Privacy & Information Security Law Blog

On April 28, 2020, the Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP submitted formal comments to the European Commission’s consultation on its roadmap for the two-year evaluation of the EU General Data Protection Regulation (“GDPR”) (the “Response”).

The Response seeks to provide input to the Commission’s upcoming GDPR evaluation report, mandated by Article 97, and builds on CIPL’s 2019 GDPR stocktaking report. The Response highlights that the tangible benefits, as well as the challenges and unfulfilled promises of the GDPR, outlined in CIPL’s 2019 report are still evident. Additionally, the COVID-19 crisis has brought into sharp focus the need for progressive GDPR interpretation as it confirms the potential of data to help address the worldwide crisis.

While CIPL believes that a shift in approach is needed to leverage GDPR provisions to their full extent going forward, the Response does not advocate for a formal review of the GDPR. CIPL believes the current challenges can be resolved by the Commission, the European Data Protection Board (“EDPB”) and the data protection authorities (“DPAs”) using existing institutional and regulatory mechanisms and their wide interpretative powers. In addition, the Response calls for consideration of GDPR challenges that go beyond the aspects of examination outlined in Article 97.

CIPL groups its evaluation and recommendations into four categories. Key takeaways from the Response include:

Short-Term Actions to Make GDPR Implementation More Efficient:

• Data transfers: The European Commission and the EDPB should provide a complete data transfer toolkit to organizations, including by updating standard contractual clauses, adopting further adequacy decisions and developing EU-wide certifications and codes.
• Cooperation, consistency and One-Stop-Shop: The EDPB should enhance collaboration among DPAs, including by clarifying that the lead DPA acts as a single interlocutor for organizations and by encouraging DPA participation in proceedings as concerned DPAs where appropriate.
• Harmonization: The European Commission should map inconsistencies and gaps in national laws and work with Member States to further harmonize the implementation of the GDPR.
• Availability of accountability tools: The European Commission should finalize, and the EDPB and DPAs should complete the adoption of, the certification regulatory framework.

Improvements to EDPB and DPA Collaboration and Engagement

• Transparency and constructive engagement: The EDPB and DPAs should work towards enhanced transparency, including through a pre-consultation phase for new guidance, setting up a special consultative group of data protection experts and enhancing the usefulness of guidance to organizations.
• Harmonization of DPAs’ GDPR interpretation and implementation: The EDPB should play a leading role in reducing the number of duplicative guidelines by DPAs.
• Transparent, harmonized and proportionate enforcement: The EDPB and DPAs should publish their regulatory strategies and priorities, develop a clear and consistent fining model, recognize accountability as a mitigating factor under Article 83 of the GDPR and promote amicable settlement practices between organizations and DPAs.

Progressive Interpretation of Some of the GDPR’s Key Substantive Requirements

• Legal basis for processing: The EDPB and DPAs should clarify and reinforce that the GDPR does not favor consent over other bases and adopt a more flexible interpretation of other legal bases, including legitimate interest, contractual necessity and compliance with a legal obligation. Further exploration of public interest and vital interest as grounds for processing should be undertaken.
• Anonymized data: The EDPB and DPAs should adopt a consistent interpretation of the notion of anonymous data and clarify the legal regime applicable to pseudonymous data.
• Risk-based approach and risk assessment: The EDPB and the Commission should enable dialogue to build consensus on how to identify and assess risks and harms to individuals and recognize that not only risks but also benefits and reticence risks must be taken into account.
• Data security and breaches: The EDPB and DPAs should work toward defining a consistent risk assessment methodology, create a single breach reporting form in English applicable across all EU countries, as well as raise the threshold to notify DPAs and individuals of a breach. The European Commission should support negotiations between ICANN and the EDPB.

Long-Term Positioning of the GDPR in the Broader Digital Landscape

• GDPR and other EU laws: The European Commission should ensure that before new EU legislation impacting personal data is proposed, a gap analysis is conducted to avoid creating duplicative or conflicting obligations and legal uncertainty.
• GDPR and new technology: The EDPB and DPAs should resolve tensions between AI and data protection concepts by working with industry and clarify DPA competence to deploy regulatory sandboxes.
• GDPR and the data economy: The EDPB and DPAs should set up a working group with industry to develop a data sharing framework.