The new General Data Protection Regulation: Still a sound system for the protection of individuals?. Issue 2 (April 2016)

• Record Type: Journal Article
• Authors: de Hert, Paul; Papakonstantinou, Vagelis
• Is Part Of: Computer law & security review. Volume 32:Issue 2(2016)
• Page Start: 179
• Page End: 194
• Publication Date: 2016-04
• Subjects: EU General Data Protection Regulation -- Controller–processor relationship -- Internet of things -- Individual consent -- DPIAs -- The right to be forgotten -- Data portability -- Personal data breach notifications; Computers -- Law and legislation -- Periodicals; Computer security -- Law and legislation -- Periodicals; Electronic commerce -- Law and legislation -- Periodicals; Data protection -- Law and legislation -- Periodicals; Computer security -- Law and legislation; Computers -- Law and legislation; Data protection -- Law and legislation; Electronic commerce -- Law and legislation; Periodicals; 343.0999
• DOI: 10.1016/j.clsr.2016.02.006
• Languages: English
• ISSNs: 2212-473X

Abstract

Abstract: The five-year wait is finally over; a few days before expiration of 2015 the "trilogue" that had started a few months earlier between the Commission, the Council and the Parliament suddenly bore fruit and the EU data protection reform package has finally been concluded. As planned since the beginning of this effort a Regulation, the General Data Protection Regulation is going to replace the 1995 Directive and a Directive, the Police and Criminal Justice Data Protection Directive, the 2008 Data Protection Framework Decision. In this way a long process that started as early as in 2009, peaked in early 2012, and required another three years to pass through the Parliament's and the Council's scrutiny is finished. Whether this reform package and its end-result is cause to celebrate or to lament depends on the perspective, the interests and the expectations of the beholder. Four years ago we published an article in this journal under the title "The proposed data protection Regulation replacing Directive 95/46/EC: A sound system for the protection of individuals". This paper essentially constitutes a continuation of that article: now that the General Data Protection Regulation's final provisions are at hand it is possible to present differences with the first draft prepared by the Commission, to discuss the issues raised through its law-making passage over the past few years, and to attempt to assess the effectiveness of its final provisions in relation to their declared purposes.