After years of preparing for and implementing the EU General Data Protection Regulation, policymakers in the region are far from finished with the broader regulation of the digital realm. Earlier this year, the European Commission announced its ambitious digital strategy and, over the course of 2021, it released a host of draft legislation to undergird what it calls the coming "digital decade." The intent of the strategy is to cultivate a healthy digital marketplace in the EU for personal and non-personal data alike.
The list isn't short. Brussels has been busy this fall. Proposed laws include the Digital Governance Act, Digital Services Act, Digital Markets Act and the Data Act. Other proposals include the draft AI regulation and Cybersecurity Act. And, of course, let's not forget about the ePrivacy Regulation, which was originally meant to go into force along with the GDPR back in 2018.
This complex digital framework will ultimately develop alongside the GDPR and affect the privacy profession in potentially novel ways. Yet, the landscape is still being shaped and much work lies ahead.
This was the subject of an early-morning session on the final day of the IAPP Data Protection Congress 2021 here in Brussels, Belgium. The European Commission's Christian D'Cunha, who has an extensive history in the data protection space, described the intent of the executive body's digital ambitions.
"The EU wants data to move freely in the EU market," D'Cunha explained, noting there are two main priorities: the "green transformation" and the "digital transformation."
The Data Act, for example, aims to create rights and responsibilities on how valuable forms of data are shared; to empower consumers to have more control of their data; to pave the "legitimate" way for public bodies to access data in special circumstances for the public interest; and create the ability for businesses to switch between cloud services.
The Data Governance Act would create a "common European data space" and "single market for data," where high quality data could be used to boost innovation, while respecting European values such as the fundamental human right to privacy.
Broadly speaking, the DGA, DMA and DA would facilitate trust in data transactions, create a level playing field for market powers, allow for the flow of data for the public good while ensuring fairness.
"The data strategy is really a game changer for all our businesses," said Mastercard EEA Data Protection Officer Helena Koning, CIPP/A, CIPM. She said the strategy will have a huge impact on how businesses ultimately engage with individuals. But, Koning cautioned that all these regulations could create "more requirements than freedoms."
"From my perspective," she said, "this is about business-to-business, business-to-government and government-to-business data sharing. There would be a whole ecosystem regulated in the governance and data acts."
Koning said in light of this strategy and its goals, it is important such an ecosystem build in incentives for companies to share their data. She also pointed out a potential risk for public-private partnerships. "All these rules means it becomes more complex," so it is important they implement rules that are consistent and harmonized.
Additionally, she asked if data sharing, particularly for B2G, would be mandatory and wondered who would pay for required data sharing.
From a regulatory perspective, European Data Protection Board Legal Officer Anna Lytra shared some of the supervisory authority's concerns, some of which were previously published in its joint opinion with the European Data Protection Supervisor regarding the DGA.
Lytra said there's a risk of inconsistency between the GDPR and DGA, for example, and some definitions are not aligned. What about the competence of supervisory authorities, she asked, while saying the processing of data should be under the GDPR. And who would impose sanctions under such a regime?
Though the EU digital strategy is yet to be finalized, what is clear is that privacy pros should pay attention to this space. The GDPR appears to be just the tip of the iceberg in the larger context of a digital marketplace in the EU. There's lots of work left, but surely this panoply of regulations will have an impact on data protection, cybersecurity and the flow of data across organizations, both public and private.
