Privacy Company has sent an open letter to European Commissioner Didier Reynders with ten proposals to make compliance with the GDPR easier. Some of these suggestions correspond to the proposals of the joint German data protection authorities and the Dutch government. The GDPR works well, but we see opportunities to improve the effectiveness of supervision and to strengthen support for compliance with the privacy rules. This blog is also available in Dutch.
Evaluation of the GDPR by the European Commission
The European Commission has started the evaluation of the General Data Protection Regulation. Pursuant to Article 97 of the GDPR, the Commission must submit its (public) report to the European Parliament and the Council no later than 25 May 2020. Recently, the sixteen regional German data protection authorities (DPAs) sent an open letter (available in English and in German) to the European Commission. In a blog, they identify nine key issues with the GDPR. The Dutch government has now also provided extensive input to the European Commission. This input can be found (in part) in the letter from Minister Dekker to the Lower House of Parliament. The input from the Netherlands can be found in more detail in a report by the Council of Ministers, with input from all member states in a survey on the GDPR. We will mention these suggestions briefly at the end of this blog.
The GDPR works
As an advisor to all kinds of small and large organisations from the private and public sector, Privacy Company sees that the GDPR works. Everywhere privacy officers have started to map existing processing operations, have conducted risk analyses and rolled out awareness campaigns. The GDPR has accomplished that personal data are much better protected than they were two years ago, and that compliance risks are high on the management agenda. In order to further increase support, the Commission can improve the GDPR in a number of areas, especially when it comes to the effectiveness of the supervision.
Good recommendations German DPAs and the Dutch government
We endorse many of the recommendations made by the German DPAs and the Dutch government. Our clients are also struggling with the extent of the right to a copy in case a customer files a data subject access request. We are affected by the large differences of opinion between the DPAs in their guidance on legitimate interests and direct marketing. Finally, we see a great deal of added value in the creation of legal privacy liability for manufacturers of devices and software that can be used to process personal data. It is impossible for most organisations to negotiate with international manufacturers themselves that they have to provide their devices and software in a privacy-friendly manner by default and permanently ensure a high level of security.
Apart from those suggestions, we have ten suggestion for the European Commission to facilitate compliance with the GDPR.
1. Transparent decision-making
We advocate a statutory publication requirement for all decisions from the DPAs. This allows everyone to learn from the explanations about the open standards. At present, a legal case against publication can sometimes take years and in fear of such litigation DPAs publish almost nothing. In order to understand how the GDPR should be applied in practice, it is essential that data controllers and processors worldwide be able to acquaint themselves with as many practical assessments as possible, even if it concerns a decision to reject a complaint because the DPA does not consider the complaint to be well-founded.
2. Knowledge sharing via English translations
We also advocate a legal obligation for the DPAs to translate any decision into English within a short period of time and to publish the decisions on the website of the European Data Protection Board. The Board or EDPB already publishes a limited number of decisions taken by DPAs, but this seems to be based on voluntary participation by DPA spokespersons. Any person affected by the GDPR and any organisation should have free access to all relevant explanations from a single central source. This source should be searchable on several criteria, such as the legal articles assessed and the nature of the sanction. This has the additional advantage that the DPAs can also coordinate their explanations better among themselves.
3. Simplification of data breach reporting
It is incomprehensible that all DPAs use their own ways and forms to report data breaches. We wholeheartedly agree with the Dutch government's contribution that there should be a single uniform digital form, but we find it even worse that a data controller has to fill in each form manually. This takes a lot of time and undermines support for the GDPR. The inefficiency of the process can result in some organisations deliberately not complying with the law. It creates frustration for organisations that spend a lot of time on careful reporting and increases the risks for data subjects who may not be informed that their data have been leaked. The European Commission should therefore ensure that there is a single uniform reporting form that can be filled in automatically via an API. It is too early to raise a higher threshold for reporting data breaches at this stage, as proposed by the German supervisory authorities. First of all, the process needs to be improved.
4. Knowledge sharing about data breaches
The obligation to report data breaches was of course not created in order to increase the administrative burden for organisations. The data breach reporting requirement should be a tool to raise awareness about the risks of unlawful access to personal data and to share knowledge about the measures that organisations can take to reduce these risks. Such practical, applicable knowledge is invaluable, especially for SMEs. In order to achieve the higher goal of the requirement to report data breaches, DPAs should share much more knowledge about reported data breaches and measures taken, and about the considerations when organisations should or should not report a data breach to data subjects. Moreover, in the case of current incidents, this information should be shared with national alertness organisations such as CERTs.
5. Clarity about cookie walls
The European Commission must provide clarity about cookie and payment walls in the GDPR, now that it is apparently not possible to set clear rules in the ePrivacy Regulation. After more than two years of negotiations, the member states in the Telecom Council have not come one inch closer to each other when it comes to cookies and similar tracking technology, such as the use of pixels (beacons) in newsletters. The latest proposal for a new ePrivacy Regulation fell at the last minute at the beginning of December and nobody knows what to do next. The DPAs give very different explanations. For organisations that do their best to comply with the GDPR, it is unclear what they can and cannot do in their consent questions about tracking cookies. Can you ask visitors to use settings to deselect more than 40 different advertising networks one by one? Are you allowed to seduce people with a large YES button and a tiny link to 'change your settings'? Can you force people to pay if they don't want to consent to tracking cookies? As privacy advisors, we don't know where the boundary lies. See also our blog Tear down that cookiewall!
6. Standard data processing agreement
The European Commission can remove an enormous administrative burden for organisations by developing a standard data processing agreement, based on the current Standard Contractual Clauses for the transfer of personal data to countries without an adequate level of protection. The Commission can offer a checklist with a black list of prohibited clauses. Article 28 of the GDPR contains a large number of obligations for data processors. For example, that they may only process personal data on documented instructions from the data controller, that they may only use sub-processors with the data controller’s written authorisation, that they must cooperate with audits and that they must assist in the performance of DPIAs. But reality is stubborn. Largescale cloud providers impose their own terms and conditions. For example, they ensure that the documented instructions from the data controller are equal to the content of the conditions drawn up by the provider itself, and the data controller can only withhold authorisation by terminating the contract. The EDPB has recently approved a data transfer agreement proposed by the Danish DPA. However, even this improved version is not sufficient to (re)gain control over personal data. Bottlenecks are for example the cost allocation to audit compliance with the provisions of a contract. The Dutch Ministry of Justice and Security, together with the EDPS, is considering uniform European purchasing terms for cloud services, at least for government organisations. But here lies a clear task for the European Commission, to simplify compliance for businesses and organisations outside the central government with a standard data processing agreement.
7. Scientific and statistical research
The Commission should clarify the exceptions for scientific and statistical research (in Articles 9(2) under j and 89 of the GDPR). It helps to delete the second sentence from recital 159. This sentence states that the concept of scientific research should be interpreted in a broad manner, to include applied research and privately funded research. In practice, this leads to legal uncertainty. Are organisations allowed to conduct research into medical data for commercial purposes without the explicit consent of patients? Should social media, conversely, open up their big personal data to scientific research? And if so, can you, as data subject, object against such processing? The answer to this question is closely linked to the question of whether the data is pseudonymous or anonymous. As advisors, we often refer to the guidelines of the regulators on anonymisation and to the explanation of the Dutch national statistical organisation CBS on protection against identifiability of statistical data. However, these two guidances do not lead to the same conclusions. The guidance should therefore be harmonised at European level. In any case, the GDPR could explain in a recital that data can never be anonymous as long as the source data are still available or regularly become available again, and as long as the 'anonymised' data can still be linked to the source data, by the provider, by the recipient or by any other third party.
8. Use of privacy labels
9. Public annual privacy accounts listed companies and government organisations
In fact, every organisation with a Data Protection Officer should write a privacy annual report as part of the permanent internal focus on compliance. But the Commission must put the heaviest administrative burden on the strongest shoulders. Listed companies and government organisations already have a great deal of experience in the management of compliance with open standards, such as objectives in the field of corporate social responsibility. There should be a statutory requirement for these organisations to publish an annual privacy account in which they account how they have governed compliance with (international) privacy laws, how often the topic has been discussed at the highest management level, how many FTEs and how much budget they have spent on compliance, what successes they have achieved, how many data breaches they have reported to the DPA, what risks they have identified and what milestones they want to achieve.
10. Reclaiming digital sovereignty
We support the Dutch government's efforts to investigate the possibilities of curbing the data power of large tech companies through the GDPR. The idea of introducing new enforcement instruments for the DPAs, such as the stationing of an employee of a DPA at a large tech company, appeals to us, but these are relatively small steps. We encourage the European Commission to develop bottom-up new strategies to regain digital sovereignty and to be able to effectively compete. There is ample knowledge in the Netherlands and Europe in the field of the technical development of hardware and software, (technical) public administration, digital ethics and privacy and competition law.
Key issues GDPR Dutch government
From the letter of Minister Dekker of 31 October 2019 to the Lower House.
In its contribution to the Council of Ministers, the Dutch government mentions three other points of attention for the European Commission, namely: