European Association for Energy and Water Data Management

E.V.V.E.’s feedback on the 2024 report on the General Data Protection Regulation E.V.V.E., the European Association for Energy Cost Allocation, is an independent and European-wide politically active interest group whose activities aim at the promoting of systems to save energy and water in buildings. Amongst their members are leading companies developing and producing systems for heat, cold and water cost allocation as well as carrying out the service for the consumption-based billing of energy and water costs within the European Union and beyond. Its members are focusing on advanced solutions to meet our customers’ needs for transparency on energy consumption and efficiency of energy systems in buildings. E.V.V.E. welcomes the opportunity to provide feedback on the application of the General Data Protection Regulation (GDPR).

…welcomes the opportunity to provide feedback on the application of the General Data Protection Regulation (GDPR). Data protection is a critical aspect of our contemporary business environment, and we commend the EU's commitment to safeguarding individuals' personal information. Over the years, E.V.V.E. has witnessed positive developments in the operational practices as a result of GDPR implementation. The regulatory framework has provided much-needed clarity on data protection rules, contributing to a more secure and transparent digital landscape. While we acknowledge the paramount importance of safeguarding personal data, we believe that, in some instances, the GDPR tends to place an undue emphasis on data protection in the overall balancing of interests.

…in some instances, the GDPR tends to place an undue emphasis on data protection in the overall balancing of interests. We suggest a nuanced approach that takes into consideration the broader implications, especially concerning impediments to digitisation, which is crucial for addressing global challenges like climate change. Specifically, within the context of activities such as heating cost allocation and billing, we have encountered challenges related to: Creation of Informative Statistics - Simplify anonymisation for processors The process of generating meaningful statistics is hindered by the stringent regulations, impacting our ability to derive valuable insights for optimising energy consumption. The options are particularly limited for large processors with a large number of clients, even though they would have the necessary database to provide socially important information.

…large number of clients, even though they would have the necessary database to provide socially important information. We would suggest creating opportunities for processors to anonymise data and use it for statistical and social purposes, such as climate change. Restrict Data Subject Requests The case law of the European Court of Justice (ECJ) is in line with the interests of users in disputes, making it difficult for companies to fulfil the requirements of data subject requests, in particular with regard to the right of access. It would make practical sense to limit data requests to a certain level of detail. Ref. Ares(2024)967925 - 08/02/2024 We recommend modifying Article 15 in such a way that data subjects must limit or specify their requests and restrict abuse requests in cases where there is no data protection interest at all.

…limit or specify their requests and restrict abuse requests in cases where there is no data protection interest at all. Attempts at gathering information in a pre-litigation scenario should be avoided. In light of these challenges, we advocate for a more nuanced approach to data protection that distinguishes between highly sensitive personal data and general data or anonymised data. A comprehensive reevaluation of the GDPR's application to different types of information would enable a more flexible and balanced regulatory framework. We urge the European Commission to consider the broader societal benefits of digitisation, particularly in the context of environmental sustainability. Balancing data protection with the imperative to address climate change is crucial for achieving our shared goals. E.V.V.E.

…data protection with the imperative to address climate change is crucial for achieving our shared goals. E.V.V.E. welcomes the Commission's attention to this issue and is willing to engage in further discussions to help enhance ongoing improvements in data protection regulations. Contact: Office Berlin Office Brussels Friedrichstraße 95 56, Av. des Arts D-10117 Berlin, Germany B-1000 Brussels, Belgium Tel. +49 228 35 14 96 Tel : +32 280 11 395 Fax +49 228 35 83 71 Markus Weidling Udo Wasser [email protected] [email protected] Guillaume Février [email protected] EVVE´s answers to the Questionnaire for the 2024 report on the application of the GDPR Questions

…answers to the Questionnaire for the 2024 report on the application of the GDPR Questions 1. General comments a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? The legal equality achieved by the GDPR within the EU with regard to the handling of data protection issues is to be welcomed in principle, as this simplifies cooperation with companies in the EU environment. However, challenges arise from cooperation with companies outside the EU environment. With the exception of countries in which a corresponding data protection standard has been established or with the USA, agreements must be concluded in accordance with EU requirements, their implementation checked and compliance with the standards monitored. The exchange of data with companies in the USA…

…exchange of data with companies in the USA should "finally" be put on a solid and legally secure footing. 2. Exercise of data subject rights a. From the individuals’ perspective: please provide information on the exercise of the data subject rights listed below, including on possible challenges (e.g. delays in controllers/processors reply, clarity of information, procedures for exercise of rights, restrictions on the basis of legislative measures, etc.). From the controllers and processors’ perspective: please provide information on the compliance with the data subject rights listed below, including on possible challenges (e.g. manifestly unfounded or excessive requests, difficulty meeting deadlines, identification of data subjects, etc.).

(e.g. manifestly unfounded or excessive requests, difficulty meeting deadlines, identification of data subjects, etc.). • Information obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) The question arises regarding the appropriate timing for disclosing information and the required follow- up procedures for such disclosures. • Access to data (Article 15) In instances of an email inquiry, the enquirer is often not clearly identifiable. If this is the case, case law now no longer permits a reply in the form of an unencrypted email, even if the request was made in that manner. • Erasure (Article 17) Individuals struggle with the fact that their data can only be deleted after the conclusion of the normative retention period (for invoices, etc.).

…fact that their data can only be deleted after the conclusion of the normative retention period (for invoices, etc.). Where possible please provide a quantification and information on the evolution of the exercise of these rights since the entry into application of the GDPR. b. Do you avail of / are you aware of tools or user-friendly procedures to facilitate the exercise of data subject rights? E.V.V.E. is not aware of any tools or user-friendly procedures to facilitate the exercise of data subject rights. c. Do you have experience in contacting representatives of controllers or processors not established in the EU? Yes, concluding the standard contractual clauses generally leads to a high need for coordination and, as a result, the requirements must be followed up. Companies have to plan for this as an additional expense and manage it in terms of personnel. d.

…must be followed up. Companies have to plan for this as an additional expense and manage it in terms of personnel. d. Are there any particular challenges in relation to the exercise of data subject rights by children?

…of personnel. d. Are there any particular challenges in relation to the exercise of data subject rights by children? 3. Application of the GDPR to SMEs a. What are the lessons learned from the application of the GDPR to SMEs? A number of changes had to be made when the GDPR was introduced (adjustments to processor agreements, procedure directories, etc.). The administrative effort for keeping track of the required evidence, documents, etc. has increased. Unfortunately, the establishment of certification bodies has taken a very long time and has still not been completed. Especially in the SME environment, a data protection seal would contribute to a better and possibly more easily comprehensible presentation of the business partner's data protection level for customers. b. Have the guidance and tools provided by data protection authorities and the EDPB in recent years assisted SMEs in…

21 → 12

originalus šaltinis (PDF) ↗