Privacy & Information Security Law Blog

On March 16, 2016, the Centre for Information Policy Leadership (“CIPL”) at Hunton & Williams LLP co-hosted a one-day workshop in Amsterdam, Netherlands, together with the Dutch Ministry of Security and Justice, to kick off CIPL’s new long-term project on the implementation of the EU General Data Protection Regulation (“GDPR”). The project aims to address the need for a constructive and expert dialogue between industry, regulators and key policymakers with the following specific objectives:

• facilitating consistency in the interpretation of the GDPR across the EU;
• informing and advancing constructive and forward-thinking interpretations of key GDPR requirements;
• facilitating consistency in the further implementation of the GDPR by EU Member States, the European Commission and the European Data Protection Board;
• examining best practices and challenges in the implementation of the key GDPR requirements;
• sharing industry experiences and views to benchmark, coordinate and streamline the implementation of new compliance measures; and
• examining how the new GDPR requirements should be interpreted and implemented to advance the European Digital Single Market strategy and data-driven innovation, while protecting the privacy of individuals and respecting the fundamental right to data protection.

Under the title of “Towards a Successful and Consistent Implementation of the GDPR,” the workshop focused on GDPR issues that require further interpretation and guidance. More than 100 participants from numerous EU data protection authorities (“DPAs”), the European Data Protection Supervisor, the European Commission, several government ministries, EU and U.S. businesses, as well as from academia and other organizations, participated in the workshop.

CIPL also has released its workshop report Implementing and Interpreting the GDPR: Challenges and Opportunities (the “Report”). The key themes and takeaways from the Amsterdam workshop that are discussed in the Report include:

• In order to ensure the consistent implementation and interpretation of the GDPR, ongoing, high-level and open engagement between industry, EU DPAs, the European institutions (e.g., the Commission), the ministries of the Member States and other stakeholders (e.g., privacy professionals) is essential.
• The Article 29 Working Party and the Commission will hold several meetings over the next two years which will provide suitable forums for stakeholder involvement.
• The successful GDPR implementation and interpretation also will depend on various considerations, such as taking into account the aims of the European strategy on the Digital Single Market, devising “future-proof” and technologically neutral interpretation and implementation guidance, ensuring a harmonized European approach (as far as possible) and considering the areas of overlap between the GDPR and other European laws (e.g., competition law and the E-Privacy Directive).
• “Accountability” is a cornerstone of the GDPR and must be understood by all the relevant stakeholders. Regulators should incentivize companies to adopt and develop accountability tools.
• “Smart” data protection regulation may enable EU DPAs to discharge their GDPR roles more effectively and tackle the significant changes in their roles and their powers at national and European levels.
• The data protection officer is a linchpin of organizational accountability. It is essential to clarify the functional and organizational aspects of the data protection officer role in order to ensure the effectiveness of the role.
• The understanding of “risk” and “high risk” must be harmonized, and effective risk assessment methodologies that consider both the risks and the benefits of processing must be developed and agreed, without determining a definitive list of “high risk” processing.
• Codes of conduct, certifications, seals and binding corporate rules can be effective compliance and accountability tools. It would be preferable if they worked at the “programmatic” rather than just the product level only. Regulators should also incentivize the adoption and development of such measures.
• Implementing and interpreting the rights to data portability, erasure and object raise various problems which need to be resolved. For example, there are potential interactions between the data portability right and other legal areas, such as intellectual property, which need to be addressed.
• The GDPR transparency provisions should be implemented and interpreted in order to minimize any tension between the GDPR provisions on transparency and detailed notice. Relatedly, the relevant stakeholders should carefully consider whether icons are suitable transparency tools.
• The GDPR will raise specific challenges for start-ups and small and medium-sized enterprises that need to be addressed, for example, by involving start-ups and small and medium-sized enterprises in the stakeholder engagement process. Also, stakeholders might explore how larger and more experienced companies can help shape how start-ups and small and medium-sized enterprises approach data protection compliance.

The Report also provides information about next steps in CIPL’s ongoing GDPR implementation initiative, including working groups to develop written input, workshops, webinars and engagements with relevant regulators and government officials.