Digital Omnibus draft: critical review of Council draft compromise

Some thoughts on the leaked EU Council draft compromise re the GDPR parts of the Digital Omnibus:
– This draft reads as a major lobbying win by data protection authorities and civil society. The EDPB would be given more power, the Commission no supervision, and a lot of the more business-friendly proposals would be removed or watered down.

– The EDPB’s powers might backfire. Being required to establish a list of DPIA scenarios without Commission review means that the EDPB’s own lists could be deemed challengeable, as they make a DPIA required or not. This isn’t mere guidance.

– Those guidelines on pseudonymisation of the EDPB? They would be “clarifying circumstances whether a natural person is identifiable and means reasonably likely to be used to identify a natural person” and “specifying means and criteria to determine whether data resulting from pseudonymisation may no longer constitute personal data for certain entities”. Which can be interesting, as it makes those guidelines potentially challengeable too: after all, if they leave uncertainty, they don’t do their job well; if they do but are restrictive, they have a direct impact on the legal situation as we know authorities will not deviate from them.

– On scientific research, Dr M.R. (Mark) Leiser and I have each written about the things the Commission’s proposal could help improve but that the EDPB/EDPS Opinion on the topic was bringing into question. The Council draft text states that “Scientific research activities should concur to public interest and well-being” – a very dangerous limitation as the “public interest” & well-being benefits of R&D are often only made plain years later. Sure, it’s a “should” and not “must”, but it creates a presumption that could end up harming R&D in Europe. I find it very shortsighted of the Council to have included that wording. More on this here: https://lnkd.in/e5Ex2HKc

– We will see what the final Council position is + the Parliament does, but if this is the basis for the adaptations for the GDPR I expect many issues to go before the Courts and ultimately the CJEU. This isn’t a win for simplification and better regulation, far from it. The Commission proposal had the merit of going in the right direction of pragmatism and legal certainty, and this is not that at all. More on that (and why the EDPB’s position on the notion of “personal data”, which has likely had an impact on the Council’s position, seems anything but pragmatic): https://lnkd.in/eY63EYwm

– Not changing *anything* on ePrivacy despite the big issues that this creates, notably regarding the issue of two sets of exceptions for different kinds of data (depending on whether personal data is involved or not), is a real disappointment. It’s like no one at the EU Council even bothered to think about the consequences of this change. More here on why I consider the ePrivacy changes to be very unfortunate: https://lnkd.in/edEdjNkj

[Thanks Ellen O’Regan!]