DIGITALEUROPE

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 29 APRIL 2020 DIGITALEUROPE Feedback on the implementation of the GDPR Executive summary The General Data Protection Regulation (GDPR) was a global milestone for data protection and privacy rules, as it not only provided upgraded rights to consumers but also looked to harmonise the rules across Europe, with the aim of fostering the digital single market. In many respects, the GDPR achieved this goal. However, in view of the two-year review of the GDPR, we look at the areas where GDPR implementation can be improved, focusing in particular on the consistency mechanisms, harmonisation and data transfers.

…can be improved, focusing in particular on the consistency mechanisms, harmonisation and data transfers. As much as Member States have made great strides in ensuring consistency, there still remain overlaps that ultimately contradict one of the main objectives of the law – that of harmonising data protection rules across Europe. In addition, the data transfer mechanisms within the GDPR are critical to business growth, and it is imperative that they remain adaptable to an ever-changing data ecosystem. Ref. Ares(2020)2296560 - 29/04/2020 2 Table of Contents Executive summary ................................................................................. 1 Data transfers ........................................................................................... 3 Adequacy decisions ...............................................................................................

…3 Adequacy decisions ............................................................................................... 3 Standard contractual clauses (SCCs) ................................................................... 3 Binding corporate rules (BCRs) ............................................................................ 4 Codes of conduct and other certification mechanisms...................................... 5 EDPB guidance on appropriate safeguards......................................................... 5 Consistency and harmonisation............................................................. 6 Harmonisation in legislation and enforcement: strengthening the one-stop shop (OSS) ...............................................................................................................

(OSS) ............................................................................................................... 6 Differing interpretations ......................................................................................... 8 Uncertainties on applicability of Member State law and/or the GDPR .............. 8 Uncertainties on the interpretation of the GDPR and redundant wording ....... 9 3 Data transfers Adequacy decisions The European Commission has only put in place adequacy decisions for a limited number of countries,1 the last one for Japan in 2019.2 More countries have recently adopted or are in the process of adopting new data protection laws, providing in many instances a similar level of protection to the GDPR,3 and it is therefore worth considering adequacy decisions for such countries.

…similar level of protection to the GDPR,3 and it is therefore worth considering adequacy decisions for such countries. As for the UK, it will be important to make sure that commercial data flows are considered as much a priority as law enforcement and judicial cooperation. Greater legal clarity and a better understanding of the steps taken to ensure data flows across the UK and the EU are needed. The transition period after Brexit (until 31 December 2020) allows the UK to benefit from the continued application of the GDPR.

…period after Brexit (until 31 December 2020) allows the UK to benefit from the continued application of the GDPR. Transfers of UK personal data after the transition period will also likely still be possible under Privacy Shield.4 However, to reduce commercial risks associated with relying only on one mechanism, ideally the UK should get the status of an adequate country and the European Commission should be proactive in starting to work on such adequacy finding as soon as possible. Standard contractual clauses (SCCs) The European Commission (or DPAs in collaboration with the Commission) should update and provide new SCCs. The new SCCs should be built with a modular approach, which will make them suitable for different scenarios that are not only for commercial practices.

…a modular approach, which will make them suitable for different scenarios that are not only for commercial practices. New SCCs should be suitable for not only controller-to-controller transfers and controller-to-processor transfers but for transfers between processors and from EEA processors to non-EEA processors. An example would be a cloud provider that processes data on behalf of its customer.

…processors to non-EEA processors. An example would be a cloud provider that processes data on behalf of its customer. If the customer also offers processor services, for example to its 1 https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data- protection/adequacy-decisions_en 2 https://ec.europa.eu/commission/presscorner/detail/en/IP_19_421 3 See for example, Brazil’s Lei Geral de Proteção de Dados (adopted August 2018), http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm 4 https://www.privacyshield.gov/article?id=Privacy-Shield-and-the-UK-FAQs 4 affiliated companies, processor-to-processor SCCs would be appreciated, similar to the approach taken by the European Data Protection Board (EPDB).5 A ‘pre-populated’ Appendix 2, setting out the minimum standards or guidance as to the technical and organisational measures that are sufficient,…

…the minimum standards or guidance as to the technical and organisational measures that are sufficient, would be useful. Finally, for swifter execution, we would recommend that formats that are easier to execute be published, as this may ensure easier adoption and provide more flexibility for SMEs. For the sake of harmonisation and consistency, there should not be various versions and templates. Member States should be encouraged to adopt SCCs already published in the EDPB’s Register for Decisions, or at least use it as a template and adapt to the circumstances where necessary. Binding corporate rules (BCRs) The bar for the creation and implementation of BCRs is relatively high.

…where necessary. Binding corporate rules (BCRs) The bar for the creation and implementation of BCRs is relatively high. It would be useful if the requirements set forth in the DPAs’ Working Papers for BCRs could be interpreted by regulators in a more practicable manner, taking into account the needs and possibilities of the digital industry. For example, there are strict requirements for disclosures due to law enforcement requests, audit requirements, information duties in case of processor BCRs to controllers, which are not easy to fulfil and can in some instances not be fulfilled for practical or legal reasons.

…to controllers, which are not easy to fulfil and can in some instances not be fulfilled for practical or legal reasons. Furthermore, the process has become very demanding and long-lasting, with a current fine-year backlog, as besides the lead supervisory authority (SA) and the two co-reviewers, also all other DPAs concerned take part in the review of BCRs, which finally have to be approved by the EDPB as well. We would also like to raise that should the EU-US Privacy Shield and the SCCs be further challenged in court, the BCR mechanism might become the preferable venue to secure data transfers. Therefore, it is important to review and streamline the current process to make it more accessible.

…data transfers. Therefore, it is important to review and streamline the current process to make it more accessible. In addition, we support further progress in the recognition of BCRs as a certification mechanism – alongside other global schemes being considered for alignment with BCRs such as the APEC CBPRs – to allow organisations to efficiently manage international transfers and certifications globally. Finally, we would recommend that there be as much transparency with regard to the development of future BCRs, in particular with the development and discussions around formatting and procedures. This will prove critical as the 5 https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_opinion_201914_dk_scc_en.pdf 5 significance and importance of the BCR mechanism will likely become more prominent in the coming years.

33 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 4 January 2020 DIGITALEUROPE's initial views on the public consultation to inform the review of the requirements for packaging and other measures to prevent packaging waste Executive summary DIGITALEUROPE, the association representing the digital technology industry in Europe, welcomes the Commission's initiative to review the Directive 94/62/EC on Packaging and Packaging Waste and supports action to address the challenges of transitioning to a Circular Economy society. DIGITALEUROPE members believe that reducing packaging and packaging waste's environmental impacts must involve all stakeholders along the packaging lifecycle stages.

…and packaging waste's environmental impacts must involve all stakeholders along the packaging lifecycle stages. A risk management approach should be adopted, focusing on sectors that generate large volumes of waste packaging and use high-impact materials, with exemptions or de minimis rules for sectors with reduced packaging use and solutions with commonly recyclable and renewable materials. The needs of specific sectors must be considered when designing mandatory requirements (minimum content, maximum size, labelling requirements, etc.) to avoid a 'rule fits all' approach. DIGITALEUROPE is concerned that unintended environmental impacts that cancel or exceed the positive effects can arise from such an approach, resulting in regrettable material substitution and the necessity of a system to manage exceptions.

…an approach, resulting in regrettable material substitution and the necessity of a system to manage exceptions. As packaging requirements have an enormous impact on the free movement of goods both within and beyond the EU, it is of paramount importance for DIGITALEUROPE that harmonized regulatory measures are taken to promote the reduction of packaging waste to ensure the continued success of the EU internal market. Misalignments on any of the proposed measures as well as underlying Ref. Ares(2021)78446 - 05/01/2021 2 definitions and referenced standards among the Member States (e.g., reduction targets, plastic taxes, labelling requirements, 'recyclable' and 'reusable' definitions) can uneven the playing-field, increase regulatory complexity and operational burden of manufacturers, and can potentially jeopardize the expected results from the proposed measures.

…operational burden of manufacturers, and can potentially jeopardize the expected results from the proposed measures. Recommendations and rationales in responding to the consultation 1. Harmonization DIGITALEUROPE highlights its concern over the proposal for specific Green Public Procurement (GPP) criteria at National and Sub-national levels. Misaligned requirements among the EU Member States have been consistently pointed out as one of the main barriers for manufacturers within the single market. It will be nearly impossible for manufacturers to comply with multiple national and sub- national mandatory packaging requirements for GPP.

…for manufacturers to comply with multiple national and sub- national mandatory packaging requirements for GPP. 2. Packaging Design Principles Packaging has a crucial role in ensuring the protection, hygiene, safety and quality of products. Appropriate packaging helps to avoid waste generation as a result of product damage during logistic operations. As a trade-off between the benefits of packaging and the environmental impacts of packaging waste, DIGITALEUROPE highlights the urgency for a further impact assessment that evaluates the effects of technically prescriptive measures on companies' ability to innovate on packaging design and materials. It also calls for clarity on how the proposed measures support a holistic packaging lifecycle approach, including the positive impacts of preventing product spoilage, and including the carbon footprint of returning damaged products, to avoid…

…footprint of returning damaged products, to avoid unintended consequences and regrettable substitutions of materials. 3. Packaging Design Considerations DIGITALEUROPE believes that packaging design considerations must be conceived to support design flexibility in opposition to unbending requirements to achieve a true holistic lifecycle approach. A 'rule fits all' approach, limiting the size of product packaging, will inevitably lead to many exceptions due to different 3 requirements of products for protection, hygiene, safety and quality. In time, it would undermine the relevance of the measures proposed. Designing processes that support flexibility and champion innovation and technological developments are considered more favorable than technically prescriptive restrictions and targets on dimension and composition. It is rather crucial to remember that, especially when limited…

…information on packaging lifecycle assessments that demonstrate overall positive environmental impacts are available. 4. Recycled Content DIGITALEUROPE believes there is a need to strengthen the market for secondary raw materials. A focus should be given to developing an innovative, efficient, reliable and harmonized collection and recycling infrastructure across all EU Member States. In the meantime, the use of recycled content in packaging should be encouraged voluntarily, regardless of the materials' recycling chains' sophistication. The use of sustainably sourced materials should also be encouraged. We urge the Commission to clarify the definition of the term' recycled content' by including both post-consumer and post-industrial sources and linking it to internationally recognized sources. The proposal for a process to support assessing the potential inclusion of recycled content in…

Mandating a process would hence create an additional burden without necessarily adding an environmental benefit. 5. Packaging Dimension DIGITALEUROPE is concerned that mandatory requirements limiting the packaging size of products may have unintended environmental impacts that can cancel or exceed the positive impacts. We urge the Commission to involve all actors in the industry in the potential drafting of a definition of 'overpackaging' and further related criteria. To ensure the type of products being packaged, the product weight, the packaging material used as well as shipping conditions are all taken into account as influencing packaging's core functionality to protect the product. 4 DIGITALEUROPE Members strongly discourage the requirement for centrally managed reporting systems intended to reduce overpackaging. This would hamper innovation and increase the administrative burden…

…and increase the administrative burden to manufacturers with questionable positive benefits to packaging reduction. 6. Recyclable Packaging The efficient and robust recycling industry is of uttermost importance to support any mandatory requirements on recyclable content in packaging material. DIGITALEUROPE believes that focus should be given to developing an innovative, efficient, reliable and harmonized collection and recycling infrastructure across all EU Member States. In the meantime, the recyclability requirement for all packaging should be encouraged voluntarily, regardless of the sophistication of the materials' recycling chains. The use of sustainably sourced materials should also be encouraged. DIGITALEUROPE welcomes the Commission's intention to define the term 'recyclability'. However, the information provided in the Public consultation doesn't offer a comprehensive…

…depending on local recycling infrastructure, making pan-European decisions on recyclable materials difficult. 7. Reusable packaging DIGITALEUROPE believes that reusable packaging may contribute to reducing the environmental impact of packaging for certain sectors, but it may not be the best or only solution for electronics. Electronics packaging is specific to each product to ensure adequate protection. Therefore, reuse of packaging is limited without shipping packaging long distances. Reusable packaging may contribute to reducing environmental impact for logistics scenarios, but this also may not be the best or only solution. Mandatory requirements across all sectors for reusable packaging should be avoided unless packaging lifecycle assessments prove beneficial. DIGITALEUROPE would welcome a clear definition of the term 'reusability' for packaging materials and support the initiative…

…limitation in the recyclability of packaging materials already reused several cycles, etc.

…and the physical/chemical limitation in the recyclability of packaging materials already reused several cycles, etc. 8. Labelling requirements The broad benefits of mandatory labelling for 'recyclable', 'reusable', 'compostable' and 'non-recyclable' packaging materials are only perceived as beneficial by DIGITALEUROPE members if the requirements are harmonized and equally implemented across the Member States, and preferably following internationally definitions and markings. National marking requirements can severely impede the single market's integrity, increase the administrative burden and operational costs and undermine the circularity of products and secondary materials across the Member States.

16 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 37, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 8 FEBRUARY 2024 The GDPR six years in: from harmonisation to alignment Executive summary Six years into the implementation of the General Data Protection Regulation (GDPR),1 Europe’s digital legal landscape has undergone significant transformations. From evolving case law from the EU’s Court of Justice (CJEU) to the completely new pieces of legislation stemming from the AI Act and the European data strategy, Europe’s regulatory environment has become much more complex.2 Our vision for Europe in 2030 underscores the emergence of potential internal market barriers and a fresh challenge to the unified European data market due to recent data regulations.

…internal market barriers and a fresh challenge to the unified European data market due to recent data regulations. It urges the European Commission to prioritise the implementation of the existing data strategy rather than introducing additional regulations.3 In 2020 we identified opportunities for harmonisation.4 As the GDPR now undergoes a second review, new challenges have arisen, particularly with the introduction of additional digital rules. The AI Act, the Data Act and other parts of the data strategy will all significantly impact organisations’ data processing operations, often conflating personal and non-personal data. The impact of these new laws is yet to be determined, but the potential for overlaps and erratic enforcement is real. We have already sounded the alarm regarding the 1 Regulation (EU) 2016/679. 2 COM(2021) 206 final.

…is real. We have already sounded the alarm regarding the 1 Regulation (EU) 2016/679. 2 COM(2021) 206 final. The European data strategy comprises several new regulations adopted or proposed during the current Commission mandate. These include, most importantly, the Data Act (Regulation (EU) 2023/2854), the Data Governance Act (Regulation (EU) 2022/868) and the proposed European Health Data Space (EHDS) (COM(2022) 197/2). 3 See Europe 2030: A digital powerhouse, available at https://cdn.digitaleurope.org/uploads/2023/11/DIGITAL-EUROPE-MANIFESTO-2024- FULL.pdf. 4 See Two years of GDPR: A report from the digital industry, available at https://cdn.digitaleurope.org/uploads/2020/06/DIGITALEUROPE_Two-years-of-GDPR_A- report-from-the-digital-industry.pdf. Ref. Ares(2024)974102 - 08/02/2024 2 potential negative impact on data flows,5 but these issues permeate other aspects of data processing.

- 08/02/2024 2 potential negative impact on data flows,5 but these issues permeate other aspects of data processing. Before the impact of these new regulations is clear, a reopening of the GDPR is premature. The current GDPR review should focus on addressing interpretation issues and fostering companies’ compliance: The review should highlight the need to prevent diverging interpretations and enforcement across legislation and Member States. It should aim to forecast and reconcile the responsibilities of data protection authorities (DPAs) and other competent authorities under new regulations like the AI and Data Acts. It should address areas of friction between the GDPR and new regulations, promoting collaboration between the Commission, competent authorities and industry stakeholders.

…and new regulations, promoting collaboration between the Commission, competent authorities and industry stakeholders. The European Data Protection Board (EDPB) should prioritise practical guidance to strengthen harmonisation, and to reduce compliance burden whenever the GDPR text allows. These include guidance on anonymisation and pseudonymisation, distinguishing personal from non-personal data, research and innovation in health and AI, tools to support SMEs, joint controllership, compensation thresholds for non- material damage, and tools for data subject rights compliance. Work should be pursued to enhance adequacy decisions and other data transfer tools.

…for data subject rights compliance. Work should be pursued to enhance adequacy decisions and other data transfer tools. This includes advancing work at a global level on mutual recognition of standard contractual clauses (SCCs), fostering more consistent recommendations from DPAs, facilitating binding corporate rules (BCRs), and the development of pan-European codes of conduct and certification. Industry needs a focused GDPR review that addresses interpretation challenges and promotes compliance for companies, strengthening Europe’s single market. It must prepare alignment with new regulations, promote practical guidance from the EDPB, secure international data transfers, and the full use of GDPR mechanisms.

…promote practical guidance from the EDPB, secure international data transfers, and the full use of GDPR mechanisms. The next review in 2028 will be better able to assess the impact of recently adopted data strategy legislation, ensuring a more comprehensive evaluation of the evolving digital landscape. 5 See Data transfers in the data strategy: Understanding myth and reality, available at https://cdn.digitaleurope.org/uploads/2022/06/DIGITALEUROPE_Data-transfers-in-the-data- strategy_Understanding-myth-and-reality.pdf. 3 Table of contents • Executive summary ...................................................................... 1 • Table of contents .......................................................................... 3 • Alignment with new regulations in the digital sector ................ 4 • Areas for practical guidance from the EDPB .............................

…in the digital sector ................ 4 • Areas for practical guidance from the EDPB ............................. 4 • Securing international data transfers ......................................... 5 • Full use of other GDPR mechanisms ......................................... 6 4 Alignment with new regulations in the digital sector The aspiration to establish a seamless flow of data within Europe faces a renewed challenge due to the influx of recent legislation overseeing data processing, frequently blurring the lines between personal and non-personal data. Despite their intent to enhance legal clarity, these new regulations compound the existing GDPR rules, potentially complicating data processing procedures for European companies.

…the existing GDPR rules, potentially complicating data processing procedures for European companies. The introduction of diverse sets of rules for identical processing operations poses a significant risk, as it may lead to conflicting interpretations and enforcement measures from various authorities. As the EDPB’s own contribution to the GDPR evaluation notes, the GDPR’s remit under new regulations remains unclear and lacks consistency.6 The comprehensive coverage of personal data by the Data Act and the creation of new enforcement authorities, along with the designation of potentially new competent authorities under the AI Act, underscore the urgency for a well- defined framework. The absence of effective cooperation mechanisms among these diverse laws and authorities heightens uncertainty for European companies.

…effective cooperation mechanisms among these diverse laws and authorities heightens uncertainty for European companies. The existing issue of divergent interpretations from various types of authorities has already posed challenges in Member States, a situation that should not be exacerbated.7 It is crucial for the upcoming GDPR review to comprehensively map out areas of friction between the GDPR and these new regulations. The European Commission and competent authorities should collaborate with industry to address the complexities arising from the coexistence of these regulatory frameworks. Areas for practical guidance from the EDPB The EDPB’s guidelines play a crucial role in supporting the practical implementation of the GDPR and establishing a standard for adherence across Member States.

…in supporting the practical implementation of the GDPR and establishing a standard for adherence across Member States. Despite this, there remain several areas where harmonisation and guidance from the EDPB are lacking, as highlighted in the 2020 report.8 Revised and more pragmatic guidelines on the concepts of personal data and anonymisation are pivotal for the successful application of the GDPR, especially in light of forthcoming legislation such as the Data Act. It is essential 6 P. 5, Contribution of the EDPB to the report on the application of the GDPR under Article 97, available at https://edpb.europa.eu/system/files/2023- 12/edpb_contributiongdprevaluation_20231212_en.pdf.

Article 97, available at https://edpb.europa.eu/system/files/2023- 12/edpb_contributiongdprevaluation_20231212_en.pdf. 7 For instance, Finland has seen different interpretations of the Payment Services Directive (Directive (EU) 2015/2366), the Anti-Money Laundering Directive (Directive (EU) 2015/849) and the Vehicle General Safety Regulation (Regulation (EU) 2019/2144). 8 COM(2020) 264 final. 5 that these guidelines strike a balance, offering realistic solutions without imposing additional requirements, staying true to both the spirit and explicit language of the GDPR. Moreover, the guidelines should cater to real-world situations, providing practical and balanced interpretations of the GDPR. This approach becomes particularly vital for smaller companies without extensive legal teams, enabling them to meet legal requirements effectively.

22 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 1 SEPTEMBER 2023 Squaring GDPR enforcement: stronger procedures for the one-stop shop Executive summary DIGITALEUROPE welcomes the proposed Regulation laying down additional procedural rules for the enforcement of the General Data Protection Regulation (GDPR).1 The proposal is an opportunity to reinforce the one-stop-shop (OSS) mechanism, which is central to the Digital Single Market. As is the proposal’s intention, this can be done by complementing, without reopening, the GDPR.

Digital Single Market. As is the proposal’s intention, this can be done by complementing, without reopening, the GDPR. In line with the proposal’s ambition and for increased efficacy, we suggest: Further specifying the framework for amicable settlements throughout cross-border cases, after complaints or in ex-officio cases; Reinforcing safeguards for highly confidential information and trade secrets in the summary of key issues and administrative files; Ensuring that the parties’ positions are heard throughout the proceedings, including in dispute resolution mechanisms; Setting procedural deadlines that fully safeguard due process, notably in the timeframe to provide a response to the administrative file shared; and Avoiding disproportionate limits to the lead supervisory authority’s (LSA) responsibility in establishing the scope of its own investigations.

…limits to the lead supervisory authority’s (LSA) responsibility in establishing the scope of its own investigations. 1 COM(2023) 348 final and Regulation (EU) 2016/679, respectively. Ref. Ares(2023)5955288 - 01/09/2023 2 Table of contents • Executive summary ...................................................................... 1 • Table of contents .......................................................................... 2 • Complaints submission and handling ........................................ 3 Company complaint mechanisms ................................................................... 3 Amicable case resolution ................................................................................. 3 Cooperation procedure and the OSS mechanism ......................................... 3 • Relevant information and the right to be heard .........................

......................................... 3 • Relevant information and the right to be heard ......................... 4 • Deadlines for decisions addressed to controllers and processors .......................................................................................... 4 • Confidentiality of the administrative file .................................... 5 • Dispute resolution ........................................................................ 5 • Annex ............................................................................................ 6 3 Complaints submission and handling Company complaint mechanisms To ensure outcome-based enforcement, we recommend that in their assessment of the extent to which a complaint should be investigated, data protection authorities (DPAs) verify the complainant’s reasonable use of the company’s complaint mechanisms.

…data protection authorities (DPAs) verify the complainant’s reasonable use of the company’s complaint mechanisms. Companies may offer several suitable options to make a complaint, so as to reach amicable resolutions at an early stage. This should therefore be listed in the proposal’s Art. 4 and its Annex. Amicable case resolution We welcome the inclusion of a framework for amicable settlements in the proposal, giving the legal tool firmer ground after its recognition both in Recital 131 GDPR and in EDPB Guidelines 06/2022. Non-litigious agreements between complainants and parties under investigation must be encouraged, so as to allow for speedier, less costly procedures for the parties and for DPAs. However, Art. 5 remains limited, as for instance the role of the LSA in amicable settlements is not detailed.

…for DPAs. However, Art. 5 remains limited, as for instance the role of the LSA in amicable settlements is not detailed. The possibility of amicable decisions in ex-officio cases, which could allow parties to reach a common understanding, is not specified either. Overall, we urge that amicable settlements should be possible at all stages of cross-border procedures. Where a solution emerges, parties should have the option to form an agreement on common terms at all stages of the procedure.

…a solution emerges, parties should have the option to form an agreement on common terms at all stages of the procedure. Cooperation procedure and the OSS mechanism The proposed Regulation, as presently drafted, shifts several competences and responsibilities from the LSA to other concerned supervisory authorities (CSAs), in the ‘cooperation procedure.’ For instance, where there is no consensus between the LSA and one or more CSAs on the LSA’s preliminary identification of the scope of the investigation, the European Data Protection Board (EDPB) can adopt an urgent binding decision within two weeks by simple majority. Rather than making the OSS more efficient, this early accelerated procedure could result in an increase in dispute resolution requests. Instead, the final text should reflect that Art.

…procedure could result in an increase in dispute resolution requests. Instead, the final text should reflect that Art. 65 GDPR dispute resolution procedures aim to resolve disputes between DPAs, rather than to direct the LSA’s fact-finding investigations and sanctions. 4 Relevant information and the right to be heard Given the potential severity of the penalties that may be imposed, parties under investigation for breaches of the GDPR must enjoy guarantees similar to those that are provided for in procedures of a penal character.2 We welcome Art. 8(2)(h) of the proposal, which includes the response of the parties under investigation in the preliminary findings. For coherence, this response should also be part of the summary of key issues, as described in Arts 9(2)(a) and (b), particularly if corrective measures are envisaged at this stage.

…of key issues, as described in Arts 9(2)(a) and (b), particularly if corrective measures are envisaged at this stage. Such responses should be reflected in the decision- making process to help provide context to DPAs, ultimately ensuring stronger cooperation. Where an urgent binding decision is requested from the EDPB, this information could facilitate case resolution by bringing sufficient context. The final text should also ensure that the right to be heard of parties under investigation is respected in urgent binding decisions, with reasonable and proportionate timeframes. Deadlines for decisions addressed to controllers and processors Pursuant to Art. 14(4), in preliminary findings, time should be given for the parties under investigation to provide their views. However, the proposal leaves the time limit to the different LSAs to determine.

…investigation to provide their views. However, the proposal leaves the time limit to the different LSAs to determine. At the very least, the final text should require the deadline to be reasonable and proportionate, and to take into consideration the facts of the investigation. This is necessary to allow the parties under investigation to assess the administrative file they have just received, and provide appropriate responses. Views expressed after the time limit should be considered where they bring new elements to the table, which could affect the final decision. Similarly, the timeline set by the LSA for parties to make their views known under Art. 17(2), as well as the time limit set by the LSA to raise confidentiality claims under Art. 21(6), should be reasonable and proportionate to the specific nature and complexity of the case.

…under Art. 21(6), should be reasonable and proportionate to the specific nature and complexity of the case. In the same vein, clear timeframes should be set for LSAs, to foster a harmonised approach and increase clarity and visibility for the parties. We recommend setting a timeframe between 30 and 45 days, depending on the request. 2 Explanatory Memorandum to the proposal. 5 The language in Art. 14(6) should be clarified to ensure that the parties’ views on the preliminary findings are included in the draft decision. The LSA should not only deal with allegations which parties have been able to provide views upon, but also the actual comments themselves. Confidentiality of the administrative file To avoid any misuse of the information parties receive as complainants, careful consideration should be given to confidential information.

…of the information parties receive as complainants, careful consideration should be given to confidential information. Where a non-confidential version of the preliminary findings is shared with the complainant pursuant to Art. 15 of the proposal, information covered by intellectual property rights or trade secrets, or which entails cybersecurity considerations, must remain protected. This also applies when several cases are treated jointly and involve various stakeholders with different interests. Consideration should also be given to the sensitivity of documents in the administrative file before they are shared. In this regard, we welcome Art. 21(4). However, files should be deemed confidential by default to avoid incorrect assumptions in time-pressing situations. The presumption under Art. 21(7) should therefore be reversed. Under Art.

19 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 31 10 2023 DIGITALEUROPE’s Response to the Revision of the Union Customs Code Executive summary DIGITALEUROPE supports the objectives of this ambitious reform and the aim of modernising the Union Customs Code in the wake of structural changes induced by the digitalisation of trade and of business models. We also welcome the proposed improvements for a coherent and uniform interpretation of the Code, as well as reformed mechanisms striving for enhanced trade facilitation for economic operators.

…of the Code, as well as reformed mechanisms striving for enhanced trade facilitation for economic operators. This paper serves as the first generic feedback on several aspects of the reform relevant to DIGITALEUROPE members, while the Association will still be collaborating closely with the Institutions and business partners on the details of the proposal during the legislative process ahead to ensure that the new UCC is better adapted to the realities and needs of business, with specific attention to the digital sector. Need for early and continued consultation with business and lead time The EU Customs reform proposal is ambitious, but many details on how the reform will be operationalised still need to be worked out. To ensure the reform meets its desired results and is adapted to the realities of business and trade, continued consultation with industry is key.

…its desired results and is adapted to the realities of business and trade, continued consultation with industry is key. This public consultation is a first step, but the EU Commission should consider setting up expert groups to inform the debate already during the legislative process. For example, we would highly recommend setting up an expert group with marketplaces and logistics service providers, focused on the e-commerce-related changes. Timeline The long timelines foreseen are justified given the scale of the reform and might even need further extension depending on the duration of the legislative process and further implementation work. Businesses can only start preparing and adapting their processes based on final legislation and detailed implementing legislation and guidelines.

…preparing and adapting their processes based on final legislation and detailed implementing legislation and guidelines. In addition, learning from the delayed implementation of the 2021 E-commerce VAT package, sufficient lead time is also needed to adapt customs systems and processes. The proposed timeline of 2028 for the e-commerce-related changes might therefore even need further extension, depending on the speed of the legislative process. Ref. Ares(2023)7410148 - 31/10/2023 2 Table of contents • Executive Summary ..................................................................... 1 • Table of Contents ......................................................................... 2 • Trust and Checked Trader ........................................................... 3 Customs Data Hub ................................................................................................

…3 Customs Data Hub ................................................................................................ 3 Data sharing - EU Customs Data Hub…………………………………………….. 4 Marketplace deemed importer concept for customs…………………………… 5 • De-minimis issue .......................................................................... 7 • EU Customs Authority ................................................................. 8 3 Trust and Checked Trader The new Trust and Check Trader status builds on existing AEO program and aims at delivering a series of enhanced simplifications for economic operators against increased and real-time access to the operator’s customs, commercial, accounting and transport records and systems.

…increased and real-time access to the operator’s customs, commercial, accounting and transport records and systems. While we strongly support the aim of simplification, we believe that the foreseen timeline for the implementation of the Trusted and Checked Traders (as linked to the deployment of the Data Hub from 2032) is too much of a stretch (by 2037). Some elements of the new system, in particular self-assessment, can be deployed earlier for the benefit of traders, especially in consideration of the fact that self-assessment already exists under the current UCC but is never fully enjoyed by operators. In addition, the Trust and Check Trader status is only accessible if an operator is resident or registered in the EU. Under the current and future legislation, companies that are not registered in the EU cannot apply for trade facilitation. The same applies for the importer of record.

…that are not registered in the EU cannot apply for trade facilitation. The same applies for the importer of record. As trade is global, EU Institutions should investigate possibilities for a “trusted status” and importer of record status for non-EU registered entities as the import of non-EU companies is responsible for a big part of the traders. The trusted trader might create a trade barrier for these companies for doing business in the EU. Mutual recognition is only possible for safety and security (AEOS). Legitimate businesses should be offered a similar status. One suggestion could be to unlock mutual recognition for customs (AEOC). Customs Data Hub DIGITALEUROPE welcomes and supports the establishment of the EU Customs Data Hub.

…customs (AEOC). Customs Data Hub DIGITALEUROPE welcomes and supports the establishment of the EU Customs Data Hub. We believe the objective of a coherent and uniform digitalisation is fundamental to overcoming existing procedural fragmentation across the Union and delivering simplification for businesses. With this in mind, we believe that more can be done to reduce the timeline for a full deployment of the Data Hub. We think it is an important and useful initiative, but it will have to be carefully thought through to take into account any local Member State requirements/recommendations. It is the only way to effectively simplify/unify clearance requirements across Member States. Moreover, in a fully-fledged EU customs information environment digitization requires Business Continuity Processes (BCP) in case IT customs systems fails.

…information environment digitization requires Business Continuity Processes (BCP) in case IT customs systems fails. At the moment, the operational responsibilities/availability of Member States’ electronics systems (BCP) for the trader is the responsibility of the 4 different MS. The European Commission should take the lead in “EU “ensuring safeguards that traders can leverage (BCP) to deliver a “true Customs Union acting as one.” We take note of the new definitions in the proposal, and we fully support the effort for legal certainty in the application of EU customs law.

…definitions in the proposal, and we fully support the effort for legal certainty in the application of EU customs law. However, we are of the view that such definitions, in particular, those of “exporter”, “importer” and “deemed importer”, need to be treated with great care and should align with relevant terms used in other areas of EU legislation, so that there is no incompatible impact on the application of the Union Customs Code and the obligations corresponding to these roles (e.g., the Dual-Use Regulation, digital services act or product-related legislation). Last but not least, as far as information sharing is concerned, in art. 25 & 61, the proposal requests real-time commercial information to be shared by Trust and Check Traders in the Data Hub.

& 61, the proposal requests real-time commercial information to be shared by Trust and Check Traders in the Data Hub. While we understand the intention of the provision, we also believe that such obligation can eventually be of problematic application in practice, even with the best cyber security in place, and taking trade secrets and business confidentiality into account. Data sharing - EU Customs Data Hub Our other key concerns regarding data sharing are: [Need for reciprocal data sharing]: We highlight the importance of data-sharing provisions which are proportionate, effectively enforceable also against non-EU businesses and ensure a level playing field. Marketplaces play an active role in securing borders against counterfeits and unsafe products.

…a level playing field. Marketplaces play an active role in securing borders against counterfeits and unsafe products. In general, they are committed to collecting and sharing data and information with customs authorities with the aim of protecting European consumers and reducing fraud. However, they would require clearer guidelines and reciprocity to ensure the data collection is targeted and meaningful and adequately addresses the issues the Customs reform proposal is trying to address. [Data minimization]: The data submission to the EU Data Hub shall be limited to the core minimum required for smooth entry through the borders, with all other data provided in a separate mode, through direct access to traders’ systems as per the Customs proposal.

31 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 04.04.2023 Response to the call for feedback on the VAT in the digital age initiative Executive summary We welcome the opportunity to provide our feedback on the VAT in the Digital Age proposal of the European Commission. We fully support the European Commission’s ambition to improve the VAT system through the use of digital tools, reducing VAT-related barriers for cross-border trade in the EU and making the VAT system better for businesses, while also more resilient to fraud.

…cross-border trade in the EU and making the VAT system better for businesses, while also more resilient to fraud. We believe the VAT in the Digital Age proposal is well placed to embrace digitalization, supports a swifter transition towards Real- Time Economy, and effectively address the challenges faced by businesses (and in particular by SMEs) who trade, or have ambitions to trade, across the EU borders. This is well reflected in the proposal through: The expansion of the Union One Stop Shop (‘UOSS’) and the introduction of a transfer module allowing businesses to use one single VAT registration to report transfers of their inventory to locations across the EU, as well as the onward sales in those locations.

…to report transfers of their inventory to locations across the EU, as well as the onward sales in those locations. We strongly encourage Member States to reach a consensus on this pillar, as it would be a pivotal tool to reduce the need for costly, time-consuming, and often prohibitive need for businesses wanting to sell products across the EU to maintain multiple VAT registrations. Amendments to the text of the proposal should be in line with the ‘north star goal’ of reducing the VAT administrative burden for businesses. To achieve this, it is key that there is no (or very limited) negative VAT cash flow impact when businesses opt to report through the UOSS and the transfer module. Any newly introduced obligations for businesses and electronic interfaces facilitating the transfer and/or the sale of goods should be proportional and ensure a level playing field.

…interfaces facilitating the transfer and/or the sale of goods should be proportional and ensure a level playing field. A shift to real-time digital reporting based on e-invoicing for businesses that operate cross-border in the EU and a more harmonized framework for domestic transactions. We welcome the ambition to harmonize EU digital reporting requirements, as Ref. Ares(2023)2443516 - 04/04/2023 2 the current fragmentation of digital reporting and e-invoicing standards around the EU is causing an immense burden on businesses and is a threat to the Single Market. However, as the proposal focuses solely on creating a harmonized invoice format, it misses a key opportunity to harness the full business and economic benefits that could come from the harmonization of transmission protocols and technical specifications for digital reporting.

…that could come from the harmonization of transmission protocols and technical specifications for digital reporting. The transition to real-time reporting will require considerable investments from businesses in the initial phase, but the ultimate goal should be to reduce administrative costs for businesses. The real-time, transaction-specific, structured data should also be usable by companies. It should be made sure that the company's financial management systems work smoothly with the official reporting systems. Digitization should promote the Real-Time Economy (financial transactions and processes are digital and based on structured data).

…should promote the Real-Time Economy (financial transactions and processes are digital and based on structured data). As technical discussions progress, we encourage the EU Commission and EU countries to consider a pragmatic and phased approach to agreeing and adopting this proposal, as it includes a large number of VAT reforms that may take a long time to agree on all at once. To strengthen the EU Single Market and remove blockers for cross-border trade, the most urgent action is needed to ensure the implementation of the single VAT registration concept, including the introduction of the transfer module and the expansion of the Union One Stop Shop scheme. 3 Table of contents Executive summary ............................................................................ 1 Table of Contents................................................................................

…1 Table of Contents................................................................................ 3 EU single VAT ID ................................................................................ 4 Digital Reporting Requirements…………………………………………5 Ensuring the VAT in the Digital Age proposal works in practice ... 6 Conclusion........................................................................................... 7 4 EU single VAT ID Strong support for the removal of the VAT registration requirement for pan-EU inventory storage and onward sales. We are strongly supportive of the EU single VAT registration and we strongly encourage Member States to prioritize discussions on this pillar to reach a consensus. We strongly encourage Member States to ensure that any amendments to the proposal are in line with the ‘north star goal’ to reduce the administrative burden on businesses.

…amendments to the proposal are in line with the ‘north star goal’ to reduce the administrative burden on businesses. The One-Stop Shop (OSS) in place since 1 July 2021 has already been a great step forward in simplifying VAT compliance for cross-border scenarios for B2C businesses. However, neither movements of retail inventory across EU countries for storage, nor the onward sale of that inventory are eligible for the OSS system. As such, businesses still face the burden of VAT registration requirements in every EU country of storage.

OSS system. As such, businesses still face the burden of VAT registration requirements in every EU country of storage. As indicated in the Commission’s Impact Assessment, the extension of the OSS as detailed in the proposal is hence a great improvement, as it will reduce burdens on hundreds of thousands of businesses operating across many industries throughout the EU, allowing them to store inventory closer to their customers, enabling faster and more sustainable delivery, without the requirement to VAT register outside their home country. This simplification will allow businesses and especially SMEs to take full advantage of the Single Market. National governments will also benefit from a more competitive EU market, leading to a boost in tax revenues at a time when Member States are dealing with the social and economic effects of recent energy price spikes and geo-political tensions.

States are dealing with the social and economic effects of recent energy price spikes and geo-political tensions. Simpler VAT obligations also lead to higher levels of VAT compliance and leveling the playing field across all sizes of businesses. We would also expect that the simplification of EU VAT obligations will encourage businesses to onshore inventory within the EU before the sale, instead of shipping directly from non-EU locations – as well as reducing pressure on customs authorities, this should enhance tax authorities’ ability to audit and enforce. Finally, we are supportive of the measure to make the existing Import One Stop Shop mandatory for marketplaces acting as deemed suppliers, as this will improve the collection and simplify the audit and enforcement of VAT while ensuring a level playing field.

…as this will improve the collection and simplify the audit and enforcement of VAT while ensuring a level playing field. VAT refunds to be improved as part of longer-term reforms As per the current proposal, the OSS system will not include a VAT deduction feature. We recognize that different reasons are making this extremely difficult. Indeed, because of its design with a single point of contact authority, the OSS is less fit for including transactions that would allow recovery of VAT (other than self-assessed VAT, e.g. on intra-EU acquisitions of goods for resale), given the need for controlling tax refunds from tax authorities’ perspective. Nevertheless, we would suggest: To foresee that studies will be conducted, and solutions will be proposed by the Commission to solve this in the future.

…foresee that studies will be conducted, and solutions will be proposed by the Commission to solve this in the future. In the meantime, and in parallel, it could be worth investigating possibilities to create a link between the OSS and the VAT refund portal to allow more automated processing of VAT credits (e.g. upload of OSS data in the refund portal, simultaneous filing periods, etc.) for taxpayers registered in the OSS. This could be done at the EU level or as a first step between voluntary Member States via bilateral agreements which will improve the conditions in which their businesses operate. If this alternative succeeds and if solutions investigated under a) appear to be complex and/or costly, they could be abandoned if this alternative appears to be satisfactory. 5 Digital Reporting Requirements We support the introduction of Digital Reporting Requirements.

26 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 17 MARCH 2023 DIGITALEUROPE position paper on the proposed Packaging and Packaging Waste Regulation Executive summary DIGITALEUROPE welcomes the revision of the EU Packaging and Packaging Waste Directive 94/62/EC and notes with appreciation the ambition and significant innovative thinking in the proposed revision which sets the direction to minimise the adverse impacts of packaging and packaging waste on the environment and human health. The revision of the EU Packaging and Packaging Waste Directive 94/62/EC has an important opportunity to address unintentional preconditions for market fragmentation when implemented.

…has an important opportunity to address unintentional preconditions for market fragmentation when implemented. Duplication, derogations and Member State interpretation of horizontal rules have led to obstacles for companies to easily comply. This puts unnecessary hurdles for the EU to achieve its green deal and circular economy goals. For example, 15 February 2023 the European Commission issued an infringement notice (INFR(2022) 4028) to France in its failure to address its labelling (Triman) requirements concerning waste sorting instructions. It saw national laws adopted in this field creating unnecessary burdens on internal market trade. The Notice states: ‘In this context, the imposition of national-specific labelling requirements risks undermining the principle of free movement of goods and can lead to counterproductive environmental effects.

…risks undermining the principle of free movement of goods and can lead to counterproductive environmental effects. Such measures can also lead to increased material needs for additional labelling and additional waste produced due to larger than necessary sizes of the packaging.’ DIGITALEUROPE encourages the revision to adopt the spirit of improving the internal market and reduce the scope for interpretation. DIGITALEUROPE welcomes provisions clarifying packaging labelling. DIGITALEUROPE offers concrete recommendations to ensure that the Packaging Regulation allows packaging to perform its core functionalities (protecting, containing and delivering products safely) while offering the best overall environmental performance and adequately informing consumers. Ref.

…products safely) while offering the best overall environmental performance and adequately informing consumers. Ref. Ares(2023)2083771 - 22/03/2023 2 Specifically: A less arbitrary definition of packaging which would mitigate the risk of considering products used by consumers to carry or store their products as packaging. Measures backed by scientific evidence and impact/lifecycle assessments, both in the Regulation and in secondary legislation Clear implementation dates and sufficient time to adapt A definition of ‘plastic packaging’ to clarify the scope of the proposed recycled content targets Jointly-developed metrics and calculation methodologies to minimise packaging Overall, improving packaging environmental performance cannot be detrimental to consumer safety, packaging innovation nor availability and use of high-quality, circular materials.

…be detrimental to consumer safety, packaging innovation nor availability and use of high-quality, circular materials. 3 Table of contents Executive summary ......................................................................... 1 Table of contents ............................................................................. 3 Key points of concern ..................................................................... 4 Science-based approach ............................................................................... 4 Clear implementation timelines and sufficient transition periods .............. 4 Definition of packaging (Article 3): ............................................................... 5 Free movement (Article 4): ............................................................................ 5 Substances of concern (art.

(Article 4): ............................................................................ 5 Substances of concern (art. 5):..................................................................... 5 Design for recycling criteria (art. 6): ............................................................. 6 Recycled content (article 7): ......................................................................... 6 Packaging minimisation/excessive packaging (Arts. 9, 21, Annex IV) ....... 7 Labelling of packaging (article 11): .............................................................. 8 Reuse systems (Art. 26): ............................................................................... 9 Extended producer responsibility (art. 40):................................................

…9 Extended producer responsibility (art. 40):................................................ 10 4 Key points of concern In particular, DIGITALEUROPE points out the below points of concern for ICT manufacturers: Science-based approach Measures in the Packaging Regulation shall be based on objective evidence and a holistic approach that takes into consideration the packaging lifecycle and all aspects that have an impact on the environmental footprint and performance of packaging. Reliance on existing and new ad hoc assessments, including impact assessments and lifecycle assessments, is of paramount importance when assessing policy options and measures. This holistic and science-based approach will be equally important when drafting secondary legislation.

…and measures. This holistic and science-based approach will be equally important when drafting secondary legislation. Industry and other key stakeholders involvement will be key in that process, specially in cases where technical and practical details of packaging design and related process are essential (e.g. packaging minimisation, recycled plastic content calculation methodology). Clear implementation timelines and sufficient transition periods The Packaging Regulation contains an ambitious set of measures that will require industry to plan and implement systemic changes in their packaging innovation strategies and in their sourcing and/or manufacturing strategies.

…systemic changes in their packaging innovation strategies and in their sourcing and/or manufacturing strategies. The required changes will require years to implement, and for that implementation to be successful industry needs: legal certainty over timelines and requirements sufficient time to adapt exemptions or special considerations for certain applications All products packaged before the entry into force of the Regulation should be exempt from the respective requirements in order to prevent the negative impact of re-packaging. Similarly, the proposal does not specify when should the EU Commission publish its Design for Recycling guidelines (defining whether packaghing is recyclable or not), nor clarify how long will companies have to adapt.

…guidelines (defining whether packaghing is recyclable or not), nor clarify how long will companies have to adapt. Sufficient time should be granted to prove compliance with the recyclability requirements following the adoption of the Design for Recycling criteria and the criteria to assess ‘recyclability at scale’. Durable products have design cycles which may be longer than the currently proposed transition periods. The same challenge applies to spare parts, which 5 shall be made available for longer periods in order to comply with consumer regulations. Overall, a generic transition period set to 36 months would increase legal certainty for economic operators while providing sufficient time for companies to implement the necessary changes and/or the creation of new processes. This is relevant both for design-related requirements/restrictions (e.g. Arts. 5,

…and/or the creation of new processes. This is relevant both for design-related requirements/restrictions (e.g. Arts. 5, 7) and for operational requirements (e.g. Art. 26 (12-13)). Definition of packaging (Article 3): DIGITALEUROPE believes that the definition of packaging (Art. 3.1) is ambiguous as it can include products which are intended to be used by consumers in order to carry or store their products after purchase. To rectify this ambiguity, we believe that the definition should be revised to specify that packaging designed and/or marketed with a secondary use (e.g. protective case/bag) should be exempt.

…to specify that packaging designed and/or marketed with a secondary use (e.g. protective case/bag) should be exempt. Free movement (Article 4): DIGITALEUROPE welcomes the fact that the Regulation makes clear the fact that Member States shall not prohibit, restrict or impede the placing on the market of packaging that complies with the sustainability requirements and the labelling requirements set out by the Regulation (Art. 4.2 & Art. 4.3). This is sufficiently reiterated by the fact that existing or future national sustainability or information requirements shall not prohibit, restrict or impede the placing on the market of packaging on the basis of non-compliance with the national requirements, as long as it complies with the requirements of the Regulation (Art.

37 → 12

originalus šaltinis (PDF) ↗

DIGITALEUROPE Rue de la Science, 14A, B-1040 Brussels T.+32 (0) 2 609 53 10 / www.digitaleurope.org / @DIGITALEUROPE EU Transparency Register: 64270747023-20 24 MARCH 2023 Fostering cooperation in GDPR enforcement across Europe Executive summary DIGITALEUROPE welcomes the European Commission’s initiative to facilitate more harmonised procedural cooperation in cross-border enforcement of the General Data Protection Regulation (GDPR).1 We believe these efforts will greatly contribute to a reinforced one-stop-shop (OSS) mechanism, which we deem crucial for both businesses and data subjects.2 For harmonised enforcement to work in practice, we recommend that the new rules should: Facilitate amicable settlements, with a reinforced role for lead supervisory authorities (LSAs); Better define the rights and roles of complainants, their representatives and the parties under investigation in…

…the LSA; and Set procedural deadlines that safeguard due process and allow parties to exercise their procedural rights. We encourage the Commission and the EDPB to continue open stakeholder involvement in the preparation of this legislative proposal. 1 https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13745-Further- specifying-procedural-rules-relating-to-the-enforcement-of-the-General-Data-Protection- Regulation_en. 2 DIGITALEUROPE, Two years of GDPR: A report from the digital industry, available at https://www.digitaleurope.org/wp/wp-content/uploads/2020/06/DIGITALEUROPE_Two-years- of-GDPR_A-report-from-the-digital-industry.pdf. Ref. Ares(2023)2159155 - 24/03/2023 2 Table of contents • Executive summary ......................................................................

…of contents • Executive summary ...................................................................... 1 • Table of contents .......................................................................... 2 • Tools to promote cooperation early in the process .................. 3 • Status of parties to administrative proceedings ....................... 3 • Right to a hearing and good administration .............................. 3 • Information shared about the investigation ............................... 4 • Procedural deadlines ................................................................... 4 3 Tools to promote cooperation early in the process We welcome the EDPB’s recognition of the role amicable settlements can play in the OSS procedure.3 Amicable settlements are described in Recital 131 GDPR, and should be facilitated in cross-border cases.

…procedure.3 Amicable settlements are described in Recital 131 GDPR, and should be facilitated in cross-border cases. Non-contentious case resolutions allow space for trusted and constructive agreements between parties. They can lead to faster case resolution, and remove some of the burden from DPAs and the parties involved. We would further welcome reinforcement of LSAs’ role in amicable settlements as part of the OSS. Status of parties to administrative proceedings Each party’s procedural rights before DPAs should be further defined. Complainants, their representatives and the parties under investigation should have clearly defined, active roles in proceedings. Having clearly defined rights and obligations would increase the parties’ trust and collaboration in resolving cases. It would also help avoid the burden of further litigation before national courts.

…collaboration in resolving cases. It would also help avoid the burden of further litigation before national courts. In this context, the right to a hearing is of particular importance, as discussed below. It can provide key information over different cases, avoid biases and ensure stronger collaboration with authorities. Additionally, we support the EDPB’s recommendation to clarify which part of a file parties should be allowed to access. To this end, it is key that confidential files, which may contain information covered by intellectual property rights or trade secrets, or entail cybersecurity considerations, should be kept highly confidential. Rules for careful assessment, involving the party under investigation, are necessary to avoid economic harm and damages. The inclusion of such confidential information in rules around DPAs’ investigative powers would be further welcomed.

The inclusion of such confidential information in rules around DPAs’ investigative powers would be further welcomed. Right to a hearing and good administration The right of parties under investigation to be heard should be recognised and balanced with those of complainants. Hearings help to inform DPAs’ decision-making process. We strongly support the EDPB’s recommendation that an obligation be set for hearings to take place before a draft decision is prepared and shared with concerned DPAs. The EDPB’s decision-making process should include the results from hearings. For 3 EDPB letter to the European Commission on procedural aspects that could be harmonised at EU level and EDPB Guidelines 02/2022. 4 hearings to inform the decision-making process, they should also be part of dispute-resolution proceedings under Art. 65.

…to inform the decision-making process, they should also be part of dispute-resolution proceedings under Art. 65. The scope, modalities and timing, as described by the EDPB, should be clarified so as to allow for sufficient time to prepare. A level of flexibility should be in place, for instance as to whether the hearing should be in written or in oral form.4 Summaries of the hearings should be provided to the parties, in the interest of transparency. Information shared about the investigation Transparency about the information shared between authorities is key, particularly in cross-border investigations. The elements taken into account to establish which DPA should take the lead should be clear to the parties involved. Procedural deadlines We welcome the introduction of more granular procedural deadlines.

…clear to the parties involved. Procedural deadlines We welcome the introduction of more granular procedural deadlines. However, new cross-border rules should remain adaptable to different cases and levels of complexity. Decisions should not be rushed, which may lead to increased litigation. Procedural deadlines should safeguard due process and allow parties to exercise their procedural rights. Extensions should be available to authorities, and the parties’ rights, e.g. the right to be heard, should be taken into account in setting new procedural deadlines. FOR MORE INFORMATION, PLEASE CONTACT: Alberto Di Felice Director for Infrastructure, Privacy and Security Policy [email protected] / +32 471 99 34 25 Beatrice Ericson Officer for Privacy and Security Policy [email protected] / +32 490 44 35 66 4 EDPB Guidelines 03/2021.

…for Privacy and Security Policy [email protected] / +32 490 44 35 66 4 EDPB Guidelines 03/2021. 5 About DIGITALEUROPE DIGITALEUROPE is the leading trade association representing digitally transforming industries in Europe. We stand for a regulatory environment that enables European businesses and citizens to prosper from digital technologies. We wish Europe to grow, attract, and sustain the world’s best digital talents and technology companies. Together with our members, we shape the industry policy positions on all relevant legislative matters and contribute to the development and implementation of relevant EU policies, as well as international policies that have an impact on Europe's digital economy. Our membership represents over 45,000 businesses who operate and invest in Europe.

…impact on Europe's digital economy. Our membership represents over 45,000 businesses who operate and invest in Europe. It includes 102 corporations which are global leaders in their field of activity, as well as 41 national trade associations from across Europe.

…which are global leaders in their field of activity, as well as 41 national trade associations from across Europe. DIGITALEUROPE Membership Corporate Members Accenture, Airbus, Applied Materials, Amazon, AMD, Apple, Arçelik, Arm, Assent, Autodesk, Avery Dennison, Banco Santander, Bayer, Bosch, Bose, Bristol-Myers Squibb, Brother, Canon, CaixaBank, Cisco, CyberArk, Danfoss, Dassault Systèmes, DATEV, Dell, Eaton, Epson, Ericsson, ESET, EY, Fujitsu, GlaxoSmithKline, Google, Graphcore, Hewlett Packard Enterprise, Hitachi, Honeywell, HP Inc., Huawei, ING, Intel, Johnson & Johnson, Johnson Controls International, Konica Minolta, Kry, Kyocera, Lenovo, Lexmark, LG Electronics, Mastercard, Meta, Microsoft, Mitsubishi Electric Europe, Motorola Solutions, MSD Europe, NEC, Nemetschek, NetApp, Nintendo, Nokia, Nvidia Ltd., Oki, OPPO, Oracle, Palo Alto Networks, Panasonic Europe, Pearson, Philips,…

Instruments, TikTok, Toshiba, TP Vision, UnitedHealth Group, Visa, Vivo, VMware, Waymo, Workday, Xerox, Xiaomi, Zoom. National Trade Associations Austria: IOÖ Belgium: AGORIA Croatia: Croatian Chamber of Economy Cyprus: CITEA Czech Republic: AAVIT Denmark: DI Digital, IT BRANCHEN, Dansk Erhverv Estonia: ITL Finland: TIF France: AFNUM, SECIMAVI, numeum Germany: bitkom, ZVEI Greece: SEPE Hungary: IVSZ Ireland: Technology Ireland Italy: Anitec-Assinform Lithuania: Infobalt Luxembourg: APSI Moldova: ATIC Netherlands: NLdigital, FIAR Norway: Abelia Poland: KIGEIT, PIIT, ZIPSEE Portugal: AGEFE Romania: ANIS Slovakia: ITAS Slovenia: ICT Association of Slovenia at CCIS Spain: Adigital, AMETIC Sweden: TechSverige, Teknikföretagen Switzerland: SWICO Turkey: Digital Turkey Platform, ECID Ukraine: IT Ukraine United Kingdom: techUK

originalus šaltinis (PDF) ↗