Brussels tries to simplify the European digital acquis
by Antonio Perrucci and Luca Megale
Digital Europe is trying to put its regulatory maze in order. With the new Digital Package on Simplification (which is scheduled to be presented on 19 November, but some drafts of which are circulating with probable changes in the final version), the European Commission proposes to simplify and consolidate most of the rules that today make up the so-called digital acquis: from the Data Act to the GDPR, from the Privacy Directive to the NIS2 directive. Furthermore, the text states that this draft Regulation will be accompanied by a second one dedicated to the revision of the EU Artificial Intelligence Regulation (2024/1689), not included in the circulated draft. The two documents together will form the Digital Omnibus. On the same day, 19 November, the Data Union Strategy will be presented and it is uncertain whether the revision of the Cybersecurity Act will be presented (which could slip between December and January). A 'legislative cleansing' operation that aims to reduce burdens and overlaps, but which at the same time moves along a delicate ridge - that of simplifying without affecting the level of protection.
The draft Digital package on simplification, considered in Brussels as the first step towards a 'single European digital code', stems from the need to bring order to a regulatory framework that in recent years has been stratified through a multiplicity of regulatory interventions. According to the Commission itself, the proliferation of texts and obligations has ended up generating confusion, duplication and disproportionate costs, particularly for small and medium-sized enterprises. Hence the decision to aim for a Simpler and faster Europe, concentrating intervention in three core areas: data regulation, streamlining of cyber incident reporting and greater clarity for the implementation of rules on artificial intelligence. The proposal envisages a number of technical interventions that, cumulatively, should have a strong immediate impact on businesses, citizens and public administrations. The Commission estimates savings for the EU of at least EUR 1 billion per year from entry into force, plus a further EUR 1 billion in one-off savings, totalling at least EUR 4 billion over three years, by 2029. The economic estimates do not, according to the proposal, include the business opportunities that may be generated by the proposed new regulatory approach.
The heart of the reform is what is called the data acquis. The Data Act, already in force, thus becomes the container for a new unified body of legislation, intended to incorporate the Data Governance Act, the Free Flow of Non-Personal Data Regulation and the Open Data Directive. The result is a harmonised framework for the sharing and re-use of public and private data, with the intention of simplifying procedures and terminologies and offering greater consistency to economic operators. Public administrations will also be able to apply differentiated conditions and fees for large digital platforms, the so-called gatekeepers, when they re-use public data. The aim is to prevent the economic power of large operators from translating into an unjustified competitive advantage to the detriment of small innovative companies.
Another relevant novelty concerns the small mid-caps, the medium-sized enterprises that were hitherto excluded from the facilitated regime for SMEs. The Digital Omnibus extends to them the same benefits in terms of documentation and compliance obligations, in an attempt to ease the regulatory pressure on a business segment that represents a crucial driver of European innovation.
The proposal also intervenes on the GDPR, the General Data Protection Regulation, to introduce targeted and technical changes. For instance, the definitions of 'personal data' and 'sensitive data' would be clarified, data breach notifications would be simplified - with a deadline extended to 96 hours and the possibility to use a single European portal - and information requirements in cases of low-risk processing would be reduced. There would also be the introduction of a possible sandbox regime to strengthen the dialogue between innovation and regulation.
