Extract from Isabelle Roccia’s article “A view from Brussels: Is governance better served by legal uncertainty?”
This week made one thing stand out over the rest for me: 10 years into the EU General Data Protection Regulation, the privacy profession still needs to settle on the basics of the law.
Accounts vary, but there are between 80 and 100 European laws relevant to digital responsibility. For context, one comparative study of regulatory density found that chemical companies are subject to roughly 70 applicable laws, while automotive companies face more than 180. By comparison, digital responsibility could be considered to fall in the middle-to-lower range of the regulatory spectrum. “It could be worse,” as the saying goes.
By many accounts, the GDPR is a well-designed law and its principles, in theory, could be relatively future proof. Is the law perfect? Probably not, no law can claim to be. As heavily criticized as it was during its first years, a majority of practitioners today would agree it has solid foundations, from its risk-based approach to the controller/processor concepts.
