Even after its adoption, the EU Data Protection Regulation (the Regulation) will likely have a two year transitional period before it comes into force. It was originally envisaged that the Regulation would be adopted in 2014. However, following a meeting of the EU Justice and Home Affairs Council on 6 December 2013, this is uncertain, and an implementation (and consequently, enforcement) date in 2016 is also at risk of being significantly delayed.
The European Commission (the Commission) proposed the Regulation back in January 2012. EU data protection law is enacted through the ‘co-decision’ procedure. This means that the Commission proposes the legislation and the European Parliament (the Parliament) and the European Council (i.e. the Member State governments) (the Council) co-decide on its adoption, following a ‘trialogue’ between Commission, Council and Parliament. On this basis, following its proposal, the draft Regulation was sent to the Parliament and Council for consideration. A ‘compromise text’ of the Regulation was adopted by the Parliament in October 2013, meaning that the Parliament was ready to commence negotiations with the Council and the Commission. However, on 6 December 2013 the Council decided that it needed further time to consider the "one-stop-shop" mechanism, meaning that it was not ready to commence negotiations. The Council’s concerns with the "one-stop-shop" mechanism are the subject of a separate blog, which can be read here.
The Parliament’s first/single reading of the Regulation – the next substantive step in the legislative process – was originally hoped to take place in March 2014, i.e. before the European Parliament elections in May 2014. Holding the first reading would have set off legislative time limits making further significant delays (of more than six months) difficult. However, if the Council is still not ready to come to the table, it is difficult to see how a first reading could take place in March. Given that it took the Parliament the best part of two years to agree the ‘compromise text’, there are fears that a new parliament (comprising new members with new political agendas) may wish to re-open issues that were previously considered finalised subjecting the Regulation to further delay (and perhaps further substantive amendment).