The European Commission has published its roadmap for the preparation of the statutory report on the application of the GDPR, which is due in 2020. The roadmap published is open for public consultation by stakeholders and interested third parties until 29 April 2020.
The Commission has announced that its report will build on the two communications published by the European Commission to date, “Data protection rules as a trust-enabler in the EU and beyond – taking stock” (24 July 2019) and “Exchanging and Protecting Personal Data in a Globalised World” (10 January 2017). The report will also take into account the contributions received from the Council, the European Parliament, the European Data Protection Board and the GDPR Multi-Stakeholder Group.
The Commission has advanced that the report will cover in particular the following two topics: (i) international transfer of personal data to third countries (Chapter V of GDPR), with a special focus on existing adequacy decisions, and (ii) the cooperation and consistency mechanism between national data protection authorities (Chapter VII of GDPR).
Although it may be premature to extract conclusions from an unwritten report, it seems regretful that the Commission’s roadmap does not put an emphasis on other elements of the GDPR that have proven critical in its application. Besides the non-negligible issues surrounding international transfers and cooperation and consistency, companies in Europe have other equally pressing questions on the application of the GDPR. For example, the EC could also address and aim to resolve issues surrounding the selection of the correct legal basis and exception for cross-border data processing, or the conduct of DPIAs and the implementation of security measures that help companies avoid future liabilities.
Even the recent COVID-19 outbreak in Europe, and the different (and, sometimes, contradictory) positions that supervisory authorities are adopting across the EU, could call for a specific chapter in the report. For example, the Commission could consider reducing the strictures on the processing of health personal data and revamping cross-border coordination. The effectiveness of measures of public or private initiative, such as social-distancing orders, Covid-19 tracking apps, or telecommunications apps, may rely on this. One single pan-European approach, rather than several different national perspectives to the same issue, can be preferable to address these questions.
