data protection is increasingly horizontal,” he said, noting that it now goes hand-in-hand with free-trade agreements, most recently between the EU and Japan. Buttarelli said that future free-trade agreements will have a new generation of data protection provisions.

“Many of them are GDPR-like or GDPR-lite. The era of self-regulation is over,” he said. “[The] GDPR is in some ways extraterritorial. Today we are largely talking about the U.S., but after 2021 it may be China. This is why we act internationally to be a sort of European data protection ambassador,” he said.

He explained that the GDPR will not be reviewed for another seven to 10 years, then discussions will take at least three to five years, and implementation at least another two, so the GDPR will be around for roughly 20 years. That's a “century” in terms of technology, Buttarelli said.

Brexit

On the question of whether the U.K. would be first in line for a data adequacy decision after Brexit — assuming that happens as scheduled March 30, something few would bet on — he was guarded.

“Other countries are queuing,” he said, naming Mexico and South Korea in particular. “The adequacy finding requires a lot of work even if [the U.K. is] fully compliant with the GDPR. Because of certain judgments [on surveillance], I perceive it will take time.” EDPS Assistant Supervisor Wojciech Wiewiórowski was quick to add that the European Commission also has a lot of other work on its plate.

“By May 2020, the Commission is due to prepare its report on international data transfers, and the Commission must make full reassessments of the current adequacy agreements,” he said.

Meanwhile, whether the U.K. Information Commissioner’s Office would be granted “observer status” is “dependent on the big picture. But I put my money on nothing happening for a couple of years,” Buttarelli said.

Privacy Shield

“Privacy Shield is an instrument of the past,” Buttarelli told the European Parliament civil liberties committee at a session earlier in the day. At the briefing of the annual report, he said, “Let’s consider Privacy Shield an interim instrument. It was negotiated before the GDPR. But now the GDPR is applied to everyone working remotely in the EU providing goods and services. A company is subject to the full scope of the GDPR, not only when the data are transferred under Privacy Shield.”

Buttarelli said Privacy Shield has many improvements over its predecessor, Safe Harbor, “but it is not the one of my dreams. It is an acceptable legal instrument, if it is fully implemented. With the U.S. as a strategic partner, we need to work together. I can’t say the commercial part is against EU law, I can only recommend the U.S. administration to continue to work with us in a transparent way and reassure us.”

Regarding surveillance, he said that in some ways the Privacy Shield is one of the most transparent documents in the world: “There are annexes that explain how they spy on you.” In the U.S., this is legal, Buttarelli said, “but not exactly in conformity with our [EU] values.” He added that he was not hung up on the bureaucracy of the ombudsperson, so long as it acted independently, but said certain reassurances are still needed about “bulk collection.” The question is not whether the U.S. does bulk collection, he explained, but what is involved exactly: length of time, how targeted, disposal of data after the event.

ePrivacy and data retention

Finally, on the question of the ePrivacy Regulation, Buttarelli said he hoped that the current Romanian Presidency of the Council of the European Union would be able to get consensus on something before June, when its term ends.

However, to date, there is no final text, and Buttarelli warned that drafts of Article 11 would allow data retention in the case of a legitimate “public interest.” That extends beyond law enforcement, which he said he could at least live with as part of the discussion, “but I don’t believe this should be included in the ePrivacy [Regulation].”

He also took aim at his home country of Italy, where the law allows for data retention for up to six years.

“It’s a big mistake,” said Buttarelli, adding that there are many non-democratic countries in the world that don’t hold data for so long. “Six years is not sustainable. There are efforts by some member states to go back to the glory days where data retention was not subject to any time limit,” he said but added that, in his view, the German approach of weeks, not years, was the correct approach.