If the EU data protection legislative reform was a marathon, we would now be approaching the 20-mile mark. That is the critical point where one can start to think that the finish line is within reach in the knowledge that the hardest part is yet to come. At present, the EU legislative process that started more than three years ago is about to reach a crucial milestone: On 15 and 16 June, the Council of the EU—which shares legislative powers with the European Parliament—is due to reach an agreement on its own preferred draft for the General Data Protection Regulation (GDPR).

What started as an ambitious proposal by the European Commission, which was then amended by the Parliament in 2014, will be ready to be debated alongside the Council's newly agreed draft in order to adopt a final version of the GDPR. According to a proposed timetable released by one of the Parliamentary political groups, the three-way negotiation process between the Commission, Parliament and Council—known as the trilogue—is expected to last six months. Comparing this timetable to our imaginary marathon, the challenges that lie ahead will be a real test of endurance:

Six miles to go…

Shortly after the Council agrees to its draft, the three European institutions will need to reach an agreement on the overall roadmap for trilogue negotiations. This has already been laid down by the Parliament and the decision to try and stick to the proposed timetable or not will be a sign of the level of commitment and state of mind of the parties towards the work ahead.

Five miles to go…

In July, before the institutions hit the summer recess, the intention seems to be to get a couple of easy wins under their belt. These will include the territorial scope of the GDPR (Article 3) and international data transfers (Chapter V), on which the three bodies largely agree. A potentially difficult issue is the Parliament's introduction of a specific restriction on the disclosure of personal data following a request from a non-EU court or administrative authority. The political connotations of this measure are severe and will require skillful handling in the trilogue.

Four miles to go…

Straight after the summer, in September, the institutions are meant to tackle the core aspects of the entire framework:

• the data protection principles, including the grounds for processing and the conditions for consent (Chapter II),
• the rights of individuals, including the right to be forgotten and the provisions on profiling (Chapter III), and
• the substantive obligations affecting controllers and processors (Chapter IV).

Given the crucial importance of each of the provisions in these sections, this could be a very long mile. A critical aspect of the negotiations around these issues will be the degree of acceptance by the Parliament of the so-called “risk-based approach” proposed by the Council. If this concept is maintained, agreement within a month is possible but otherwise, discussions could really drag on.

Three miles to go…

The discussions scheduled to take place in October are bound to be very intense. The key issue for debate is the concept of One Stop Shop—one of the cornerstones of the whole framework devised by the Commission, which is supported by the Parliament but that has proved to be a battleground in the Council. The proposal from the Council on this point is the result of heated internal discussions and, therefore, it is nowhere near the Commission's original thinking.

An area where there seems to be a degree of consensus is the potential amount of the fines that data protection authorities will be able to issue. The final amount is still due to be discussed but we can assume that the highest fines will be calculated by reference to the annual turnover of a corporate group.

Two miles to go…

After having sorted out the most substantial issues, the negotiations will focus on some technical but still important points such as the special regimes that will apply to the processing of personal data in the context of the employment relationship, scientific research and journalism. Getting the balance right on these specific issues will be of great strategic importance for many organisations.

One mile to go…

The final discussions will hopefully be uncontroversial – although they will touch on the politically sensitive issue of the power of the Commission to adopt delegated and implementing acts. However the prospect of the finish line will likely help everyone reach consensus.

The most difficult question to answer is this: Will the three European institutions involved in the process have the vision, stamina and sense of common purpose to meet this demanding timetable?

It is not impossible but they are going to have to dig deep to progress at that speed. Time to pull up our socks everyone!