Greetings from Washington, DC!

This week, our IAPP Europe Data Protection Digest is led by Jennifer Baker, seasoned Brussels-based EU policy correspondent reporting on technology, politics and legislation, www.brusselsgeek.eu. She traveled this week here to the Global Privacy Summit as a speaker and had some thoughts on the event:

For my first trip to the Global Privacy Summit I was curious to find out what the view of Europe’s new data protection regime is from the other side of the Atlantic. I am used to IAPP members at European events obsessing over the GDPR, but wasn’t convinced I would hear the same on the other side of the pond.

With the panel on the GDPR packed out and standing room only for many EU sessions, it seems I need not have worried that our U.S. cousins are taking EU data protection reform lightly.

However, what struck me was a general misunderstanding of what the EU is. The question of why DPAs are criticizing the U.S. intelligence agencies, but not their own national agencies came up time and again and I heard both Isabelle Falque-Pierrotin, chairwoman of the Article 29 Working Party, and European Data Protection Supervisor Giovanni Buttarelli, try to explain the differences between EU competencies and national competencies.

I appreciate that this is not straightforward stuff. Many, probably even the vast majority of, EU citizens don’t understand the labyrinthine complexities of EU law-making. However I feel that the standard practice of comparing it to U.S. levels of government is holding back comprehension. It seems like a nice analogy, but U.S. states are simply not the same as EU member states. Luckily the IAPP audience is a smart, highly educated one, perfectly able to grasp different legal, cultural and enforcement systems, so, please, let’s stop trying to shoehorn the EU structure into a format it doesn’t fit.

For my own part, I was asked to clarify more than once the difference between a directive and a regulation, as well as what transposing into national law is all about. For some this may be “Europe 101,” but skipping the basics is a mistake. At the very least a refresher might reduce the head-scratching when Americans learn that the European Court of Human Rights is not an EU institution.

Speaking of courts, the Court of Justice of the European Union ruling on the Schrems case and the resulting Privacy Shield dominated much of the EU-related conversation. Despite what negotiators are telling us about cooperation, I heard much mistrust on both sides. No one in the panels I attended – apart from yours truly – actually used the word “hypocrisy,” but it was clear that many attendees feel the Court ruling and subsequent fallout may have been disingenuous. And they have a point: While not nearly on the same scale, European countries’ intelligence agencies do conduct similar surveillance. No one really disputes that.

It’s just, as Falque-Pierrotin pointed out, there’s not a lot DPAs can do about it. To that I would add: “Two wrongs don’t make a right.” During a press conference, Buttarelli urged “member states in the EU to consider how their own intelligence agencies affect human rights.”

Restoring trust and good relations is top of everyone’s agenda, but I fear that there is a longer way to go than some would admit. Chairwoman of the Federal Trade Commission Edith Ramirez and Falque-Pierrotin both acknowledged there had been suggestions that the EU was attempting to export its own data protection values at the expense of the U.S. position. But Falque-Pierrotin reiterated that the point was to protect citizens, not to make life difficult for American corporations. As the head of CNIL, which is currently pushing Google to extend the so-called right to be forgotten worldwide, she would know a thing or two about it.

The one thing that both EU and U.S. attendees seemed to agree on is that stability and consistency would be good. However, we may have to wait awhile. Although the members of the A29WP would not be drawn on the subject, everyone else speculated about what would be included in its opinion on the Privacy Shield due out next week. Dutch DPA Jacob Kohnstamm sounded a note of caution: “Democracy is a higher standard than certainty. It is not our primary role to worry about business.” So the uncertainty generated by the Schrems ruling seems unlikely to be wiped away any time soon.

All in all, I was glad to see the U.S. taking Europe seriously, but I left with as many questions as answers. I suspect that come the Data Protection Congress in Brussels in November we will still be talking about GDPR implementation and potentially another Schrems case challenging Privacy Shield.

Groundhog Day anyone?