Bitkom · Trade and business associations · DE
Šaltinis: Europos Komisijos skelbiami susitikimai, sutapatinti pagal skaidrumo registro numerį. n = 60 susitikimų; x — metai pagal susitikimo datą, y — susitikimų skaičius.
Position Paper bitkom.org 08. February 2024 Questionnaire for the report on the General Data Protection Regulation 1. General comments a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? Since May 2018, the implementation of the General Data Protection Regulation (GDPR) has significantly shaped the landscape of data protection practices across member federations. Bitkom appreciates the opportunity to engage in the public consultation for this year’s report by the European Commission. The GDPR has undeniably contributed to heightened awareness and improved hygiene in handling personal data.
Commission. The GDPR has undeniably contributed to heightened awareness and improved hygiene in handling personal data. Enhanced emphasis on data protection has fostered a culture within enterprises, encouraging a proactive approach to compliance and an exploration of ways to meet requirements in a more transparent and compliant manner. Impact on businesses becomes visible in the incremental improvement of internal procedures for data discovery and audit trails, particularly in sectors with a high uptake of digital technologies. Significant investments have been directed toward GDPR compliance, especially by SMEs. This reflects the importance placed on adhering to the regulatory framework and improving the global flow of data. These data flows underpin the modern economy and are critical to protecting consumers wherever their data is located.
These data flows underpin the modern economy and are critical to protecting consumers wherever their data is located. However, as described below, the positive trend towards better data management practices requires the existing hurdles and issues of the GDPR to be improved with this review. Moving forward, the priorities to address revolve around the practical implementation of GDPR principles. Innovation and emerging technologies stand out as key concerns of our members, with a need to strike a balance between data protection compliance and fostering innovation. Business suffers from potential obstacles that the GDPR may unintentionally create based on a lack of understanding of a specific market sector and an incomplete or one-sided balancing of relevant interests and fundamental rights. This situation blocks innovation, delays product developments, and creates an Ref.
…interests and fundamental rights. This situation blocks innovation, delays product developments, and creates an Ref. Ares(2024)956221 - 08/02/2024 2 immense bureaucratic overhead for businesses. Improvement can be reached by considering the role of the EDPB and the impact of its guidelines on the European industry. Ensuring consistency in applying the risk-based approach and proportionality principles, especially in international data transfers and data breaches, is essential. Improving transparency, communication, and simplifying data processing for corporate groups are avenues to explore for refining the GDPR's practical implementation. This can be achieved by a much stronger and earlier involvement of all relevant stakeholders when guidelines are intended to be developed to achieve a more balanced and society-wide accepted interpretation of GDPR.
…guidelines are intended to be developed to achieve a more balanced and society-wide accepted interpretation of GDPR. Concerns regarding a perceived zero-risk policy and inconsistent recommendations by some DPAs and the EDPB further highlight the need to align approaches with GDPR principles. Specific concerns were expressed about certain national DPAs potentially exceeding their powers under the GDPR. This poses a risk to the balanced approach supporting innovation and economic growth in Europe. While the GDPR grants national authorities oversight, investigative, corrective, advisory, and enforcement powers, some interpret it expansively, going beyond EU legislators' intent. Such quasi- legislative actions without safeguards threaten to fragment GDPR interpretation, harming businesses and consumers across Europe.
…actions without safeguards threaten to fragment GDPR interpretation, harming businesses and consumers across Europe. Bitkom urges the European Commission to clearly define national authorities' powers, ensuring discretion within a risk-based framework that protects privacy and supports innovation, avoiding unnecessary restrictions or lack of EU-wide consistency. Bitkom members expressed additional concerns, emphasizing the importance of scrutinizing tools for international data transfers in accordance with the GDPR. These concerns encompass identified deficiencies that must be rectified to enable European companies to trust these tools without facing excessive compliance challenges. Some members also pointed out limitations on sharing customer data among pertinent group entities, causing frustration with customer expectations.
…limitations on sharing customer data among pertinent group entities, causing frustration with customer expectations. To address these issues and align the tools with GDPR objectives, a comprehensive evaluation and potential enhancements are recommended, aiming to facilitate seamless cross-border data flows. Additionally, the pivotal role of anonymization in balancing privacy and the use of data for artificial intelligence is emphasized. Practical guidelines for standardized anonymization methods, privileges for processing pseudonymized data, and the exclusion of the process of rendering data anonymous as processing under Art. 4 Subsection 2 GDPR are considered essential solutions. Additional challenges persist in the coexistence of outdated sector-specific rules like the old ePrivacy Directive alongside GDPR.
…challenges persist in the coexistence of outdated sector-specific rules like the old ePrivacy Directive alongside GDPR. While GDPR provides a technology-neutral, risk-based framework, concerns exist about the comprehensive scope of the ePrivacy Regulation covering processing subject to the outdated ePrivacy Directive. Members suggest withdrawing the 2017 ePrivacy draft and repealing the ePrivacy Directive to align regulations more effectively and eliminate the need for sector-specific rules. Perspectives on Articles 82 and 83 of the GDPR are also crucial, advocating for the establishment of a clear threshold for non-material damage in individual and collective redress claims and a clear framework in the calculation of administrative fines.
…damage in individual and collective redress claims and a clear framework in the calculation of administrative fines. Common and clear standards are sought to ensure proportional sanctions, consistency with GDPR concepts among all members states, and avoidance of incentivizing investigations 3 based on turnover. A risk-based approach aligned with GDPR objectives would be emphasized and different fines for identical delinquency could be avoided. Our assessment of the GDPR's application in the following questionnaire reveals a multifaceted landscape. While there is a consensus on the need for ongoing evaluation and improvement, the specific nuances of concerns and proposed solutions highlight the complexity of the data protection landscape in Europe.
…nuances of concerns and proposed solutions highlight the complexity of the data protection landscape in Europe. Addressing these priority issues will contribute to the continued effectiveness of the GDPR in balancing data protection and technological innovation. 2. Exercise of data subject rights a. From the individuals’ perspective: please provide information on the exercise of the data subject rights listed below, including on possible challenges (e.g. delays in controllers/processors reply, clarity of information, procedures for exercise of rights, restrictions on the basis of legislative measures, etc.). From the controllers and processors’ perspective: please provide information on the compliance with the data subject rights listed below, including on possible challenges (e.g.
…provide information on the compliance with the data subject rights listed below, including on possible challenges (e.g. manifestly unfounded or excessive requests, difficulty meeting deadlines, identification of data subjects, etc.). -Information obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) -Access to data (Article 15) -Rectification (Article 16) -Erasure (Article 17) -Data portability (Article 20) -Right to object (Article 21) -Meaningful explanation and human intervention in automated decision making (Article 22) Where possible please provide a quantification and information on the evolution of the exercise of these rights since the entry into application of the GDPR.
…and information on the evolution of the exercise of these rights since the entry into application of the GDPR. Talking from the perspective of our membership as controllers and processors, we underscore a prevalent issue concerning insufficient awareness among data subjects regarding the nuanced limitations of data protection rights outlined in the GDPR. These rights, far from being absolute, are intricately balanced against the rights of others. There's a noted misuse of GDPR rights, detached from their intended context of 4 safeguarding fundamental rights. Instead, they are wielded for general complaints about products or services, divorcing them from a clear connection to the processing of personal data. In addition to that, very often the right of access is exercised in an abusive manner by the data subject.
98 → 12
Position Paper Seite 1 von 8 bitkom.org Berlin, 3 April 2023 Bitkom e.V. Nils Britze Head of Business Process Automation P +49 30 27576-201 [email protected] Charleen Roloff Policy Officer Legal Tech & Law P +49 30 27576-199 [email protected] Albrechtstrasse 10 10117 Berlin Germany President Achim Berg CEO Dr. Bernhard Rohleder VAT in the Digital Age 3 April 2023 EU-Initiative “VAT in the Digital Age” The European Commission proposed its VAT in the Digital Age package, consisting of three elements: modernising VAT reporting obligations, updating VAT rules for the platform economy, and improving and expanding the single VAT registration for businesses through the VAT One Stop Shop. Its main goal is to modernize the EU’s Value Added Tax (VAT) system, make it work better for businesses and more resilient to fraud by embracing and promoting digitalization.
(VAT) system, make it work better for businesses and more resilient to fraud by embracing and promoting digitalization. This EU-Initiative is of high importance for Bitkom and we welcome the opportunity to express our views on the proposal. We recognize that VAT has become an increasingly important source of revenue for EU Member States and is also an important EU own resource. The current EU VAT system is very complex and above all varies highly in the different EU Member States. Furthermore, the current VAT system still does not meet the needs of the age of digitization. Therefore, Bitkom appreciates any initiative by the European Commission to simplify the current VAT system and to adapt the VAT system to the digital age. We are grateful for the opportunity to contribute to the initiative. In short, we support the introduction of real-time digital reporting for VAT purposes.
…to contribute to the initiative. In short, we support the introduction of real-time digital reporting for VAT purposes. However, we also recommend the promotion of interoperability and standardization. In addition, the scope of reporting and deadlines should be critically reviewed. Furthermore, the potential of e-invoicing to reduce administrative burdens and stimulate economic growth in Europe should be enhanced. In principle, we support the Commission's approach to adapting the VAT system to the platform economy. However, both the implementation effort and the significant costs for platforms to collect the necessary data should be considered. We strongly support the transfer module introduced in the Single VAT ID workstream to report the cross-border transfer of own goods and the extension of the IOSS system to domestic B2C sales.
…workstream to report the cross-border transfer of own goods and the extension of the IOSS system to domestic B2C sales. We also welcome the EU harmonized reverse charge mechanism for domestic B2B sales. These three elements taken together will hugely simplify VAT registration obligations for businesses storing inventory cross border and selling from remote storage hubs. Ref. Ares(2023)2396812 - 03/04/2023 Seite 2 von 8 bitkom.org However, as part of long-term reforms, a solution should be found for the types of transactions excluded from the OSS. Part 1 – Digital Reporting Requirements (DRR) Bitkom supports the initiative to digitalize tax reporting in Europe. The proposal adds important elements that will contribute to this goal.
…to digitalize tax reporting in Europe. The proposal adds important elements that will contribute to this goal. We welcome the use of the existing European standard EN 16931 as a basis for the domestic introduction of e- invoicing by Member States as an important step forward. It is also the right signal to remove the need for Member States to apply for an exemption to introduce e- invoicing. We support the idea of a decentralized approach and hope that the initiative will lead to further process digitization in public and private organizations.
…approach and hope that the initiative will lead to further process digitization in public and private organizations. However, we see room for improvement in the following areas: Advancing interoperability and standardization Although we support the idea of creating a tax reporting approach from 2028 that is compatible with the specifications of all European Union member states, we believe that the proposals must go much further to achieve sufficient levels of harmonization to make a significant difference to EU businesses, in particular by seeking to harmonize not only the invoice structure, but also the transmission protocols and technical specifications for the actual transmission of the invoices to Member State e- invoicing platforms, including any invoice validations and authenticity requirements.
…the invoices to Member State e- invoicing platforms, including any invoice validations and authenticity requirements. Existing international standards and methods should be considered for this purpose, including those associated with the PEPPOL network. Doing so would vastly simplify implementation for businesses and Member States, reduce costs and ensure compliance, while not doing so will be prohibitive for some businesses, thus exacerbating administrative borders within the Single Market. Lead-time in relation to Member State’s domestic regimes While we appreciate that Member States wish to be free to implement domestic e- invoicing at their own discretion, without needing to seek a derogation from the Commission, we foresee a risk that some Member States could seek to rush e-invoicing mandates into place without appropriate lead-time or consultation with stakeholders.
…could seek to rush e-invoicing mandates into place without appropriate lead-time or consultation with stakeholders. This is a grave risk to business continuity given the fundamental role that invoices play in every day commercial operations. It is vital that all parties (businesses, e-invoice service providers and Member States) have enough time to prepare for new e-invoicing rules. We therefore call on the Commission to add guardrails to the proposed legislation that mandate a period of lead time prior to imposition of new domestic e- Seite 3 von 8 bitkom.org invoicing mandates, ideally specifying a minimum period of at least 12 months from the date of release of legislation and technical guidance.
…specifying a minimum period of at least 12 months from the date of release of legislation and technical guidance. Evaluating reporting scope and deadlines The standardization of the content of invoices is generally welcomed, but some of the details, such as the quantity and nature of goods or services or the price per article could reveal confidential data, thus undermining the principle of data minimization. In certain business scenarios providing the actual and final IBAN and payment terms on an invoice is a disproportionate obstacle. In some cases, invoices are offset against other business transactions. For compliance reasons, the IBAN is sometimes taken from the creditor master data and not from the invoice. According to the dual control principle, invoice verification and creation of creditor master data must be performed by different team members within a company.
…invoice verification and creation of creditor master data must be performed by different team members within a company. Moreover, the 2-day deadlines for preparing and sending invoices (Art 222) seem unreasonably short, especially in the absence of efficient systems to support automation, which is the case for SMEs, i.e., it is likely that this timeline will not be achievable in many cases. Italy for example, where e-invoicing has already been introduced, has a 12-day deadline for reporting invoices. For the reporting of sales invoices, a 2-day reporting period seems reasonable for the issuer. However, in the case of EU cross-border purchase invoices, the invoice- verification will regularly take longer than 2 days. This could therefore lead to many correction reports. In France foreign purchase invoices need to be reported within 10 to 20 days. According to Art.
…reports. In France foreign purchase invoices need to be reported within 10 to 20 days. According to Art. 263 the buyer must fulfill his tax-reporting obligation after two days even if the seller did not send out any invoice. Currently, such a comparable audit plan exists only at the end of the year to make provisions for outstanding invoices. It seems disproportionate to require this every other day. As a trade of for the real-time tax reporting the archiving period should be limited on an EU-Level to 5 years maximum instead of current period of 10 years. Collective invoicing should also remain possible, the removal of this possibility will cause disruption for many businesses, impacting on established commercial practices and driving up costs for businesses who will have to issue and ingest many more invoices per day.
…commercial practices and driving up costs for businesses who will have to issue and ingest many more invoices per day. The reasoning for this requirement from an anti-fraud perspective are unclear and should be revisited with appropriate business input. Advocate for e-invoicing to drive economic growth The system needs to bring advantages to public authorities and private organizations of all sizes. The implementation of digital reporting requirements should be accompanied by measures that reduce costs and administrative burden for businesses and create scale effects from electronic invoicing. For example, pre-filled VAT returns Seite 4 von 8 bitkom.org could help small and medium-sized enterprises. The advantages of electronic invoice exchange should be proactively communicated through a communication campaign, as one-sided reporting obligations could be perceived as a burden.
31 → 12
Titel 1 Eine Überschrift die über mehrere Zeilen laufen kann Eine Unterzeile, die ebenfalls über mehrere Zeilen verlaufen kann Bitkom on the Reform of the Unions Customs Code Ref. Ares(2023)7440208 - 01/11/2023 Bitkom on the Refrom of the Unions Customs Code 2 At a glance A uniform and digital Customs Union Initial position The reform of the Union Customs Code (UCC) is intended to make the heart of the EU, the Customs Union, fit for the future. It aims to create one digital customs system and to enable a uniform interpretation and implementation of European customs regulations. Bitkom rating Goes in the right direction: We welcome the reform of the Customs Union as it has the potential to deliver a more efficient, secure, and business-friendly Customs Union.
…of the Customs Union as it has the potential to deliver a more efficient, secure, and business-friendly Customs Union. However, this will require a common interpretation of the UCC by Member States and the actual implementation of various proposed improved customs mechanisms. The most important Creating an Attractive Trust & Checked Trader: Any benefits of this mechanism must be available to businesses from the outset to justify the burden placed on them. Furthermore, access to real-time data should be limited to customs data only. Securing the Customs Data Hub: We stress that data security needs to be at the heart of any process and that access to stored data needs to be limited and transparent to companies. A Powerful Customs Authority: The foreseen EU Customs Authority should not only advise national customs authorities on the customs code.
Authority: The foreseen EU Customs Authority should not only advise national customs authorities on the customs code. It should also work as mediator between businesses and national authorities in case of conflict and monitor the uniform interpretation of the UCC. Consulting with Business: The implementation of the new UCC will take more than a decade. To reduces delay and allow for a seamless transition we recommend close consultation with businesses through all steps of the implementation. Bitkom on the Refrom of the Unions Customs Code 3 For a modern and digital Customs Union A modern and efficient Customs Union is a vital corner stone of the European Union. It protects the European Economy from threats like unfair competition or counterfeit goods and enables the ever-growing trade flows of our globalized economy.
…like unfair competition or counterfeit goods and enables the ever-growing trade flows of our globalized economy. At the same time EU legislation, like the Carbon Border Adjustment Mechanism (CBAM), continues to set very ambitious standards in various policy areas and commonly impacts customs procedures. These trends are exacerbated by the current geopolitical shifts that once again highlighted how fragile supply chains can be. To manage these trends and still enable a competitive European economy, we need to take the Customs Union to the next level. To ensure the success of the reformed UCC, it should be focused on digitalization and acknowledge the rapid evolution of technology. The proposal should incorporate the most up-to-date technology and possess the necessary flexibility to adapt to the swift pace of technological advancements.
…up-to-date technology and possess the necessary flexibility to adapt to the swift pace of technological advancements. Yet the UCC proposal focuses on the use of technology mainly as a means to control risk (e.g. Article 21), but not as a means to facilitate and simplify trade. This should be changed, and it could, for instance, be achieved by giving customs authorities the option to supervise various processes (like requirements for self-assessments) via AI- solutions and generally make the legislation flexible to adopt new technological solutions. A secure EU Customs Data Hub The UCC reform proposal includes the establishment of an EU Customs Data Hub, which will serve as the central interface behind the Customs Union.
…the establishment of an EU Customs Data Hub, which will serve as the central interface behind the Customs Union. The Customs Data Hub will gather, process, link, and store all pertinent customs data, transforming the approach to information provision, customs oversight, and collaboration with partner authorities. Bitkom welcomes the creation of the EU Customs Data Hub and supports the Commission’s goal to ensure integrated data collation and sharing between customs authorities; such centralized databases and data management are key to ensuring pan-European risk assessment. Digitalization plays a vital role in streamlining customs procedures and minimizing bureaucratic hurdles, benefiting both companies and customs authorities. This is particularly significant considering the growing workload faced by customs authorities.
…authorities. This is particularly significant considering the growing workload faced by customs authorities. Providing customs authorities with “a wide range of advanced data analytics, also including through the use of artificial intelligence” which “should be an enabler for risk analysis, economic analysis, and predictive analysis to anticipate possible risks with consignments coming to or moving from the Union” (Recital 20) will clearly allow them to operate more effectively and target scarce resources on safeguarding the EU market from counterfeits and other illegal goods. Additionally, the hub offers the opportunity of truly interoperable customs systems of the member states and implementing many of the promised efficiency gains of the Bitkom on the Refrom of the Unions Customs Code 4 last UCC reform.
…many of the promised efficiency gains of the Bitkom on the Refrom of the Unions Customs Code 4 last UCC reform. The EU Customs Data Hub (Title III) should help to prevent the anomalies and lack of transparency caused by the maintenance of unconnected, individual national databases, as well as the duplication both in terms of management and updating such disparate systems. We hope that in rolling out this mandatory system due attention will be paid not only to facilitating its interoperability with EU systems, e.g. IPEP, as outlined in Recital 20, but also relevant non-EU databases such as the WCO’s CENCOMM.
…with EU systems, e.g. IPEP, as outlined in Recital 20, but also relevant non-EU databases such as the WCO’s CENCOMM. Union-level risk management activities (Recital 32, Title IV, Chapter 3 and Articles 81 and 97), with common risk analysis, Union control recommendations to customs authorities and instructions that goods destined for the Union may not be loaded or transported are all very positive developments. Whilst we call for ambitious timelines, they should allow sufficient lead time for businesses who can only start preparing once the legislation and all implementing guidelines are adopted. We call for regular business consultation and pilot testing as key mechanisms to ensure successful implementation. The Customs Data Hub should be fully operational by 2032. Furthermore, Bitkom recommends three changes regarding the governance of the data hub.
…fully operational by 2032. Furthermore, Bitkom recommends three changes regarding the governance of the data hub. Firstly, the access to the data hub should be strictly limited. Article 31 outlines the authorities eligible for accessing the EU Customs Data Hub. However, granting access to the Data Hub increases the likelihood of security breaches. Access to the EU Customs Data Hub, beyond the specifications of Article 31, should be strictly limited. Secondly, it is currently possible for the Commission to extend the functionalities of the Data Hub without considering the opinion of the European Parliament. Given the sensitive nature of the data stored in the hub, any change to the functionalities and change of access rights to the data should only be possible with the consent of the European Parliament.
…and change of access rights to the data should only be possible with the consent of the European Parliament. Thirdly, Article 34 specifies very dispersed responsibilities regarding personal data stored on the hub. To allow for an easier and faster administration of data (e.g. in cases where data needs to be altered or deleted) we recommend to streamline responsibilities and include less actors in the decision making process. Close collaboration with economic operators is crucial for the development and implementation of digital solutions at both EU and national levels. To bring about tangible simplifications for business in the Customs area the Commission should develop the hub in close collaboration with business. Given the importance of the data hub, there should be a separate consultation on the EU Customs Data Platform to meet the needs of traders.
…of the data hub, there should be a separate consultation on the EU Customs Data Platform to meet the needs of traders. The definition of “economic operators” who “should be able to submit to or make available in [the Data Hub] all relevant data required to fulfil customs legislation” (Recital 23) should include right holders’ data pertinent to IPR. In the latter regard, we welcome the clarity provided in Article 38 that “customs authorities and economic operators may exchange any information not specifically required under the customs legislation, in particular for the purpose of mutual cooperation in the identification and counteraction of risk.” Similarly, references to access to the data by other EU Law Enforcement Authorities (Recitals 24-26, Article 31) should include the latter’s ability to submit relevant data.
30 → 12
Position Paper page 1 / 7 Rebekka Weiß, LL.M. Head of Trust & Security T +49 30 27576-161 [email protected] Albrechtstraße 10 10117 Berlin Bitkom Position Paper on the EU Consultation “Further specifying procedural rules relating to the enforcement of the General Data Protection Regulation” 24. February 2023 Summary The European Commission (EC) recently launched a public consultation on the enforcement of the General Data Protection Regulation (GDPR) and started its initiative to further procedural rules relating to the enforcement of the GDPR. This initiative is aimed at streamlining cooperation between national data protection authorities when enforcing the GDPR in cross-border cases. To this end, it is supposed to harmonize some aspects of the administrative procedure the national data protection authorities (DPAs) apply in cross-border cases.
…aspects of the administrative procedure the national data protection authorities (DPAs) apply in cross-border cases. The initiative and procedural changes are aiming at supporting a smooth functioning of the GDPR cooperation and dispute resolution mechanism. Bitkom is thankful for the opportunity to contribute to the consultation and welcomes future occasions to offer its expertise in open discussions. We welcome the EC’s initiative intended to streamline cooperation between DPAs when enforcing the GDPR in cross-border cases, and to harmonize certain procedural aspects applied by DPAs in cross-border cases. We view this an opportunity for a broader conversation on how to improve GDPR enforcement.
DPAs in cross-border cases. We view this an opportunity for a broader conversation on how to improve GDPR enforcement. We believe that the following points could have a significant positive impact in how fundamental privacy rights of Europeans are preserved while ensuring legal certainty: In our view, it is overdue for the EC to address the fact that the consistency mechanism does not function sufficiently in practice. It should have already done so - also due to the "voices" from the EDPB - in the context of the evaluation of the GDPR. Ref. Ares(2023)2158950 - 24/03/2023 page 2 / 7 Some cases have been taken years until consensus is reached and referrals from other authorities (e.g. the Federal Cartel Office) are making the regulatory landscape even more complex.
…from other authorities (e.g. the Federal Cartel Office) are making the regulatory landscape even more complex. The current enforcement practice and missing harmonization results in competitive disadvantages for companies located in those EU member states where data protection infringements are enforced on the basis of a more restrictive interpretation of the rules. Coherence and harmonization on the basis of a progressive, innovation-friendly and data-use-friendly interpretation of the GDPR rules in line with new Regulation (e.g. the EU Data Act) should therefore be the main priority for the current review. To streamline the opinions of the national DPAs, the EDPB should establish more dialogue between the DPAs, especially when it comes to highly complex cases – while at the same time maintaining confidentiality of the proceedings.
…when it comes to highly complex cases – while at the same time maintaining confidentiality of the proceedings. This would also lead to the much needed acceleration of proceedings. However, strict deadlines should not be implemented as cases can be very complex in practice and due process needs to be maintained. The right to be heard for the respondents and a constructive regulatory dialogue needs to be established for all proceedings. Harmonized interpretation (and therefore enforcement) is especially needed in the context of special categories of data where the lack of harmonization and a very restrictive understanding has led to serious disadvantages in some countries. In the interest of a functioning internal market, technological advancements, much needed research (esp.
…countries. In the interest of a functioning internal market, technological advancements, much needed research (esp. when it comes to health data) and the goal of the EC to support Data Spaces, DPAs, regulators and Industry need to find a new approach for consensus and dialogue to advance the Data Economy while preserving fundamental rights. And while we consider that improving cooperation between national DPAs when enforcing GDPR in cross-border cases is essential to ensure a harmonized and thus efficient and effective enforcement, we would like to also draw the attention of the EC to the importance of considering other dimensions of the GDPR enforcement mechanism in addition to Article 63 GDPR. Right to be heard We support proposals that give increased power to the respondent to be heard during proceedings.
Right to be heard We support proposals that give increased power to the respondent to be heard during proceedings. The right to be heard in the context of a DPA’s investigation varies depending on Member States’ national rules. In some Member States, the parties under investigation can only make submissions on factual points. We submit that to give full effect to the right to be heard enshrined in Article 41 of the Charter of Fundamental Rights of the EU, it is necessary that this right covers both the factual page 3 / 7 and legal elements raised in the investigation and provides parties with the opportunity to make written and/or oral submissions, as appropriate. Current procedural rules in certain Member States allow parties under investigation to make submissions to the lead DPA before its draft position is finalized.
States allow parties under investigation to make submissions to the lead DPA before its draft position is finalized. This right should be extended to include the EDPB in cross-border cases, when disputes are being resolved between different concerned DPAs’ relevant and reasoned objections and when the cooperation mechanism has been triggered. The EDPB should not adopt a position, often entirely different from that of the lead DPA, without any representations by the relevant parties. The EDPB should therefore grant the party under investigation a right to be heard in writing and orally and an opportunity to respond to the positions the EDPB intends to adopt in the procedure leading to its binding decision.
…an opportunity to respond to the positions the EDPB intends to adopt in the procedure leading to its binding decision. This requires that the EDPB proactively discloses the material in its files (facts, legal characterisation of those facts, and evidence on which the EDPB relies), together with its preliminary position, to the party under investigation. The right to be heard by the EDPB must also apply to both the legal characterization of the facts by the EDPB and the legal positions the EDPB intends to adopt. In addition, an oral hearing is necessary because EDPB decisions can lead to significant administrative fines and/or significant detrimental effects on the position or activities of the party under investigation.
…fines and/or significant detrimental effects on the position or activities of the party under investigation. An oral hearing would allow the party under investigation to eliminate possible uncertainties and inaccuracies with respect to the facts and to address any concerns raised by the EDPB in respect of the legal position adopted by the party under investigation. We believe, therefore, that the harmonization of rules on the right to be heard before DPAs would be ineffective if it were not complemented by a systematic right to be heard before the EDPB. Procedural deadlines Bitkom understands that there is an ongoing discussion about whether the absence of deadlines in the GDPR causes delays and/or disparity in the finalization of cases.
…about whether the absence of deadlines in the GDPR causes delays and/or disparity in the finalization of cases. However, the introduction of fixed deadlines can be counterproductive if they do not take into account the current workload of DPAs, the need for flexibility and the specificity and complexity of each case. The length of time required to complete procedural steps depends, in our experience, on the specific subject matter of the inquiry in question. Fixed deadlines will most page 4 / 7 likely be to the detriment of the party under investigation and undermine the fair, properly reasoned, efficient, and consistent application of the GDPR. Prescribing deadlines with no flexibility or allowance for a case-by-case analysis also risks undermining a respondent’s right to fair procedures and the DPAs’ obligation to exercise their powers with regard to due process (Article 58(4) GDPR).
…to fair procedures and the DPAs’ obligation to exercise their powers with regard to due process (Article 58(4) GDPR). Fixed deadlines would also force the DPAs to take action regardless of what other tasks need to be considered. The current DPA practice often shows that there is too little available time and staff to properly advise controllers/processors on how data protection compliance can be achieved, innovative projects can be set up properly and technology can be used in a data protection friendly way. Seeing the current dynamic in the regulatory framework and technological advancements, especially SMEs will be even more dependent on support from the DPAs throughout the EU. Fixed deadlines will only limit the flexibility for advisory activities even more.
25 → 12
Titel 1 Eine Überschrift die über mehrere Zeilen laufen kann Eine Unterzeile, die ebenfalls über mehrere Zeilen verlaufen kann Proposal for a Regulation for additional procedural rules for GDPR enforcement Ref. Ares(2023)5990079 - 04/09/2023 Bitkom Position Paper GDPR Enforcement Rules & Procedures 2 At a glance Regulation for additional procedural rules for GDPR enforcement Status quo Following a public consultation in January 2023, the EU Commission (EC) has published its proposal for a Regulation for additional procedural rules for GDPR enforcement in July 2023. Bitkom evaluation We welcome the proposal and its intention to streamline cooperation between DPAs when enforcing the GDPR in cross-border cases, and to harmonize certain procedural aspects applied by Data Protection Authorities (DPAs).
GDPR in cross-border cases, and to harmonize certain procedural aspects applied by Data Protection Authorities (DPAs). We also view this process as an opportunity for a broader conversation on how to improve harmonization. In our view, it is overdue for the EC to address the fact there is not yet enough harmonization when it comes to GDPR interpretation. The current enforcement practice and missing harmonization results in competitive disadvantages for companies located in EU member states where data protection infringements are enforced on a more restrictive interpretation of the rules. Key Aspects Establishing more dialogue, making a push for more harmonization and legal certainty The GDPR is a complex legal instrument with a very broad scope, covering all European companies as well as international providers.
…a complex legal instrument with a very broad scope, covering all European companies as well as international providers. To streamline interpretation and opinions while taking regulatory changes, technological advancements, and a myriad of court cases throughout the EU into account, the establishment of a structured dialogue with industry and technology experts is necessary. Regarding the proposal, maintaining confidentiality of proceedings, once cases are brought, is essential. On a procedural level, a swift completion is important. However, due to the varying complexity of the cases, deadlines should be implemented carefully and not on all stages of the procedure. The right to be heard for the respondents must be granted during all relevant phases. We welcome that the current Proposal includes such rights.
…the respondents must be granted during all relevant phases. We welcome that the current Proposal includes such rights. Bitkom number 60 percent of companies in Germany have already stopped plans for innovations or new technologies because of data protection rules or uncertainties about them (according to a study by Bitkom Research). 60% of companies in Germany have already stopped plans for innovations or new technologies because of data protection rules or uncertainties about them.
…already stopped plans for innovations or new technologies because of data protection rules or uncertainties about them. (according to a study by Bitkom Research) Bitkom Position Paper GDPR Enforcement Rules & Procedures 3 Content 1 General Remarks 4 2 Comments on Chapter III – Cooperation under Article 60 of the GDPR 6 Cooperation 6 3 Comments on Chapter IV – Access to the administrative file and treatment of confidential information 7 Article 20 – Access to the administrative file and use of documents 7 4 Comments on Chapter V – Dispute resolution 7 Dispute Resolution 7 5 Comments on Chapter VII – General and final provisions 8 General and final Provisions 8 Bitkom Position Paper GDPR Enforcement Rules & Procedures 4 1 General Remarks Bitkom is thankful for the opportunity to contribute to the consultation and welcomes future occasions to offer its expertise in open discussions.
…opportunity to contribute to the consultation and welcomes future occasions to offer its expertise in open discussions. We welcome the European Commission’s Proposal intended to streamline cooperation between Data Protection Authorities (DPA) when enforcing the GDPR, and to harmonize certain procedural aspects applied by DPAs in cross-border cases. We view this an opportunity for a broader conversation on how to improve harmonization of GDPR interpretation. We believe that the following points could have a significant positive impact in how fundamental privacy rights of Europeans are preserved while ensuring legal certainty: In our view, it is overdue to address the fact that interpretations of the GDPR have differed vastly in the EU and the consistency mechanism does not function sufficiently in practice.
…of the GDPR have differed vastly in the EU and the consistency mechanism does not function sufficiently in practice. Some cases have taken years until consensus is reached and referrals from other authorities (e.g. the Federal Cartel Office) are making the regulatory landscape even more complex. The current enforcement practice and missing harmonization results in competitive disadvantages for companies located in those EU member states where data protection infringements are enforced based on a more restrictive interpretation of the rules. Coherence and harmonization on the basis of a progressive, innovation-friendly and data-use-friendly interpretation of the GDPR rules in line with new Regulation (e.g. the EU Data Act) should therefore be a key priority for the broader GDPR review in 2024.
…line with new Regulation (e.g. the EU Data Act) should therefore be a key priority for the broader GDPR review in 2024. To stay competitive, the EU should make a comprehensive assessment of all data- related Regulation and take the need for advanced data processing (e.g. for AI training) into account. As stated above, companies are currently often put in a position where they must choose between the legal uncertainties and restrictions in Europe or the relocation of technology development to other regions of the world. To streamline the opinions of the national DPAs, the EDPB should establish more dialogue between the DPAs, especially when it comes to highly complex cases – while at the same time maintaining confidentiality of the proceedings. This would also lead to the much needed acceleration of proceedings.
…maintaining confidentiality of the proceedings. This would also lead to the much needed acceleration of proceedings. On a procedural level, deadlines for the interaction of the DPAs can facilitate the swift completion of the dispute resolution procedure and speed up the dialogue. However, due to the varying complexity of the cases deadlines should be implemented carefully and not on all stages of the procedure. The right to be heard for the respondents and a constructive regulatory dialogue needs to be established for all proceedings. Harmonized interpretation (and therefore enforcement) is especially needed in the context of special categories of data where the lack of harmonization and a very restrictive understanding in some EU countries has led to serious disadvantages.
…the lack of harmonization and a very restrictive understanding in some EU countries has led to serious disadvantages. In the interest of a functioning internal market, technological advancements, much needed Bitkom Position Paper GDPR Enforcement Rules & Procedures 5 research (esp. when it comes to health data) and the goal of the EC to support Data Spaces, DPAs, regulators and industry need to find a new approach for consensus and dialogue to advance the Data Economy while preserving fundamental rights. Improving cooperation between national DPAs when enforcing GDPR in cross-border cases is essential to ensure a harmonized and thus efficient and effective enforcement. New cooperation methods need to be found that will improve the exchange of opinions but not prolong the process or unduly burden the LSA and the other involved authorities.
…the exchange of opinions but not prolong the process or unduly burden the LSA and the other involved authorities. Furthermore, we would like to also draw the attention of the EC to the importance of considering other dimensions of the GDPR enforcement mechanism in addition to Article 63 GDPR. GDPR is in large parts a law that foresees an appropriate balance between informational self-determination and other fundamental rights. The interpretation in practice often leads to a difficult balancing process of data protection and other fundamental rights and societal concerns, which need to be sufficiently taken into account. This balancing of interests is not yet done in a harmonized way in the EU. In the absence of a fundamental rights balancing, innovation can be severely hampered and considerable global competitive disadvantages can arise for European companies.
…innovation can be severely hampered and considerable global competitive disadvantages can arise for European companies. The past years have shown societal disadvantages due to this lack of balancing of interests (e.g. ban of videoconferencing tools in the context of school closures during the pandemic). Both at national level and through the EDPB, it is paramount that the DPAs take other fundamental rights into account while paying attention to the general interest of society. Although legal action can be pursued, court cases are usually very time consuming and this time is lost for Europe in the development of technology. In the meantime, too many risks accumulate regarding fines and reputation.
25 → 12