The myths pertaining to the proposed General Data Protection Regulation

Abstract

Expectations and myths In all fields of law it is a common expectation that new rules are instigated in order to solve issues that the old rules could not solve. The legal situation is to be improved as it does not meet the demands of society satisfactorily. In a field such as data protection, in which the very generally framed rules have significant impact on almost all parts of society and where it is well-known that legal change is complex and challenging, this expectation must be taken particularly seriously. The fundamental right to the protection of personal data must be fulfilled in a way that is better than it was before. Against this background it is necessary to consider carefully to which extent the proposed General Data Protection Regulation (hereafter the Regulation) will actually change the law as it follows not only from the wording of the current Data Protection Directive 95/46 (hereafter the Directive) but also compared with the practice that has developed during the life span of the Directive. Many of the rules in the Directive are flexible and data protection law is in many respects not the same as it was in 1998 when the Directive came into force. It is even more important to consider whether data protection will be sufficiently adjusted to current data processing and be balanced in an acceptable way viewed from the divergent perspectives of data subjects, controllers, and society. The proposed Regulation may be seen as a combination of new rules, codifications of practice, and the status quo. Data protection is not completely new and quite a lot of the changes are not entirely unexpected. A fundamental question is whether data protection law is being adjusted in order to better match the current information technology or whether in the long run the only real and decisive novelty is that the law will be communicated through a regulation rather than a directive. In other words whether the legal policy battle primarily concerns how strong a player the EU should be in this field. Another way to phrase this question is whether