United Internet AG

EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR JUSTICE AND CONSUMERS Directorate C: Rule of Law, Fundamental Rights and Democracy Unit C.3: Data protection Brussels, 19 September 2023 DG JUST.C3 QUESTIONS TO GDPR MULTISTAKEHODLER EXPERT GROUP FOR COMMISSION 2024 REPORT ON THE APPLICATION OF THE GDPR The General Data Protection Regulation (‘GDPR’) entered into application on 25 May 2018, repealing and replacing Directive 95/46/EC. The GDPR has a two-fold objective. The first is to protect fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. The second is to allow the free flow of personal data and the development of the digital economy across the internal market.

…is to allow the free flow of personal data and the development of the digital economy across the internal market. In line with Article 97 GDPR, the Commission adopted a first report on the evaluation and review of the GDPR on 24 June 2020 (the ‘2020 report’).1 The next report is due by mid- 2024 (the ‘2024 report’). Article 97 GDPR requires the Commission to examine, in particular, the application and functioning of: • Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on cooperation and consistency.

…adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on cooperation and consistency. As you are aware, the functioning of Chapter VII is addressed by the Commission’s proposal for a Regulation on GDPR procedural aspects adopted on 4 July 20232 and takes into account the input received from the Group. Therefore, the present exercise does not cover this matter. Article 97 GDPR also requires the Commission to take into account the positions and findings of the European Parliament and the Council, and of other relevant bodies and sources. The Commission may also request information from Member States and supervisory authorities.

…bodies and sources. The Commission may also request information from Member States and supervisory authorities. 1 Communication from the Commission to the European Parliament and the Council, Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, 24.6.2020, COM(2020) 264 final. 2 COM(2023) 348 final. Ref. Ares(2024)916399 - 07/02/2024 2 Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111 [email protected] The GDPR Multistakeholder Expert Group was established in 2017 to assist the Commission in identifying potential challenges in the application of the GDPR from the perspective of different stakeholders, and to advise the Commission on how to address them.

…of the GDPR from the perspective of different stakeholders, and to advise the Commission on how to address them. In view of the preparation of the 2024 report, and as for the preparation of the 2020 report1, the Commission is seeking feedback on your experiences with the application of the GDPR. As communicated separately, the Commission has planned a meeting of the Multistakeholder Expert Group for 27 October 2023. This meeting will provide an opportunity for members to provide feedback orally to the questions below and to raise other points if deemed necessary.

…for members to provide feedback orally to the questions below and to raise other points if deemed necessary. You will then be invited to provide your final feedback in writing (in English) to the questions below by 18 November 2023, at the following e-mail address: JUST-C3- [email protected] Please note that, as for the 2020 report, the Commission will prepare a report summarising the written feedback provided, which is intended to be made publicly available. Individual contributions may be disclosed in response to access to documents requests under Regulation (EC) No 1049/2001.2 QUESTIONS 1. General comments a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed?

…in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? The introduction of the General Data Protection Regulation (GDPR) has posed significant challenges for businesses, particularly in ensuring compliance with its requirements. Adapting to these standards has led to substantial investments by many companies. The ongoing development priorities focus on balancing data protection with fostering European innovation and global competitiveness, especially in AI models and applications. Consistency in applying risk-based and proportionality principles, particularly in international data transfers and data breaches, is crucial. Concerns have arisen over certain national data protection authorities potentially exceeding their GDPR powers, which could undermine the balance between innovation and economic growth in Europe.

…exceeding their GDPR powers, which could undermine the balance between innovation and economic growth in Europe. There are concerns regarding international data transfer tools under the GDPR, including deficiencies that need addressing to build trust among European companies without imposing excessive compliance burdens. The varying application of the GDPR by national 1 Report – Contribution from the Multistakeholder Expert Group to the Commission – 2020 evaluation of the GDPR, 17 June 2020: https://ec.europa.eu/transparency/expert-groups-register/core/api/front/document/41708/download 2 Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents OJ L 145, 31.5.2001, p. 43– 48. 3 authorities is also a critical issue.

Parliament, Council and Commission documents OJ L 145, 31.5.2001, p. 43– 48. 3 authorities is also a critical issue. The adaptation of the GDPR by European legislators and the uneven implementation across EU Member States, with countries like Ireland and Luxembourg emerging as internet industry hubs, have led to market imbalances. The publication of the Guidelines on the application of Article 60 of the GDPR was a positive first step, but not all data protection authorities have effectively adopted these guidelines, leading to imbalances in GDPR interpretation. The EU Commission's review initiative is a positive step towards improving the cross-border enforcement of the GDPR. The GDPR has brought both benefits and challenges since its implementation.

…the cross-border enforcement of the GDPR. The GDPR has brought both benefits and challenges since its implementation. Benefits include increased awareness and trust in data protection among businesses and consumers, and the integration of data protection requirements into process approvals. Challenges include the continuous updating of processing activity inventories, optimizing data subject access request mechanisms, managing third-party contracts, including data protection agreements, and implementing privacy by design. These challenges require proactive approaches to integrating data protection into product and service development phases. Also, the following aspects are particularly relevant and require a review: Anonymization: Although not directly included in the GDPR, anonymization is derived from the definition of personal data in Art. 4 Nos. 1 and 5 of the GDPR and Recital 26.

GDPR, anonymization is derived from the definition of personal data in Art. 4 Nos. 1 and 5 of the GDPR and Recital 26. Currently, there are high requirements for anonymization. A stronger privileging of data processing under pseudonymization of personal data to strengthen the risk-based approach in the GDPR would be more sensible than demanding anonymization requirements. A clear commitment to relative personal reference is needed, as this has already been confirmed by some courts. Harmonization in the EU and Germany (Art. 60 ff GDPR): Challenges in standardization continue. The coordination among 27 supervisory authorities at the EU level for a uniform interpretation and enforcement of the GDPR rules is only partially effective in practice. A stronger position for the European Data Protection Board (EDPB) would be desirable.

…partially effective in practice. A stronger position for the European Data Protection Board (EDPB) would be desirable. In Germany, the supervisory authorities of the federal and state governments also interpret the GDPR differently in parts. Enforcement Against US Corporations (Art. 83 GDPR): In individual cases, such as the fines imposed by the Irish supervisory authority against Meta in 2023, high fines have been enforced. However, large corporations still have the means, based on their financial resources, to delay proceedings. Third-Country Transfers (Art. 44 ff GDPR): Given NOYB's announcement to also proceed against the new US-EU Privacy Shield Framework, its viability is in question, continuing to bring legal uncertainty. Many US companies are also not yet listed with the FTC in the US.

33 → 12

originalus šaltinis (PDF) ↗