4: The EU will accelerate approval of its new privacy law.
The EU has passed every predicted deadline for wrapping up negotiations on its General Data Protection Regulation (GDPR). The European Council, European Parliament and European Commission are reconciling their final versions of the law, which some have said has been the most-lobbied piece of legislation in the EU’s 23-year-old history. In any foreseeable scenario, the final text will create new privacy protections for Europeans’ personal data and give DPAs an unprecedented fining capacity of up to 2% of a company’s global revenues for violating the law.
How does the ECJ decision affect the GDPR endgame? Two ways:
- Privacy hardliners emboldened. The court’s ruling has strengthened the hand of those taking the more restrictive positions of the remaining points of GDPR debate. This new momentum may be just what is needed to push through consensus on those topics.
- DPAs strengthened. Passage of the GDPR will give DPAs a way to change the public commentary from data transfers to the U.S. to implementing the new law. The GDPR’s passage will also give DPAs an opening to ask for more staff resources from their legislatures, which they will need to handle any wave of new citizen complaints.
5: The focus will shift to EU government surveillance.
Some enterprising U.S. law student in Europe will soon realize she can become famous doing the reverse of what the Austrian grad student did to the Safe Harbor. How? By starting a lawsuit in Europe against a European government alleging it is violating her rights through its surveillance using the same rationale laid out in the ECJ decision.
The irony of the ECJ decision is that European personal data stored in the U.S. is probably safer from U.S. surveillance than that same data stored in some European countries. The rationale of the ECJ ruling will be the privacy-rights chicken that comes home to roost.
As a result, Europe will either need to modify its own surveillance procedures — something its intelligence agencies will be reluctant to do during the escalation of conflict near its borders — or shift its attention away from its impasse with the U.S. and toward implementing its new GDPR.
The landmark privacy developments in Europe this fall arrive in an era of accelerating technological innovation. The cloud and mobile revolutions of recent years are yielding to the next big thing — the Internet of Things (IoT). The IoT promises to generate jobs and establish competitive advantage for its early adopters. The new ways of collecting, using and sharing personal data across the IoT, however, will stress the boundaries of the ECJ decision in the years to come.
Sign up for CIO Asia eNewsletters.