Sometimes the best way to make progress is to stay the course. That appears to be a shared line of thinking between the European Council and European Parliament as it relates to the position of European data protection supervisor.
The European Parliament Committee on Civil Liberties, Justice and Home Affairs chose acting EDPS Wojciech Wiewiórowski to take the role for a five-year term during an anonymous ballot ceremony Tuesday morning in Strasbourg, France. After the EU Council selected him as its preferred candidate last week, Wiewiórowski received 36 votes from MEPs Tuesday, while fellow candidates Yann Padova and Endre Szabó earned 26 and 3 votes each, respectively.
As mentioned, Wiewiórowski is no stranger to the EDPS office, having worked there the last five years. Much of that time was spent as assistant EDPS under head EDPS Giovanni Buttarelli before Buttarelli's untimely death in August.
Tuesday's vote came after Wiewiórowski, Padova and Szabó went before the LIBE Monday night in public hearings, which included committee questioning and a chance for candidates to state their cases for appointment.
Wiewiórowski appealed to the LIBE in his opening statement by explaining the consistent approach to his work for the EDPS, saying his values "are the same as five years ago," but he added that he has a "young-blood and young-youth approach to the problems of data protection and privacy." Wiewiórowski went on to further explain his experience, asserting his prior roles in private and public sectors, as well as in academia, have prepared him for being the next EDPS.
"It all gives me the situation in which I can technologically understand the challenges we have," Wiewiórowski said. "I know how the office operates, how the EU institutions operate and what is good versus what is bad in this."
Some of the LIBE's questions during the 45-minute session with Wiewiórowski focused on how he would tend to specific issues, including how he would address artificial intelligence, improve EU General Data Protection Regulation enforcement and approach balancing indiscriminate data retention. On AI, specifically, Wiewiórowski was asked how the GDPR and a potential ePrivacy Regulation would protect values when it comes to emerging technologies.
"[AI] is a big challenge for us and all data protection authorities, but we first of all, we have to understand what we mean by [AI] because it's a marketed notion," Wiewiórowski said. "We should first try to see what we have and what we can use. The GDPR is one of the legal acts that may cover a lot of requirements and expectations on the regulation of [AI], especially with data protection impact assessment done in the right way."
The LIBE Committee also grilled Wiewiórowski on how he might provide more clout to the EDPS, which often times has its orders and proposals "ignored" by the European Commission, according to LIBE members during questioning.
"We have to show the power of the EDPS with real enforcement and real implementation of the rules we have at the moment to show there's good reason ... for the empowerment by the council, Parliament and the commission," Wiewiórowski said. "I would put the stress on the very practical work of the institutions, including the EDPS, in data protection. I would also stress that we should go out, as EDPS, from the typical legal field of advice and also give technical and organizational advice. That's something which we are missing."
Some reactions to Wiewiórowski's selection, which awaits final approval from the Conference of Presidents before a formal appointment, fall in line with the perceived preference of the council and Parliament to have EDPS remain status quo.
"His experience on the job as assistant supervisor and acting supervisor has probably played a big role," former EDPS Peter Hustinx said. "On that basis, I would expect basic continuity, but the new office holder will also introduce some changes. He will no doubt be keen to promote a close cooperation with national colleagues, both in the European Data Protection Board and elsewhere, with a view to reaching greater consistency and more effective enforcement."
Hustinx expects Wiewiórowski to explore more emphasis on technological developments, as indicated in his answers to the LIBE's questions. Hustinx said adding "more technical expertise than already available in the staff" will be a possible consideration.
Hogan Lovells Partner Eduardo Ustaran, CIPP/E, said, "This appointment is not surprising, but it is still very good news for the privacy world. Going forward, we should expect more of that great combination of vision and pragmatism that has made the EDPS so globally influential."
Wilson Sonsini Goodrich & Rosati Senior Privacy Counsel Christopher Kuner believes Wiewiórowski's work as acting EDPS in recent months helped him earn the confidence of the council and Parliament.
"In his time at the EDPS, he has proven himself to be a strong regulator who has also been able to stabilize the office following the tragic death of Giovanni Buttarelli," Kuner said. "I would expect him to continue many of the initiatives that Buttarelli began, while also striking out in some new areas, as well."
Now, it's up to Wiewiórowski to show the watching world what that looks like.
