Privacy & Information Security Law Blog

On January 24, 2018, the European Commission issued a communication to the European Parliament and the Council (the “Communication”) on the direct application of the EU General Data Protection Regulation (“GDPR”). The Communication (1) recounts novel elements of the GDPR that create stronger protections for individuals and new opportunities for organizations; (2) reviews preparatory work undertaken to date for GDPR implementation; (3) outlines remaining steps for successful preparation; and (4) outlines measures the European Commission intends to take up until May 25, 2018.

EU GDPR – Stronger Protection and New Opportunities

The Communication begins by recapping the main innovations and opportunities afforded by the GDPR, including:

• a harmonized legal framework among EU Member States and a level playing field for all organizations operating in the EU market;
• stronger protections for individuals through the integration of data protection by design and default in the GDPR, enhanced individual rights and increased control through concepts such as data portability;
• a comprehensive set of rules on personal data breaches, and clarity on (1) the obligations of data processors and (2) data protection authorities’ (“DPA”) power to impose fines;
• flexibility for controllers and processors by virtue of the accountability principle; and
• a modern governance system ensuring consistent application of the GDPR along with guarantees of protection for personal data transferred outside the EU.

Preparatory Work to Date

The second section of the Communication details actions taken by the European Commission and the Article 29 Working Party (“Working Party”) to date in preparing for the GDPR. These include:

• supporting EU Member States and their authorities’ efforts to prepare for the GDPR through the establishment of an Expert Group and engaging in bilateral meetings with EU Members States’ authorities to discuss issues arising at the national level;
• supporting individual DPAs and the work of the Working Party, with a view to ensuring a smooth transition to the European Data Protection Board (“EDPB”);
• working on a modernized Council of Europe Convention 108, which reflects the same principles as those enshrined in the GDPR;
• pursuing international outreach by actively engaging with key trading partners, notably in East Asia, Southeast Asia and Latin America, working with Japan towards achieving a finding of adequacy and launching talks with South Korea in view of a possible adequacy decision;
• engaging with stakeholders through organized events and dedicated sectoral discussions, and setting up a multi-stakeholder group of civil society and business representatives, academics and practitioners on the GDPR;
• funding actions to develop tools supporting the effective application of the GDPR in relation to consent and privacy-preserving methods of data analytics through its Framework Program for research and innovation, Horizon 2020; and
• issuing Working Party guidelines on GDPR concepts for companies and other stakeholders.

Remaining Steps for Successful Preparation

The third section of the Communication outlines outstanding issues and remaining steps for GDPR preparation among all those involved in data protection.

• Though the GDPR is directly applicable, EU Member States must take necessary steps to adapt their existing legislation, set up national DPAs, choose an accreditation body and lay down rules for the reconciliation of freedom of expression and data protection. The European Commission notes that only two EU Member States (Germany and Austria) have already adopted relevant national legislation to date.
• The EDPB must be fully operational as of May 25, 2018. The European Data Protection Supervisor will provide the secretariat of the EDPB and has started the necessary preparations.
• EU Member States must ensure that national DPAs are provided with the necessary financial, human and technical resources to carry out their duties, both effectively and independently.
• Businesses, public administrations and other organizations processing personal data must undertake thorough reviews of their data policy cycle, potentially revise existing contracts, especially those between controllers and processors, and review their current transfer and governance mechanisms. The Communication notes organizations should use this opportunity to put their house in order, develop privacy within their organization and reset relations with DPAs.

Next Steps

The final section of the Communication outlines next steps the European Commission will take in the months leading up to the GDPR becoming directly applicable, including:

• The European Commission will continue working with EU Member States and, from May 2018, will monitor how they apply the new rules, taking appropriate action as necessary.
• The European Commission is making available new online guidance to help businesses comply with and benefit from the GDPR.
• The European Commission will make use of its power to issue implementing or delegated acts only where there is clearly demonstrated added value based on stakeholder feedback. The European Commission plans to look into GDPR certifications based on a study contracted with external experts and input from the multi-stakeholder group set up in 2017.
• The European Commission will work with the three EFTA states (Iceland, Liechtenstein and Norway) in the European Economic Area (“EEA”) to integrate the GDPR into the EEA agreement.
• The European Commission will pursue the objective of ensuring that provisions of EU data protection law applicable in the UK on the day preceding its withdrawal from the European Union will continue to apply to personal data processed in the UK before the withdrawal date.
• One year after the GDPR enters into application, the European Commission will organize an event to review different stakeholders’ experiences of implementing the GDPR. This will provide insight for the report the European Commission is required to complete on the evaluation and review of the GDPR by May 2020.