Deputy Information Commissioner David Smith has admitted he would not lay too much money on the EU ever passing the proposed new data legislation, conceding we will not get a clearer picture until early next year.
Speaking at Infosecurity Europe 2013 in London, Smith voiced concern that the regulations may never see the light of day, explaining that there are still several processes of negotiation and compromise before any new rules come into force.
The Parliament consists of MEPs, whereas the council is made up of representatives from the member states, with the Ministry of Justice representing the UK.
A consolidated proposal with agreement from the Parliament, the Council, and civil liberties group LIBE – the body that originally proposed the regulation – is expected by the end of June. But only then does Parliament, the Council and the Commission come together to thrash out the final version.
Smith said: “There are 3,000 amendments or so on the table at the moment as the regulation goes through the European Parliament. In the Parliament, a lot of amendments are driven by a desire for more protection, or improved civil liberties. Whereas the debate in the Council is more driven by member states’ concerns, so they want to ease back on prescription, and see looser rules for SMEs.
“There is no certainty that there’ll be an agreement at the end of this. I’ll put money on there being an agreement, but not a lot of money.”
Smith said it was important to note that the ICO does not think the EC’s proposed data protection framework is universally bad.
“We welcome better data protection, we welcome concepts such as greater accountability that requires companies to demonstrate they have effective protections in place,” he said.
“The EC has recognised that the original proposals are over-prescriptive and over-detailed in places,” he said. “These changes may not go as far as we would like, it will not be perfect, it is a compromise, but we will make it better.”
Earlier this week, an EU official denied there would be changes to how direct marketers process personal data, claiming “explicit consent” will not be required. However, some experts believe the threat of opt-in only has not gone away.
Sceptics blast EU consent claims
Industry hails EU ‘extra time’
EU data laws enter the ‘hot phase’
EU data law: ‘It’s the DMA wot won it’
Does anyone give a toss about DM?
MEPs pass 900 amendments to data laws
DM chiefs urged join war on EU laws
First victory in war on EU data laws
EU: Full steam ahead on new laws
Bosses ‘clueless on new EU laws’
EU data laws ‘just got a lot worse’
Germans seek tougher EU data laws
DMA rallies team for £47bn fight
New EU data laws ‘to cost millions’