The draft data protection regulation – too soon to be forgotten?

Last week’s European Parliament elections have thrown a spanner into the works of the already troubled and delayed passing into law of the proposed new General Data Protection Regulation.  At present, the 28 member states have adopted variations of the existing Data Protection Directive (which was passed back in 1995 before the internet was widely used) with varying outcomes – and certainly with a less than level playing field.

The EU, wishing to standardise the law, has been negotiating within its various key decision-making institutions and with external, interested parties (governments, privacy lobbyists, ISPs and other information society service providers) for a couple of years.  Most recently, the Parliament voted through a revised draft of the Regulation, which the proponents of the new proposals called ‘irreversible’.  That draft contains certain key, and deeply controversial, measures such as fines of up to 5% of global turnover for the worst breaches.

Just a couple of weeks ago, the European Court of Justice ordered Google to respect the request of Spanish man, Mario Costeja González, to have its search results exclude links to news reports of his bankruptcy from some 15 years ago. This began the current and much-commented on ‘right to be forgotten’ debate, which has long been a controversial theme of the proposed Regulation.

So, what now?

With out-and-out Euro-sceptics from the left (in Greece) and right (in the UK, France and Denmark) sharing common cause with Eurosceptics in the mainstream parties of the centre-left and centre-right achieving greater representation in Parliament, just how ‘irreversible’ the status of the draft Regulation is, remains to be seen.

Whilst Mr González’s only concern was to prevent Google highlighting his bankruptcy when searching for him, the top European court has now determined that “as a general rule” the privacy rights of individuals should take priority over the rights of other internet users, unless that individual played a particular role in public life, when, presumably, they deserve less privacy. The clash between freedom of speech (as embodied in Article 10 of the Human Rights Convention) and Article 8 (the right to privacy) has been long-running, and seems, in the court, to be coming out in favour of privacy. Whether the new-look Parliament, Commission and Council will see a way to pass the Regulation into law, with or without the right to be forgotten, remains up in the air.  Indeed, since the election, even higher up in the air.