ENEL SpA

ENEL SpA Position Paper on the roadmap of the GDPR evaluation The new Regulation is a key enabler for economic growth, job creation, innovation and scientific progress in Europe. Strict data protection rules are necessary to rebuild the trust of individuals in how their personal data is being used. We believe that the GDPR introduces many important improvements from the business perspective by unifying Europe's rules on data protection, creating new business opportunities and encouraging innovation. However Enel underline that more attention should be paid, to - At present GDPR is working fine, Enel does not believe it has to be modified but EDPB and the DPO’s community has to cooperate to best interprete and support homogeneous implementation of the GDPR in Europe.

…the DPO’s community has to cooperate to best interprete and support homogeneous implementation of the GDPR in Europe. That is why we look forward to establish a Permanent Group of Global DPO representing European companies with a European turnover (almost 30%) and a worldwide business presence. Collect their experience is essential. The Multistakeholder Expert Group does not take into account this. First, it was created before the GDPR (2017) came into action; second, it does not see the direct participation of DPO’s. The practical experience of DPO of large companies is useful to understand what is working of GDPR and what can be improved by soft regulation from EDPB; - Adequacy decisions must be subject to ongoing monitoring and periodic review, as required by Union law, which is essential to ensure adequate protection of the rights of the data subject.

…review, as required by Union law, which is essential to ensure adequate protection of the rights of the data subject. EU should engage more countries to make adequacy decisions and clarify UK situation. - The standard contractual clauses for data transfers to third countries developed under Directive 95/46/EC have not been updated in light of developments since they were originally adopted. - International intra-group data transfer, without prejudice to compliance with the competition and regulatory rules, has to be favoured by a fast track procedure approval of binding corporate rules. - The EDPB guidelines are welcomed, we encourage the Board to continue its work in preventing fragmentation, with more guidance of concrete guidelines in practice and implementation of the certification schemes.

…fragmentation, with more guidance of concrete guidelines in practice and implementation of the certification schemes. - Increase measures in order to encorauge the drafting of codes of conduct by sector stakeholders at European Level; GDPR impacts on European Data Strategy We consider appropriate to reinforce the position expressed in the paper “A European strategy for data”, Brussels, 19.2.2020 COM(2020) 66 final, in particular on these steps: “The European data space will give businesses in the EU the possibility to build on the scale of the Single market. Common European rules and efficient enforcement mechanisms should ensure that: Ref.

…on the scale of the Single market. Common European rules and efficient enforcement mechanisms should ensure that: Ref. Ares(2020)2299847 - 29/04/2020 - data can flow within the EU and across sectors; - European rules and values, in particular personal data protection, consumer protection legislation and competition law, are fully respected; - the rules for access to and use of data are fair, practical and clear, and there are clear and trustworthy data governance mechanisms in place; there is an open, but assertive approach to international data flows, based on European values. “ And again, we believe it’s crucial that “The functioning of the European data space will depend on the capacity of the EU to invest in next-generation technologies and infrastructures as well as in digital competences like data literacy.

EU to invest in next-generation technologies and infrastructures as well as in digital competences like data literacy. This in turn will increase Europe’s technological sovereignty in key enabling technologies and infrastructures for the data economy.” With this angle, we believe that the legislative framework for the governance of common European data spaces will determine what data can be used in what situations, facilitate cross-border data use, and prioritise interoperability requirements and standards within and across sectors. One of the pillars of the new data-driven ecosystems outlined by the new European Data Strategy is a Cross-sectoral governance framework aiming at creating necessary rules for a data-agile economy.

Data Strategy is a Cross-sectoral governance framework aiming at creating necessary rules for a data-agile economy. There will be the need for legislative action on issues that affect relations between actors in the data- agile economy to  foster business-to-government data sharing for the public interest  support business-to-business data sharing  seek to identify and address any undue existing hurdles hindering data sharing and to clarify rules for the responsible use of data (such as legal liability) The European data-spaces outlined by this strategy will be related to :  industrial manufacturing,  Green Deal,  mobility,  health,  financial,  energy,  agriculture,  public administration,  skills As stated in the definition of the strategy, the general principle shall be to facilitate voluntary data sharing, but, in specific circumstances, ‘access to data should be made…

…compulsory, where appropriate under fair, transparent, reasonable, proportionate and/or non-discriminatory conditions’. This new evolution will require a very clear definition of rules able to guarantee the right balance between individual privacy rights and general interests. We have also to take in account that, in a lot of ‘data-sets’, is almost impossible split personal data (under GDPR) from non-personal data. The current COVID crisis and the need of using personal data for monitoring purposes have even more accelerated the search for solutions to conciliate privacy rights with the use of data for the common good. These solutions must offer anonymization and pseudonymization techniques aiming at protecting the privacy rights of individual data subjects and allow organizations to balance this right to privacy against their legitimate goals.

…of individual data subjects and allow organizations to balance this right to privacy against their legitimate goals. As an example, in a toolbox recently released by European Commission for the use of technology and data to combat and exit from the COVID-19 crisis, concerning mobile applications, the use of anonymized mobility data is the only possible option. Moreover, rules for data retention and deletion of source data (specially in case of pseudonymized data) have to be aligned to GDPR. Data subjects must maintain the right to request details about their personal data which is held by an organization and to access their personal data. These solutions and the principles on which they are founded must be shared and consolidated not only in the European Single Market but also in other markets (like US) where some of the main digital providers are located.

…in the European Single Market but also in other markets (like US) where some of the main digital providers are located. This must become one of the issues to discuss in the continuous monitoring of the alignment between EU Data Protection laws and the Privacy Shield. The same must be done with data protection provisions of China’s Cybersecurity Law. The lack of these alignments can have strong impact on individual privacy rights and on business developments. ***

originalus šaltinis (PDF) ↗