Making the General Data Protection Regulation work

The General Data Protection Regulation (COM (2012) 11 final) – hereafter “the regulation” – is coming. After more than three and a half years of political debate and thousands of proposed changes it is now quite certain that the final adoption of the regulation will take place within the foreseeable future. And while much has already been said and written about what the regulation will mean for both the public and the private sector the aim of this comment will be to touch upon two of the somewhat overlooked issues which will not be settled by the formal adoption of the regulation. These issues warrant attention because they must be addressed effectively in order for the regulation to work in practice for citizens, businesses and authorities.