By Jedidiah Bracy, CIPP/US, CIPP/E

A new chapter in the long and winding history of the proposed EU data protection regulation was opened late last week with the release of a draft compromise text by the Council of the European Union’s Justice and Home Affairs. According to Hunton & Williams’ Privacy and Information Security Law Blog, the text narrows the scope of the regulation and “seeks to move from a detailed, prescriptive approach toward a risk-based framework.” (We recommend reading the H&W blog entry for details on the regulation’s status and European legislative process.)

With the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (LIBE) currently considering more than 3,000 amendments to the proposed regulation—causing it to postpone its orientation vote—and negotiations still necessary between the European Parliament and the Council of the European Union (CoE), the Irish presidency has issued this compromise draft for the CoE to consider, representing its first textual contribution to the process. The presidency’s draft only covers Chapters I to IV of the proposed regulation and emphasizes that no part of the regulation can be finalized until the entire text of the proposed regulation is determined. The draft also outlines a more relaxed data breach notification regime—moving notification from within 24 to 72 hours of an incident, and creating a harm threshold to only significant breaches resulting in “severe material or moral harm.”

“Overall,” the Hunton & Williams’ post states, “the presidency’s draft compromise text can be seen as a more business-focused, pragmatic approach.”

Wilson Sonsini Senior Of Counsel Christopher Kuner told The Privacy Advisor that this release “is an important step in the legislative process, but one should keep it in perspective. For instance, it only covers Chapters I-IV of the proposed regulation, and some member states have included important reservations to it.”

Privacy advocate Simon Davies called the deal a “killer blow to privacy reforms” on his blog. “The proposals are almost precisely in line with those suggested by industry lobbyists over the past few months,” he wrote, adding, they “have dangerously wounded prospects that the new regulation will strengthen European privacy.”

For Davies, moving toward a more risk-based approach means “data controllers can decide for themselves what constitutes a risk and merely show that they have taken some steps to mitigate that risk.” He also warns that the presidency’s all-or-nothing approach will allow a “widespread veto by governments to sabotage the entire regulation unless they get what they want.”

The compromise draft also lays out a provision that would permit direct marketing to be a legitimate interest by default for processing data. Davies called this an “extraordinary result for corporate lobbying,” but not everyone agrees.

Marty Abrams, president of Hunton & Williams’ Centre for Information Policy Leadership, told The Privacy Advisor that this is not a new development. “Vice President Viviane Reding has said the proposed regulation would continue this practice,” he notes, adding, “legitimate business interests as a legal basis to process requires a balancing against fundamental rights. What has been missing is a framework for that risk assessment. With that risk assessment, the protection for individuals is enhanced, not weakened.”

Kuner also said he doesn’t think the compromise draft will weaken “European data protection per se, it depends on how risk-based approaches would be implemented. The status of data protection as a fundamental right in the EU does make evaluating the risks posed by particular types of processing more difficult. On the other hand, many DPAs have said openly that a risk-based approach is the way they approach enforcement anyway, so in that sense it would just bring the law closer to the way the law is applied and enforced in practice.”

So what does this ultimately mean for the future of the regulation?

So far, it’s tough to tell. The Irish presidency has made passing the regulation a priority during its tenure, but that wraps up in July, and the European Parliament is about to go on summer break.

The compromise draft could make passing the regulation more difficult, Kuner said. “A risk-based approach is different than the approach taken by the original European Commission proposal,” he notes, “and in many amendments being considered by the European Parliament.”

Kuner added, “I think the next month or so will be critical to see if the regulation will ultimately be adopted or not.”

Read more by Jedidiah Bracy: 
Medine’s Confirmation Moves PCLOB Forward; Questions Remain About Cybersecurity Authority
A Look at the Privacy Consultants of Acxiom
ICO Fine “Confirms” Emergence of Private-Sector Enforcement Trend
Broad Spectrum Voicing Opinions on Proposed Data Protection Framework