Science Europe

Science Europe Rue de la Science 14, 1040 Brussels, Belgium Tel: +32 (0)2 226 03 00  Fax: +32 (0)2 226 03 01  Email: [email protected]  www.scienceeurope.org Science Europe Feedback on the Implementation of the GDPR Introduction Science Europe welcomes the opportunity to provide feedback on the implementation of the General Data Protection Regulation (GDPR) through the call for evidence opened for the 2025 GDPR report. Science Europe represents 40 major European public research funding and performing organisations, together spending over €25 billion per year on science in 29 countries, and funding or performing excellent, ground-breaking research in Europe. Public research-funding and research-performing organisations often collaborate and finance research projects with partners from different countries within and outside the European Union.

…collaborate and finance research projects with partners from different countries within and outside the European Union. These collaborations are usually established with multiple partners from the public sector, which involve the processing of personal data. For instance, when researchers apply for funding, receive funding, or submit scientific papers for review, personal data is processed. Additionally, researchers collect, generate, and share data, including personal data, across borders with their international partners. As a result, GDPR has a strong influence on the ways in which research – and research collaboration – is conducted and managed. Research organisations have developed structures, tools, and policies to ensure their activities comply with the GDPR. The 07/2020 Guidelines of the European Data Protection Board have also provided much-needed clarifications.

…the GDPR. The 07/2020 Guidelines of the European Data Protection Board have also provided much-needed clarifications. However, many challenges remain. In cases of collaboration with non-EU partners, difficulties exist in finding appropriate tools and convincing partners to agree to sign them formally. Both issues lead to difficulty for organisations to agree on the kind of controlling and agreements that are needed. Joint Controlling vs. Separate Controlling The main challenges are: • Differing interpretations of the rules related to controlling and processing data • Lack of common understanding of roles and responsibilities under GDPR The rules around controlling and processing data are interpreted differently by different organisations. This can create difficulties for organisations to reach an agreement on the controlling of data and necessary agreements.

…can create difficulties for organisations to reach an agreement on the controlling of data and necessary agreements. When GDPR applies, research-funding and research-performing organisations must define each partner's roles and responsibilities for all kinds of data processing in their collaboration agreements. This involves determining whether the data controlling is done together or separately for each case. Several factors must be considered to establish the appropriate agreement, including the nature of the shared data, the appropriate legal basis, the respective data flows, and the different roles fulfilled by the various partners. Ref. Ares(2024)942002 - 07/02/2024 SCIENCE EUROPE FEEDBACK ON THE IMPLEMENTATION OF THE GDPR 2 Much progress has been made in the application of the different types of controlling agreements, and policies have been put in place in research organisations.

…of the different types of controlling agreements, and policies have been put in place in research organisations. However, there is still a lack of unified understanding of when an organisation is a joint controller – or even a controller at all. Organisations have adopted different approaches to determine when they are a controller or processor, which impact the agreements they have with international partners. To tackle these challenges, Science Europe calls on the European Commission, EU Council, and European Data Protection Board to: • Review and, where necessary, update the available guidelines to communicate more clearly the definition, applicability, and requirements of joint and separate controlling, to harmonise the interpretations of the relevant GDPR provisions.

…and requirements of joint and separate controlling, to harmonise the interpretations of the relevant GDPR provisions. • Provide clear advice on which forms of written agreements can be used to ensure compliance with the GDPR, and when these agreements need to be put in place. Choosing and Applying the Right Tools The challenges are: • Finding appropriate mechanisms to address the GDPR in agreements with non-EEA countries • Additional tools, such as TIAs, are difficult for research organisations to implement GDPR only applies to countries within the European Economic Area (EEA). In turn, additional tools and safeguards need to be put in place for collaborations with non-EEA partners to be GDPR- compliant. The most straightforward tool is adequacy decisions, which confirm that a specific country offers an essential equivalent level of data protection.

…is adequacy decisions, which confirm that a specific country offers an essential equivalent level of data protection. Currently, only 15 countries have been recognised by the European Commission – and for two of those (Canada and the United States) the decision only applies to commercial entities. As a result, research-funding and research-performing organisations have had to use additional tools in their collaborations. Standard Contractual Clauses (SCCs) have been introduced in collaborative agreements to comply with the GDPR. Joint Controller Agreements and Data Processing Agreements are also being used. However, the Schrems II Judgement of 16 July 2020, invalidating the EU-US Privacy Shield, has had wide-ranging effects on the applicability of SCCs and due diligence requirements for European organisations.

…has had wide-ranging effects on the applicability of SCCs and due diligence requirements for European organisations. Additional tools like Transfer Impact Assessments (TIAs) and Code of Conduct could prove useful. However, TIAs are difficult to conduct – as relevant information might not be readily available to research organisations – and understanding what measures to take to mitigate the identified risks remains challenging. In addition, Codes of Conduct, while promising, are still being developed. The legal landscape is, therefore, still extremely complex. To address this, Science Europe recommends that the European Commission, EU Council, and European Data Protection Board: • Support the development of sector-specific Codes of Conduct that would address the needs of research and innovation in international collaboration contexts.

Codes of Conduct that would address the needs of research and innovation in international collaboration contexts. • Support organisations in undertaking TIAs, including through providing guidelines on which due diligence is required and facilitating information-sharing on the relevant risks. SCIENCE EUROPE FEEDBACK ON THE IMPLEMENTATION OF THE GDPR 3 • Review SCCs and clarify their use – including updating them as relevant. Collaborating with International Partners The challenges are: • A reluctance by organisations in non-EEA countries to agree to signing binding agreements on data protection • Difficulties in reconciling the legal obligations of EEA and non-EEA countries Many Science Europe member organisations have encountered difficulties negotiating with partners outside the EEA. In particular, many non-EEA organisations are reluctant to sign binding agreements on data protection.

…outside the EEA. In particular, many non-EEA organisations are reluctant to sign binding agreements on data protection. This is due to the reluctance to apply EU law to their activities and the technicity of GDPR agreements. Differences in legal and policy cultures also play an important role, with international partners perceiving that their EU counterparts are imposing their own legal rules on them while not being bound by theirs. There also can be difficulties in reconciling the legal obligations of EEA (stemming from GDPR) and non-EEA (stemming from national legislation) partners. These challenges in finding agreements with international partners result in difficulties in setting up and implementing international collaboration, which is one of the cornerstones of scientific progress.

…in setting up and implementing international collaboration, which is one of the cornerstones of scientific progress. To mitigate those issues, Science Europe calls on the European Commission, EU Council, and European Data Protection Board to: • Include awareness-raising on GDPR-related issues in their political and policy discussions with international partners, especially in the context of research and innovation. Current forums, such as the Multilateral Dialogues on Principles and Values, could be used to that effect. • Provide guidance on effectively communicating the GDPR requirements and the necessity and relevance of implementing them in international agreements. Science Europe would like to stress that it is ready to work together with the relevant EU Institutions and their services to explore ways forward to address the above concerns.

originalus šaltinis (PDF) ↗