There's a lot to keep up with on the European data protection scene these days between EU General Data Protection Regulation enforcement, ePrivacy Regulation proposals and a recent EU-U.S. Privacy Shield review. Lost in that shuffle is the fact that the role of European Data Protection Supervisor does not have a permanent successor to the late Giovanni Buttarelli.
That conundrum is set to be addressed in the coming weeks. The European Parliament has announced the European Commission submitted an official list of EDPS candidates to be interviewed by Parliament and the European Council Nov. 25. The list includes acting EDPS Wojciech Wiewiórowski, Baker McKenzie Partner and IAPP Country Leader for France Yann Padova, and Hungary National Authority of Data Protection and Freedom of Information Vice President Endre Szabó.
Each candidate will go through a public hearing with Parliament and a closed-door session with the council. The two entities will then compare notes before coming to a decision on or before Dec. 5 — the end of the mandate for the current EDPS regime, which includes Wiewiórowski, who was the assistant EDPS for nearly five years under Buttarelli.
A source in Brussels who had knowledge of the commission's final list before its official publication said they were "quite surprised" on the adoption of a final list.
"It means they're hurrying," the source said. "Everyone is aware that 5 Dec. is a meaningful day."
The source added that the timeline for officially hiring a candidate would be strung out only if the respective mandates of Parliament and the council do not “coincide” following their interviews, forcing further deliberations. If the opinions agree with one another, the source said that the two parties will draw up a draft decision to appoint the preferred candidate.
With time working against Parliament and the council, Hogan Lovells Partner Eduardo Ustaran, CIPP/E, was less surprised regarding the commission's swift movement into the appointment process.
"I think there's a desire for continuity," Ustaran said. "With whatever happens, I think everyone wants a seamless process as this change occurs."
It's unknown how many candidates applied for the position, but the source noted that there was the potential to have four candidates interviewed. United Nations Rapporteur on Privacy Joseph Cannataci was the fourth candidate before recently pulling out of consideration.
The remaining candidates each bring a wealth of experience in privacy and data protection.
Wiewiórowski's working knowledge of the EDPS role and its office gives him an obvious advantage. He spent the majority of his five-year term as assistant EDPS supporting Buttarelli's vision on privacy and data protection but has transitioned well into the office's lead role over the last two months.
Padova practices in Baker McKenzie's Information Technology Group and is head of its Data Protection Practice in Paris. Padova, France's country leader to the IAPP, also carries enforcement experience, having spent six years as the general secretary for the French data protection authority, the CNIL.
Szabó has spent the last six years in his position with the Hungarian DPA. Szabó also served a pair of three-year terms as the parliamentary commissioner for the DPA and had a brief stint working for the EDPS in between those terms.
"There's no single message among the group," Ustaran said. "The aim of whoever takes the role will still be to approach public policy in an influential way."
The Brussels source indicated the newly elected Parliament, taking part in its first EDPS election, may not have a sense for particular focuses they'd like to see the next EDPS take-up. However, Parliament's probing of candidates during interviews will be telling.
"You’ll see how Parliament weighs different factors within its questioning," the source said. "You’ll get a sense of what’s on their minds. And then if you see two bad or tough questions in a row, then that’s likely the end of a candidate."
Parliament and the council are likely to explore candidates' thoughts regarding a potential ePrivacy Regulation, but Ustaran expects candidates will also need to weigh in on their planned approach with emerging technologies.
"There's going to be more focus and policy perspective needed on new technologies," Ustaran said. "Facial recognition is the latest example. There are privacy implications there that the nominee is going to have to address and prompt meaningful debate on what's appropriate."
Photo by Hunters Race on Unsplash