From Brussels: The New EU Data Protection Regulation - Will they Or Won't They? And If So, When?

Sometimes the most interesting things that emerge from conferences are whispered across the aisle just after a presentation or debated by attendees off-site over a glass or two of wine.

The big-ticket question at last week's IAPP Europe Data Protection Congress in Brussels wasn't on the agenda: Will members of the European Parliament and the European Council manage to bridge their differences and pass a new Data Protection Regulation amidst significant competing pressures from various stakeholders?

A new Regulation (to replace the 1995 Directive) was announced by the European Commission in January 2012. (Our summary of the Regulation can be found here). European legislators originally estimated that the new Regulation could be passed as soon as the middle of 2013 (to be followed by a two year implementation period). Jan Philipp Albrecht, a Member of the European Parliament and champion of the Regulation, conceded last week that the end of 2013 might be more realistic. However, none of the government speakers whose sessions I attended considered a scenario where the Regulation simply wasn't adopted for lack of sufficient consensus on its substance.

Some members of the audience, however, noted the deep fault lines that were evident between the views of various speakers on issues ranging from questions of power-sharing among national governments (specifically, the potential loss of power of certain "stricter" national data protection offices under the "one stop shop" system) to widely varying assessments of the practical and economic burden that the Regulation would place on businesses (will businesses flee Europe due to...