Insurance Ireland

EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR JUSTICE AND CONSUMERS Directorate C: Rule of Law, Fundamental Rights and Democracy Unit C.3: Data protection Brussels, 19 September 2023 DG JUST.C3 QUESTIONS TO GDPR MULTISTAKEHODLER EXPERT GROUP FOR COMMISSION 2024 REPORT ON THE APPLICATION OF THE GDPR The General Data Protection Regulation (‘GDPR’) entered into application on 25 May 2018, repealing and replacing Directive 95/46/EC. The GDPR has a two-fold objective. The first is to protect fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. The second is to allow the free flow of personal data and the development of the digital economy across the internal market.

…is to allow the free flow of personal data and the development of the digital economy across the internal market. In line with Article 97 GDPR, the Commission adopted a first report on the evaluation and review of the GDPR on 24 June 2020 (the ‘2020 report’).1 The next report is due by mid- 2024 (the ‘2024 report’). Article 97 GDPR requires the Commission to examine, in particular, the application and functioning of: • Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on cooperation and consistency.

…adopted on the basis of Article 25(6) of Directive 95/46/EC; and • Chapter VII on cooperation and consistency. As you are aware, the functioning of Chapter VII is addressed by the Commission’s proposal for a Regulation on GDPR procedural aspects adopted on 4 July 20232 and takes into account the input received from the Group. Therefore, the present exercise does not cover this matter. Article 97 GDPR also requires the Commission to take into account the positions and findings of the European Parliament and the Council, and of other relevant bodies and sources. The Commission may also request information from Member States and supervisory authorities.

…bodies and sources. The Commission may also request information from Member States and supervisory authorities. 1 Communication from the Commission to the European Parliament and the Council, Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, 24.6.2020, COM(2020) 264 final. 2 COM(2023) 348 final. Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111 [email protected] Ref. Ares(2024)667749 - 29/01/2024 2 The GDPR Multistakeholder Expert Group was established in 2017 to assist the Commission in identifying potential challenges in the application of the GDPR from the perspective of different stakeholders, and to advise the Commission on how to address them.

…of the GDPR from the perspective of different stakeholders, and to advise the Commission on how to address them. In view of the preparation of the 2024 report, and as for the preparation of the 2020 report3, the Commission is seeking feedback on your experiences with the application of the GDPR. As communicated separately, the Commission has planned a meeting of the Multistakeholder Expert Group for 27 October 2023. This meeting will provide an opportunity for members to provide feedback orally to the questions below and to raise other points if deemed necessary. You will then be invited to provide your final feedback in writing (in English) to the questions below by 18 November 2023. Please note that, as for the 2020 report, the Commission will prepare a report summarising the written feedback provided, which is intended to be made publicly available.

…will prepare a report summarising the written feedback provided, which is intended to be made publicly available. Individual contributions may be disclosed in response to access to documents requests under Regulation (EC) No 1049/2001.4 QUESTIONS

…may be disclosed in response to access to documents requests under Regulation (EC) No 1049/2001.4 QUESTIONS 1. General comments a. What is your overall assessment (benefits/challenges, increase in trust and awareness, etc.) of the application of the GDPR since May 2018? Are there priority issues to be addressed? GDPR has given data subjects a platform to have more control over how their personal data is processed. There is more awareness around the topic of personal data and data subjects rights since the introduction of the GDPR in 2018. If data controllers are adhering to GDPR then this will strengthen the relationship with Insurance Ireland’s (II) members’ customers as they have the assurance that their data is being processed correctly. GDPR has had the benefit of applying a largely common set of data protection requirements across the EEA, providing increased trust for data…

…conflict with other domestic regulatory requirements such as the Central Bank of Ireland’s Consumer Protection Code. 2. Exercise of data subject rights a. From the individuals’ perspective: please provide information on the exercise of the data subject rights listed below, including on possible challenges (e.g. delays in controllers/processors reply, clarity of information, procedures for exercise of 3 rights, restrictions on the basis of legislative measures, etc.). Aside from the right of access, Insurance Ireland’s (II) members noted that there is limited take up and awareness of other subject rights. II members’ experience of the right of access is that the vast majority of data subjects simply want access to their data, usually to further some goal such as a complaint or legal claim.

…of data subjects simply want access to their data, usually to further some goal such as a complaint or legal claim. The majority are not interested in the array of wider information outlined under Article 15 and in the associated EDPB guidelines. Therefore, controllers expend an undue amount of time and resource to meet a data subject requirement, that they are not usually seeking. It would be preferable to have this based on data subject request. II members also noted that they have dedicated resources in place to dealing with right of access requests which are usually related to a complaint or a claim. As right of access requests can be quite vague, II members would normally make contact with the data subject so they understand exactly what they are looking for and this sometime helps firms action an access request in a quicker time frame and is of value to the data subjects.

…this sometime helps firms action an access request in a quicker time frame and is of value to the data subjects. Regarding any data that is withheld or redacted, II members ensure that this is explained in their final response letter to data subjects. As a general comment, II members noted that the requests they have received are only concerned with access to data (Art. 15 GDPR), or in fewer cases exercising the right to be forgotten (Art. 17 GDPR). Some of II members have received no requests to date in relation to the other rights set out in Chapter III GDPR.

Some of II members have received no requests to date in relation to the other rights set out in Chapter III GDPR. Finally, II members noted the ECJ ruling in the Austrian Postal case which essentially expanded Article 15 to require data controllers to name recipients of personal data when responding to access requests (not just categories) is problematic and unclear whether exemptions under the GDPR and Section 60 of the Irish Data Protection Act 2018 apply to this right. Potentially a private investigator may have been used on the data subject making the request and it is enquired whether insurers are required to provide the name of the private investigator based on this ruling. From the controllers and processors’ perspective: please provide information on the compliance with the data subject rights listed below, including on possible challenges (e.g.

…provide information on the compliance with the data subject rights listed below, including on possible challenges (e.g. manifestly unfounded or excessive requests, difficulty meeting deadlines, identification of data subjects, etc.). • Information obligations, including the type and level of detail of the information to be provided (Articles 12 to 14) In relation to the Right to be Informed (Article 13 and 14), II members’ view as Controllers, is that there is conflict between the amount of information to be disclosed (made more complex and expanded by the Irish DPC’s Whatsapp decision) and providing information to data subjects in a concise and intelligible format.

32 → 12

originalus šaltinis (PDF) ↗