Telefonica, S.A.

…1 ID Register: 52431421-12 TOWARDS 2024 EC REPORT ON THE APPLICATION OF GDPR TELEFÓNICA VIEWS ON 5-YEAR GDPR APPLICATION January 2024 The General Data Protection Regulation (‘GDPR’) entered into application on 25 May 2018, repealing and replacing Directive 95/46/EC. The GDPR has a two-fold objective. The first is to protect fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. The second is to allow the free flow of personal data and the development of the digital economy across the internal market. In line with Article 97 GDPR, the Commission adopted a first report on the evaluation and review of the GDPR on 24 June 2020 (the ‘2020 report’)1. The next report is due by mid-2024 (the ‘2024 report’).

…and review of the GDPR on 24 June 2020 (the ‘2020 report’)1. The next report is due by mid-2024 (the ‘2024 report’). Article 97 GDPR requires the Commission to examine, in particular, the application and functioning of: • Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on cooperation and consistency. The functioning of Chapter VII is addressed by the Commission’s proposal for a Regulation on GDPR procedural aspects adopted on 4 July 20232.

VII is addressed by the Commission’s proposal for a Regulation on GDPR procedural aspects adopted on 4 July 20232. 1 Communication from the Commission to the European Parliament and the Council, Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, 24.6.2020, COM(2020) 264 final. 2 COM(2023) 348 final. Ref. Ares(2024)938078 - 07/02/2024 2 Article 97 GDPR also requires the Commission to take into account the positions and findings of the European Parliament and the Council, and of other relevant bodies and sources. The Commission may also request information from Member States and supervisory authorities. QUESTIONS 1. General comments a.

…may also request information from Member States and supervisory authorities. QUESTIONS 1. General comments a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? The GDPR stands as a significant milestone with far-reaching positive implications for companies, governments, individuals, and society at large. Despite some unresolved issues, like the alignment with outdated sector- specific rules such as the ePrivacy Directive, the GDPR has ushered in a new era of privacy culture. Among its key achievements: • Harmonization Across Borders: GDPR has introduced a high level of harmonization among EU Member States in terms of data processing principles, rights of data subjects, and obligations for companies.

…among EU Member States in terms of data processing principles, rights of data subjects, and obligations for companies. This harmonization is a substantial leap forward from the previous system with vastly different data protection laws in each Member State. It creates a more consistent and predictable environment for both businesses and individuals. • Global Privacy Standard: GDPR has become a global privacy standard. Regions worldwide are increasingly adopting the GDPR model. This global alignment benefits European companies and data subjects by simplifying international data transfers and raising the bar for data protection standards. • Increased Awareness: GDPR’s accountability principle has driven structural changes within companies in how they collect and process personal data. Simultaneously, individuals have become more aware of the importance of their privacy.

…and process personal data. Simultaneously, individuals have become more aware of the importance of their privacy. It has fostered a collective consciousness about the value and protection of personal data. • Adaptability to Technology: GDPR’s technologically neutral approach and future-proof rules make it adaptable to emerging technologies and evolving realities. It ensures that the regulation continues to provide a high level of protection for the fundamental right to data protection in an ever-changing digital landscape. • Legitimate interest as a legal basis: The use of legitimate interest, with all its guarantees, deserves a special consideration as legal basis over other, more commonly used bases, such as consent.

…its guarantees, deserves a special consideration as legal basis over other, more commonly used bases, such as consent. Legitimate 3 interest establishes the data controller as the party who must assess the proportionality and lawfulness of the data processing, whereas consent places such assessment onto the data subject, who may not always be able to carry out said assessment properly. Hence, the proper use of legitimate interest as a legal basis may further safeguard the rights and freedoms of the data subjects regarding their personal data. In general, the main benefit of GDPR should be to create a safe environment for data processing operations while enabling competitiveness and innovation.

…should be to create a safe environment for data processing operations while enabling competitiveness and innovation. However, due to the impact and significance that GDPR compliance has on organizations, an unreasonable or disproportionate approach to its enforcement can severely impact both goals of secure data processing and competitiveness & innovation within the EU. Therefore, for the GDPR to be able to properly establish a safe environment for competitiveness and innovation while safeguarding the rights and liberties of EU citizens, we consider that the following issues should be addressed: • Corrective measures: Further encouraging the DPAS to favor corrective measures over sanctioning measures in the event of non-compliance could be highly beneficial, especially when such non-compliance may be of an interpretative nature.

…of non-compliance could be highly beneficial, especially when such non-compliance may be of an interpretative nature. • DPAs soft law: However, both the EDPB and Data Protection Authorities (DPAs) have published opinions and decisions (“soft law”) where, in practice, they pre-establish GDPR compliance requirements for certain processing operations, thus moving away from the principle-based approach. Soft law should not undermine the principle-based approach of the GDPR nor trigger enforcement for specific interpretations. • Enforcement disparities: Despite the significant improvements regarding harmonization, there have been disparities in the enforcement of GDPR across EU Member States, leading to concerns about consistency and creating legal uncertainties, especially in the technology sector.

States, leading to concerns about consistency and creating legal uncertainties, especially in the technology sector. Ensuring consistent interpretation, application and enforcement of GDPR across all EU member states must be a priority. This can help reduce compliance complexities for organizations. • Interplay between the GDPR and other privacy-related regulations. In our opinion, and to achieve GDPR’s ultimate goal, lex specialis regulations (i.e. ePrivacy) should be avoided to regulate data protection. 4 2. Exercise of data subject rights a. From the individuals’ perspective: please provide information on the exercise of the data subject rights listed below, including on possible challenges (e.g. delays in controllers/processors reply, clarity of information, procedures for exercise of rights, restrictions on the basis of legislative measures, etc.).

…clarity of information, procedures for exercise of rights, restrictions on the basis of legislative measures, etc.). From the controllers and processors’ perspective: please provide information on the compliance with the data subject rights listed below, including on possible challenges (e.g. manifestly unfounded or excessive requests, difficulty meeting deadlines, identification of data subjects, etc.).

(e.g. manifestly unfounded or excessive requests, difficulty meeting deadlines, identification of data subjects, etc.). • Information obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) • Access to data (Article 15) • Rectification (Article 16) • Erasure (Article 17) • Data portability (Article 20) • Right to object (Article 21) • Meaningful explanation and human intervention in automated decision making (Article 22) Where possible please provide a quantification and information on the evolution of the exercise of these rights since the entry into application of the GDPR. From a data controller perspective, the abuse or misuse of these data protection rights is a relevant issue of concern. In particular, an abusive use of the right to access can be highly expensive for a data controller, both economically and operationally.

43 → 12

originalus šaltinis (PDF) ↗