You're accountable for compliance decisions. But how often do you consider how the regulations you implement were actually negotiated? The gap between regulatory text and the political process that produced it creates blind spots in your compliance program.
Christian D'Cunha, who led the review of the EU Data Retention Directive and later served at the European Data Protection Supervisor's office, reveals something critical: the regulations you implement aren't just legal documents. They're the product of negotiation, compromise, and ethical trade-offs that shape how you should interpret and apply them.
This checklist helps you build institutional knowledge about the political and ethical dimensions of EU privacy law. Use it to strengthen your team's ability to anticipate regulatory changes and make defensible compliance decisions.
What This Checklist Covers
This checklist addresses the gap between reading a regulation and understanding its intent. You'll assess whether your team can trace key requirements back to their policy origins, identify ethical principles embedded in regulatory text, and recognize when political compromises create implementation ambiguity.
It's designed for privacy officers and legal teams who need to interpret regulations under pressure and defend their choices to supervisory authorities or executive leadership.
Prerequisites
Before starting this checklist, confirm:
- Your team has access to official regulatory guidance from the European Data Protection Board and relevant supervisory authorities.
- At least one team member monitors EDPB opinions, guidelines, and working papers.
- You maintain documentation of your compliance decisions with written rationale.
- Your organization processes personal data under GDPR or anticipates doing so under the ePrivacy Regulation when finalized.
Checklist Items
1. Track legislative history for regulations you implement
Can your team identify which EDPB working groups, Article 29 Working Party opinions, or European Data Protection Supervisor recommendations influenced the regulations you follow?
Good looks like: A reference document linking each major GDPR chapter to pre-adoption guidance, showing how supervisory authorities interpreted requirements before the text was finalized.
2. Document the ethical principles behind your lawful basis selection
When you choose Legitimate Interests over Consent, can you articulate the ethical framework that supports your decision beyond legal defensibility?
Good looks like: Written analysis for each Legitimate Interests assessment explaining not just the three-part test, but the value judgments about data subject expectations and power imbalances that informed your balancing.
3. Monitor ePrivacy Regulation negotiations and prepare alternative compliance paths
Do you have a contingency plan for cookie consent and electronic communications that accounts for different possible outcomes of the ePrivacy Regulation?
Good looks like: A compliance matrix showing how your current approach would need to change under three scenarios: strict consent requirements, limited Legitimate Interests carve-outs, and extended timelines that leave the ePrivacy Directive in force longer than anticipated.
4. Assign responsibility for interpreting regulatory ambiguity
When GDPR Article 6 or Chapter V GDPR requirements conflict with operational realities, who on your team has authority to make the call and document the reasoning?
Good looks like: A named decision-maker with documented escalation criteria, plus a log of interpretation decisions that includes the regulatory text, the operational constraint, and the ethical principle that broke the tie.
5. Review Technical and Organisational Measures against evolving supervisory authority expectations
Can you explain why your current measures are "appropriate" not just by citing ISO standards, but by referencing supervisory authority enforcement priorities?
Good looks like: Annual review notes that map your encryption, access controls, and Data Purging procedures to recent EDPB guidelines and enforcement decisions, showing you've adjusted as expectations evolved.
6. Establish a process for evaluating cross-border transfer mechanisms when political conditions shift
If an Adequacy Decision is challenged or Supplementary Measures guidance changes, how quickly can you assess impact on your Data Exporter obligations?
Good looks like: A transfer inventory with documented risk assessments for each Data Importer relationship, reviewed quarterly, with trigger points that initiate legal review when political or judicial developments occur.
7. Create institutional memory of why you chose specific compliance approaches
When staff turn over, can new team members understand not just what you do, but why you rejected alternative approaches?
Good looks like: Decision logs that capture the Legal Obligation, the options you considered, the trade-offs you weighed, and the ethical or operational principle that drove your choice.
8. Connect your Rights Related to Automated Decision-Making procedures to the underlying policy debate
Do you know whether your approach to the Right to Human Review aligns with the European Data Protection Supervisor's position on algorithmic transparency?
Good looks like: Documented review of European Data Protection Supervisor opinions on automated decision-making that influenced how you designed your human intervention process, showing alignment with supervisory authority expectations even where GDPR text is general.
Common Mistakes
Treating regulations as static technical requirements. GDPR and the ePrivacy Directive evolved through negotiation. If you don't understand the compromises embedded in the text, you'll miss opportunities to interpret ambiguous provisions in ways supervisory authorities will accept.
Ignoring pre-adoption guidance. The Article 29 Working Party published opinions before GDPR took effect that still inform how supervisory authorities interpret requirements. Skipping this context means you're building compliance on incomplete information.
Separating ethics from legal analysis. When you face a choice between two defensible interpretations, the ethical dimension often determines which approach a supervisory authority will support. If your team can't articulate the values at stake, you're guessing.
Assuming the ePrivacy Regulation won't materialize. Years of delay don't mean abandonment. If you haven't modeled how stricter consent requirements or expanded Legitimate Interests restrictions would affect your operations, you're not ready.
Documenting what you did without capturing why. Compliance decisions made sense in context. If you can't reconstruct your reasoning two years later when a supervisory authority asks, you've lost your defense.
Next Steps
Start with items 1, 4, and 7. Building institutional knowledge and decision-making authority creates the foundation for everything else.
Then assess your exposure to ePrivacy Regulation changes (item 3) and cross-border transfer risks (item 6). These are the areas where political developments will force rapid operational changes.
Schedule quarterly reviews of EDPB guidance and supervisory authority enforcement decisions. You're not looking for new requirements; you're watching how authorities interpret existing ones. That pattern tells you where expectations are shifting before formal guidance appears.
The regulations you implement aren't neutral technical standards. They're negotiated agreements that reflect specific ethical commitments and political compromises. Your job isn't just to comply with the text. It's to understand the intent well enough to make defensible decisions when the text runs out.
