Beltug vzw/asbl

…8 February 2024 Consultation European Commission Report on the General Data Protection Regulation Beltug input Ref. Ares(2024)975732 - 08/02/2024 Report on the General Data Protection Regulation 8 February – 2 About Beltug With over 2300 members from 500+ organisations, Beltug is the largest Belgian association of CIOs & Digital Technology leaders. We cover their priorities such as vendor and software asset management, 5G, hybrid IT, cyber security, artificial intelligence, the hybrid workplace, IoT, privacy, data governance, and many more. We defend the interests of our members, develop positions, and support knowledge exch anges between our members. Each year, we organise more than 50 events for sharing experiences. Beltug also represents the business ICT users at the European and international levels, in close cooperation with organisations in other countries.

ICT users at the European and international levels, in close cooperation with organisations in other countries. Within Beltug there is an active Privacy Council gathering privacy experts from different sectors. EC Transparency register: TR ID 488493238396-32 Contact: Danielle Jacobs, CEO, Beltug, +32 495 10 88 51, [email protected] Beltug – Industriepark-West 75 – 9100 Sint-Niklaas – www.beltug.be Report on the General Data Protection Regulation 8 February – 3 Consultation European Commission - Report on the General Data Protection Regulation GDPR led to a higher awareness for data protection. Yet there are several challenges that businesses must deal with and that raised legal uncertainties. If the EDPB guidelines are seen as helpful in the interpretation of the GDPR, the documents are also seen as complex, requiring serious resources to be analyzed.

…in the interpretation of the GDPR, the documents are also seen as complex, requiring serious resources to be analyzed. 1 Reporting obligations are burdensome The level of information expected from companies is burdensome. The reporting obligations can be disproportional. There is a real need for clarification and guidance on what is needed to comply with the regulation. The implementation of the information obligation means a great deal of effort. The implementation of the GDPR requires in every business environment a lot of resources. Implementing a risk-based approach would be welcomed to facilitate the conformity with the GDPR while considering the burden of the reporting obligations. The burden of proof requirement is heavy. Companies are not always sure that they have fulfilled all the obligations at a sufficient level.

…requirement is heavy. Companies are not always sure that they have fulfilled all the obligations at a sufficient level. 2 Application of the GDPR in non-EU States Several companies shared issues in cross-border situations, especially when there is no adequacy decision with third countries. It is often unclear how the GDPR is applied with the specific regulations of different third countries. Since the CJEU ruling on Schrems II, additional measures must be introduced to secure personal data if the level of data protection does not correspond to that of the GDPR. Situations where personal data is transferred to third countries as part of international business operations are also perceived as challenging. This requires a lot of efforts for companies to comply with the rules and raises questions regarding the legal certainty of the framework in which they operate.

…to comply with the rules and raises questions regarding the legal certainty of the framework in which they operate. For instance, not all data transfers can be technically secured. For instance, the CJEU’s ruling “Schrems II” puts data controllers in a situation to investigate a third country’s legal situation. Analyzing the legislation of the destination Report on the General Data Protection Regulation 8 February – 4 country requires large resources for companies and even the bigger one’s face challenges. International harmonization should be encouraged. The European Commission should continue working on adequacy decisions. There are strong expectations regarding a robust framework for EU-US data transfers. Industrial planning needs legal certainty.

…strong expectations regarding a robust framework for EU-US data transfers. Industrial planning needs legal certainty. 3 Unbalanced responsibility of the data holder A significant challenge in the application of the GDPR is linked with the interpretation of some provisions perceived as unclear and the implementation of some obligations at company level. One area of uncertainty concerns the level of responsibility held by data controllers for the entire subcontracting chain's data transfers and how the assessment of the entire subcontracting chain should be practically verified, especially with subcontractor operating outside the EU. Proceeding to a transfer impact assessment to third countries requires resources to evaluate a foreign legal situation and authority practices.

…impact assessment to third countries requires resources to evaluate a foreign legal situation and authority practices. Regular monitoring of all requirements is costly, especially as subcontractors may update their website, without notice. Finding the right information might be difficult. It would be useful to encourage suppliers to automatically mention changes made in their practice regarding personal data. Moreover, it is often challenging for data controllers to assess the contractual relationships between their subcontractors and the subcontractors further down the chain, as well as to obtain information about the associated risks. There is a need to better balance the way responsibility is shared between data controllers and the providers throughout the chain. Several provisions are burdensome for companies, especially the Data Protection Impact Assessments (DPIAs).

…the chain. Several provisions are burdensome for companies, especially the Data Protection Impact Assessments (DPIAs). Yet they are held responsible as data holders, but they are not in a situation to get information from their subcontractors, especially when they are large international IT providers. For instance data holders are not always in a situation when they can impose to their IT subcontractors, provisions, especially on how they secure the data. The same points always arise in the negotiations, for example audit rights, disclosure of sub-service providers, etc. European data holders are not in a position to negotiate with major IT providers and the negotiations about GDPR conformity are long.

…holders are not in a position to negotiate with major IT providers and the negotiations about GDPR conformity are long. 4 Unclear provisions leading to interpretation In a practical business environment, the division of roles into data controllers and processors in not as straightforward as it is described in the GDPR. Data processors often Report on the General Data Protection Regulation 8 February – 5 also act as data controllers. Therefore, the application of several provisions of the GDPR is confusing. Moreover, international companies often have separate legal entities operating in different countries, which act both as data controllers and participate in the same processing activities. This situation raised questions regarding the application of the cross-border processing provisions.

…activities. This situation raised questions regarding the application of the cross-border processing provisions. 5 Application of the GDPR and the different legislatives texts Since the adoption of the GDPR in 2018, several legislative texts have been adopted or will be. This increases the complexity of the compliance, especially when definitions are not fully aligned. It would be very helpful if the Commission could provide a concordance table of the different provisions and definitions. Developing GDPR conformity labels regarding some tools that are used by companies would also be appreciated. Business users are also looking forward to a clear framework regarding the impact of artificial intelligence and the GDPR, especially for the implantation of the AI regulation and data transfers.

…of artificial intelligence and the GDPR, especially for the implantation of the AI regulation and data transfers. Report on the General Data Protection Regulation 8 February – 6 Beltug vzw/asbl Bedrijvencentrum Waasland, Industriepark-West 75 | B - 9100 Sint-Niklaas | +32 3 780 17 30 BE 0443-557-046 | RPR Gent, afdeling Dendermonde www.beltug.be | [email protected]

originalus šaltinis (PDF) ↗