This blog post is republished by permission of the Center for Democracy and Technology where it first appeared.

This post is part of “CDT Fellows Focus,” a series that presents the views of notable experts on tech policy issues. This month, CDT Fellow Omer Tene writes about the consultation launched by the European Commission to update the European Union Data Protection Directive. Posts featured in “CDT Fellows Focus” don’t necessarily reflect the views of CDT; the goal of the series is to present diverse, well-informed views on significant tech policy issues.

In a way, the process undertaken by the European Commission to review the current framework applicable to privacy and data protection is akin to speeding on a highway at 100 mph while looking at the rearview mirror. The consultation launched by the EC and comments filed by some of the main players (see, e.g., ec.europa.eu) are strongly anchored in the text of the EU Data Protection Directive (“EU DPD”), enacted in 1995, negotiated several years before then, and based on documents dating back to the late 1970s. That was the era of mainframe computers and punched cards; long before PCs, the Internet, and mobile, not to mention cloud services, ubiquitous computing, smart grid, genetics and biometrics.

Building on acquired knowledge and proceeding with care in small increments is firmly rooted in legal culture. Ours is a discipline based on precedent and cautious tweaking of existing texts. Torts, contracts, and even public law today are strikingly similar to those in Roman times or ancient Jewish law. Yet given the scope and pace of technological innovation over the past 40 years and its massive impact on the collection, storage and use of personal information, it seems that an innovative mindset is needed to overcome some of the shortcomings of the current framework.Continue Reading For Privacy, European Commission Must Be Innovative