INSIGHT
Another year and another opportunity to dust off the crystal ball and speculate what 2023 may bring in the world of data privacy.
Every year brings new data privacy legislation and 2023 is unlikely to be any different (Argentina, Canada, India, …?). To the extent that new laws bring legislation up to date and continue the broad trend of aligning with the EU’s GDPR, these developments can bring clarity and simplification.
However, it looks like 2023 could also see its fair share of additional complexity and uncertainty.
In the US:
With the federal American Data Privacy and Protection Act (ADPPA) apparently stalled indefinitely amid Californian concerns that it might water down their existing privacy legislation, there is suddenly renewed enthusiasm for state privacy legislation with multiple states re-starting their efforts to join the 5 states (California, Colorado, Connecticut, Utah and Virginia) which have already passed their own data privacy laws. A growing array of similar but different state privacy laws seems likely to add to the already complex patchwork of US privacy legislation.
In the EU:
EU data protection authorities have put the hesitant approach to fines seen in the early days of the GDPR well and truly behind them with 40% of total EU fines coming in the last 6 months, a trend we can expect to continue through 2023.
While the understanding and enforcement of the GDPR has matured, a swathe of new legislation linked to the EU’s digital and data strategies is on its way. With the Digital Markets Act and Digital Services Acts already passed and the Artificial Intelligence Act, Data Act and Data Governance Act expected hot on their heels, digesting the implications of this new and complex legal landscape is set to be an interesting challenge for 2023.
Sadly, the long awaited and much anticipated e-Privacy Regulation to replace the EU’s aging e-Privacy Directive and help settle the “cookie wars” seems the one piece of the puzzle that is notable by its absence from the EU’s legislative plans for the moment.
EU-U.S. data transfers:
Announced by Joe Biden and Ursula von der Leyen with much fanfare in March 2023, the EU-U.S. Data Privacy Framework, intended to ease the transfer of personal data from the EU to the U.S., continues to make its steady if slow progress through the EU approval process.
With all the effort on both sides of the Atlantic that went into preparing the framework, it is hard to imagine that the EU won’t eventually approve an adequacy decision but it is equally hard to imagine that it won’t be challenged in the Court of Justice of the European Union (CJEU) by the Austrian lawyer Max Schrems as the two similar previous agreements were.
Whether the third challenge will be as successful as the previous two remains to be seen but, in the meantime, companies will have to live with the uncertainty and continue to invest time and effort in cumbersome contractual workarounds when exporting personal data from the EU to the US.
In the UK:
Yes, the UK’s data protection regime continues to be defined by the GDPR (albeit rebranded as the UK GDPR). And yes, the UK government is committed to reforming it into something better – still strong, still offering real privacy protection to individuals but more business friendly and less bureaucratic. However, with the changes in the UK government leadership in 2022, we are still no closer to understanding exactly what form this will take, when it will happen and whether the UK government will succeed in the balancing act of making real improvements without losing its status as a country considered adequate to receive data transfers from the EU.
The picture should become clearer during 2023 (assuming no further change in government) but whether the current uncertainty will be replaced by clarity or just additional complexity remains to be seen.
In the meantime, perhaps we should appreciate the (UK) GDPR and the certainty it brings. As the saying goes, better the devil you know…
