Anyone keeping up with the negotiations on the proposed EU General Data Protection Regulation (GDPR) is aware that the negotiations are gradually coming to their conclusion. And while much work remains to be done, some of the many questions that have surrounded the reform can already be answered. Yes, the chosen form of legal act will be a regulation. Yes, the fines for non-compliance will be substantial. And yes, new and somewhat abstract concepts like privacy by design and by default will be made into legal obligations.

But what may not be known to all readers of this blog is that some very basic elements of the coming regulation could have been different.

In the early days…

Even before the European Commission's original proposal for the regulation was tabled in January 2012, stakeholders were working to garner support for a different approach to European data protection law than that represented by the 95/46 Directive. This work was both hindered and energize by the tabling—two years behind schedule—of the Commission's proposal. And as we can now finally determine, these forces were—alas—not powerful enough nor well enough prepared to offer an effective alternative to the model proposed by the Commission and broadly supported within data protection circles in Bruxelles and beyond.

What did this alternative approach entail? Well, because a cohesive and complete approach was never formulated this is difficult to explain in detail. But the overall intentions were clear.

Less "legality" and more reality

On a fundamental point the desire was to move beyond the existing, rigid model. The model has no formal name but may best be termed as the "legality" model or, to be more accurate, the "everything-is-forbidden-unless-it-is-allowed" model.

The European approach to data protection is based on the premise that any processing of personal data—from the benign to the harmful—requires a legal basis, a so-called "processing basis.” The basic idea behind this model is that any processing of personal data is an interference with the basic human right to data protection. Whether this approach has merit in the day-to-day life of European citizens is another matter entirely

And while this approach may have made sense in 1990, when the draft for what became the EU Data Protection Directive was tabled, that was a time when data was processed in a much more limited and, one could say, one-dimensional manner. The meaning, value and indeed mass of data was on a different scale than it is today.

On this background, central actors in several member states wanted to address the issue of whether a different approach to regulating privacy in the 21^st century may be achievable. An approach, which to a lesser extent than the proposed regulation, create burdens like data portability—drafted for social media and the like—applicable to any entity processing personal data. The aim was also to make a fundamental assessment of what types of processing of personal data carries inherent risks, and as a result, could justify the fairly far-reaching compliance burdens contained in the draft regulation, and which types of processing could be exempted.

Not to remove the privacy protections necessary in light of technological and societal developments but rather to assess whether a model thought up in 1990 really was the most suitable to regulate data processing for the next 20 years.

Perhaps it could even have been agreed that the processing of some forms of personal data for certain purposes or by some data controllers is—especially in light of the pervasiveness of modern technology enabling processing—inherently legitimate and therefore should be allowed unless specific harm is caused.

But would such a shift not have lead to the dreaded "lowering of the level of data protection?”

Formally, yes. But this question presupposes that the current level of protection is high or even substantial and much more importantly actually complied with. It is a fact that the current Directive from early on suffered from, as the Commission put it, "very patchy compliance by data controllers, no doubt reluctant to undertake changes in their existing practices to comply with what may seem complex and burdensome rules, when the risks of getting caught seem low.”

Of course, imposing fines of up to 5 percent of a business' annual global turnover will certainly drive compliance efforts to a new high. But here are the relevant questions: Are the compliance burdens at all times proportionate to the risks? And are they imposed on businesses fairly?

Unfortunately, no matter where the negotiations go from here, there is good reason to fear that the final answers to both these questions will be, "No.”