Towards a new data protection european legal system: the keys of the reform

Abstract

The European Commission has presented legislative initiatives aimed at reforming the European legal system for data protection: a draft General Data Protection Regulation and a draft Directive in the area of Police and Criminal Justice. These proposals represent a comprehensive European data protection legal system review because they support on the basis of a different standard-setting instrument versus the previous Directive 95/46 and addresses new issues which were not being satisfactorily resolved by current rules (for example, the impact of new technologies and the Internet). These initiatives are called to revolutionize the global European data protection framework and make a special impact in the Spanish legal system because of the direct and immediate application of European Regulation and providing new rights to citizens. This new European data protection regulation is marked by a clear trend towards European centralization as evidenced with the strengthening of the powers of the European Commission through the use of the delegated and implementing acts, with the laying down of a common system of penalties which strengthens the repressive policy, with the recognizing of new powers to current institutions and organizations as the European Data Protection Board and the Data Protection European Supervisor and with the forecast of new European procedures for cooperation and consistency to ensure mutual assistance, joint investigations and, ultimately, effective European harmonisation. In addition, this new European framework seeks to address the technological revolution of our time giving more protection to the rights of citizens —in particular, minors— through information and transparency, new rights as to be forgotten and portability and new procedural and jurisdictional rules. Finally, the new legislation seeks to enhance an effective preventive strategy that takes into account the privacy by design and by default, through impact assessments, with the existence of data protection officers and, related to international transfers, legally recognizing the value of binding corporate rules.