Interesų grupė
…22 April 2020 ADIGITAL CONTRIBUTION TO THE EUROPEAN COMMISSION PUBLIC CONSULTATION REPORT ON THE GDPR The following document has been elaborated by Adigital, the Spanish Association for the Digital Economy, in view of the European Commission public consultation on the implementation of the General Data Protection Regulation. In particular, Adigital focuses on: (i) international transfers to non- EU countries, and (ii) the cooperation mechanism between national data protection authorities. I.
…transfers to non- EU countries, and (ii) the cooperation mechanism between national data protection authorities. I. Transfers of personal data to non-EU countries With respect to the international transfers of personal data and the cooperation mechanisms, one of the most disturbing situations to our associates was the fact that we do not have it clear to which National Authority do we have to report to when it comes to data breaches, having into account that there are companies with subsidiaries within many countries. Especially when subsidiaries lack of legal personality and the data breach affects only a certain country.
…countries. Especially when subsidiaries lack of legal personality and the data breach affects only a certain country. In situations like the aforementioned the GDPR becomes inaccurate as it does not illustrate if the data breach shall be notified to the Authority where the parent company -the controller of the processing- is sited or to the one sited in the specific country where the data breach took place -despite subsidiaries lack of legal personality-. There could be also another possible situation: to inform both Authorities about the data breach suffered. In short, one of the issues Adigital associates have experienced since the GDPR implementation is the absence of guidance in order to make it clear to which specific Authority companies have to report data breaches in conditions like the ones mentioned before. II.
…to which specific Authority companies have to report data breaches in conditions like the ones mentioned before. II. Cooperation mechanisms between national data protection authorities Standardization of criteria regarding certain legitimate purposes in the context of those difficulties suffered by insurance multinational companies when applying the GDPR. For instance, in Portugal it is needed the consent of the data subject to process sensible data, where in Ireland it is committed to the performance of the insurance contract. Ref. Ares(2020)2296874 - 29/04/2020