The European Council of Ministers have now published a proposed text for the General Data Protection Regulation. This still needs to be edited by the Commission’s “lawyer-linguists” to check for inconsistencies, sort out the numbering of recitals and articles etc. But the working parties of both the Parliament and the Council have recommended that the resulting text should be adopted by the respective full bodies at meetings in the next couple of months.
Bloomberg have published an excellent summary of the differences between the existing Directive and the new Regulation.
Over the next few weeks I’ll be revisiting the four topics I considered when the European Commission first published its proposal back in 2012, looking specifically at the Regulation’s implications for some of the networked services provided by NRENs and their customers:
- Federated Access Management
- Breach Notification
- Incident Response
- Cloud Computing [awaiting the Article 29 Working Party’s review of export arrangements]
Links to those posts will be added here when they are published. Once the Regulation is passed, there will be a period of two years before it comes into force. During that time I hope regulators will be providing guidance to fill in some of the practical details. It seems likely that there will also be more activity on international transfers, following the Safe Harbor case, and on the e-Privacy Directive, which will be revised once the Regulation’s text is agreed. But there seems to be plenty in the current text to suggest how we may need to adapt our activities, and where we may already be ahead of the developments.
