Assessment by the European Commission of two years of the GDPR’s application

What happened?

On 24 June 2020, the European Commission (“Commission”) published its first evaluation¹  of the General Data Protection Regulation (“GDPR”)²  since its entry into application on 25 May 2018 (the “Report”).

The Report focuses on international transfers and the manner in which the cooperation and consistency mechanisms provided for under the GDPR are applied. It also refers to several issues surrounding the GDPR’s implementation amongst which are the challenges faced by small and medium-sized enterprises (“SMEs”) as to their compliance with the GDPR or the way specific technologies such as artificial intelligence, blockchain or the Internet of Things implement GDPR principles.

The Report also highlights that the GDPR provides a strong and flexible framework with respect to the processing of personal data (including health data) as part of the monitoring of epidemics such as the current COVID-19 pandemic. In this respect, the Commission expresses its intention to follow closely the development and the use of apps in the context of the COVID-19 pandemic and refers to its previous guidance in that area.

What is the overall assessment?  

While the Commission admits that it is still early to draw definitive conclusions, the Commission considers the GDPR did successfully reach most of its objectives.

The GDPR notably conferred more awareness on data subjects in the exercise of their rights and Member States have progressed in effectively supporting their respective data protection authorities, which have used their corrective powers in a reasonable manner since 25 May 2018. Regarding this last point, however, the Report highlights that national data protection authorities have also imposed administrative fines, certain of which amounted to hundreds of thousands of euros and even to several million euros (against entities of the Google group).

The Commission points out that the Luxembourg data protection authority (Commission Nationale pour la Protection des Données), which acts as a lead authority in several cross-border cases due to the presence of a certain number of big tech companies on its territory, has benefited from one of the greatest increases in human and financial resources (as a percentage)³ . Between 2016 and 2020, it is expected, within the European Economic Area (“EEA”), to have (i) the fourth most significant growth in staff (153%) (following Ireland, Finland and the Netherlands), and (ii) the second most significant growth in budget (226%) after Ireland.

What are the remaining challenges?

Notwithstanding the GDPR’s achievements after two years of application, the Commission has also identified several areas where the enforcement of the GDPR may be improved or where future actions would be necessary, such as:

• simplifying data subjects’ rights enforcement, in particular for the right of portability which has not reached its full potential yet and is exercised in few sectors only (such as the banking and telecommunications sectors);
• providing standard contractual clauses ("SCCs") between controllers and processors (under Article 28 of the GDPR) and continuing the ongoing work on the modernisation of the SCCs for international transfers (under Article 46 of the GDPR)⁴ ;
• improving handling of cross-border cases by national authorities and the implementation of joint investigations;
• limiting the use of specification clauses (i.e. where the GDPR gives Member States the possibility to put in place specific rules for certain specified processing situations), which create fragmentation between Member States’ legislation (for instance, regarding the age for child consent in relation to information society services);
• developing more practical tools and resources to help SMEs comply with the GDPR; and
• reflecting on potential amendments that could be made to specific provisions of the GDPR.

What’s next?

The Commission will release a new evaluation in 2024. In the meantime, it will continue its work aiming at promoting convergence of data protection rules and developing international cooperation in the field of data protection. To that end, the Commission invites data protection authorities to ensure their national guidance is fully in line with guidelines adopted by the European Data Protection Board (the “EDPB”)⁵  and encourages both the EDPB and national data protection authorities to adopt further practical guidelines to provide concrete answers on issues faced by the various stakeholders when they apply the GDPR.

Finally the Commission has stated that it will report at a later stage on the evaluation of the existing adequacy decisions, such decisions constituting a legal basis for the transfer of personal data from the EEA to a third country⁶ .