d) Assessing the need to make use of the Commission’s empowerments

The Regulation 51 allows the Commission to issue implementing or delegated acts to further support the implementation of the new rules. The Commission will only make use of these empowerments when there is a clearly demonstrated added-value and based on feedback from stakeholders' consultation. In particular, the Commission will look into the issue of certification based on a study contracted with external experts and input and advice on this issue from the multi-stakeholder group on the Regulation established at the end of 2017. The work done by the European Union Agency for Network and Information Security (ENISA) in the field of cybersecurity will also be relevant in this context. e) Integration of the Regulation into the EEA-Agreement The Commission will pursue its work with the three EFTA States (Iceland, Liechtenstein, and Norway) in the European Economic Area (EEA) to integrate the Regulation into the EEA agreement. 52 It is only once the integration of the Regulation into the EEA agreement is in force, that personal data can flow freely between EU and EEA countries in the same way as they do between EU Member States. f) Withdrawal of the United Kingdom from the EU In the context of the negotiations of a withdrawal agreement between the EU and the United Kingdom on the basis of Article 50 of the Treaty on the European Union, the Commission will pursue the objective to ensure that the provisions of Union law on personal data protection applicable on the day preceding the withdrawal date continue to apply to personal data in the United Kingdom processed before the withdrawal date 53 . For example, the individuals concerned should continue to have the right to be informed, the right of access, the right to rectification, to erasure, to restriction of processing, to data portability as well as the right to object to processing and not to be subject to a decision based solely on automated processing, on the basis of relevant provisions of Union law applicable on the withdrawal date. Personal data referred to above should be stored no longer than is necessary for the purposes for which the personal data was processed. As of the withdrawal date, and subject to any transitional arrangement that may be contained in a possible withdrawal agreement, the rules of the Regulation for transfers of personal data to third countries will apply to the United Kingdom. 54 g) Taking stock in May 2019 After 25 May 2018, the Commission will closely monitor the application of the new rules and will stand ready to take action should any significant problems arise. One year after the Regulation enters into application (2019) the Commission will organise an event to take stock of different stakeholders’ experiences of implementing the Regulation. This will also feed into the report the Commission is required to produce by May 2020 on the evaluation and review of the Regulation. This report will focus in particular on international transfers and the provisions on cooperation and consistency which pertain to the work of data protection authorities. Conclusion On 25 May, a new single set of data protection rules will enter into effect across the EU. The new framework will bring significant benefits to individuals, companies, public administrations and other organisations alike. It is also an opportunity for the EU to become a global leader in personal data protection. But the reform can only succeed if all those involved embrace their obligations and their rights. Since the adoption of the Regulation in May 2016, the Commission has actively engaged with all concerned actors — governments, national authorities, business, civil society — in view of the application of the new rules. A significant amount of work has been dedicated to ensure widespread awareness and full preparation, but there is still work to do. Preparations are progressing at various speeds across Member States and among the various actors. Moreover, knowledge of the benefits and opportunities brought by the new rules is not evenly spread. There is in particular a need to step up awareness and accompany compliance efforts for SMEs The Commission therefore calls on all concerned actors to intensify the ongoing work to ensure the consistent application and interpretation of the new rules across the EU and to raise awareness among businesses and citizens alike. The Commission will support these efforts with funding and administrative support and will help raise general awareness, notably by launching the online guidance toolkit. Data are becoming very valuable for today's economy and are essential to daily lives of the citizens. The new rules offer a unique opportunity for businesses and the public alike. Businesses, especially the smaller ones, will be able to benefit from the innovation-friendly single set of rules and put their houses in order in terms of personal data to restore consumer's trust and use it as their competitive advantage across the EU. Citizens will be able to benefit from the stronger protection of personal data and gain better control over how the data are handled by the companies. In a modern world with a booming digital economy the European Union, its citizens and businesses must be fully equipped to reap the benefits and understand the consequences of data economy. The new Regulation offers the necessary tools to make Europe fit for the 21st century. (1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016. (2) Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281 of 23.11.95. (3) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, OJ L 119, 4.5.2016. (4) The Regulation has been in force since 24 May 2016 and will apply as of 25 May 2018. (5) Article 8 of the EU Charter of Fundamental Rights and Article 16 TFEU. (6) https://ec.europa.eu/commission/sites/beta-political/files/letter-of-intent-2017_en.pdf . (7) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), OJ L 201, 31.7.2002, p. 37–47. According to Article 95 GDPR, the GDPR shall not impose additional obligations on natural or legal persons in relation to matters for which they are subject to specific obligations with the same objective set out in Directive 2002/58/EC. This means, for example, that entities covered by the e-Privacy Directive are subject to that Directive's obligation to notify a personal data breach in as far as the breach concerns a service which is materially covered by the ePrivacy Directive. No additional obligations are imposed on them by the GDPR in that respect. (8) Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, OJ L 194, 19.7.2016, p. 1–30. Entities within the scope of the NIS Directive should notify incidents having a significant or substantial impact on the provision of some of their services. The incident notification under the NIS Directive is without prejudice to the breach notification under the Regulation. (9) Article 35 of the Regulation. (10) Commission Communication on Exchanging and Protecting Personal Data in a Globalised World, COM(2017)7 final. (11) Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, COM(2017) 8 final. (12) Proposal for a Regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (Regulation on Privacy and Electronic Communications), COM(2017) 10 final. (13) Until the ePrivacy Regulation's adoption and entry into application, Directive 2002/58/EC applies as lex specialis to the Regulation. (14) For a complete list of the meetings, agendas, summary of discussions and overview of the state of play of legislation in the different Member States see http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetail&groupID=3461 . (15) For instance, the Commission will provide to the European Data Protection Board the possibility to use the Internal Market Information System (IMI) for the communication between its members. (16) Reflection Paper on Harnessing Globalisation COM(2017)240. (17) Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No 108) and the 2001 Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows (ETS No 181). The Convention is open to non-members of the Council of Europe, has already been ratified by 51 countries (including by Uruguay, Mauritius, Senegal and Tunisia). (18) See e.g. Data Protection Standards of the Ibero-American States’, http://www.redipd.es/documentacion/common/Estandares_eng_Con_logo_RIPD.pdf (19) COM(2017)7. (20) COM(2017)7 ibid p. 10-11. (21) http://europa.eu/rapid/press-release_STATEMENT-17-1917_en.htm . (22) COM(2017)7 ibid p. 10-11. (23) Two workshops with the industry in July 2016 and April 2017, two business Round Tables in December 2016 and May 2017, a workshop on health data in October 2017, and a workshop with SMEs representatives in November 2017. (24) http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetail&groupID=3537 . (25) https://ec.europa.eu/programmes/horizon2020/h2020-sections (26) All adopted guidelines are available at: http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=50083. (27) Article 288 TFEU. (28) Article 54(1) Regulation (29) Article 43(1) Regulation provides for Member States to offer two possible accreditation methods to certification bodies, i.e. by the national data protection supervisory authority established in accordance with data protection legislation and/or by the national accreditation body established under Regulation (EC) No 765/2008 on Accreditation and Market Surveillance. The European Cooperation for Accreditation ('EA', recognised under Regulation 765/2008), which gathers national accreditation bodies, and the supervisory authorities of the GDPR should closely cooperate to this effect. (30) Article 85(1) Regulation. (31) Articles 6(2) Regulation. (32) Articles 88 and 9(2)(b) Regulation. The European Pillar of Social Rights also states that 'Workers have the right to have their personal data protected in the employment context'. (2017/C 428/09, OJ C 428, 13.12.2017, p. 10–15) (33) Article 9(2)(h) and (i) Regulation. (34) Article 9(2)(j) Regulation. (35) Article 87 Regulation. (36) Article 86 Regulation. (37) Article 90 Regulation. (38) Article 9(4) Regulation. (39) Case 94/77 Fratelli Zerbone Snc v Amministrazione delle finanze dello Stato ECLI:EU:C:1978:17 and 101. (40) Recital 8 Regulation. (41) Austria ( http://www.ris.bka.gv.at/Dokumente/BgblAuth/BGBLA_2017_I_120/BGBLA_2017_I_120.pdf ); Germany ( https://www.bgbl.de/xaver/bgbl/start.xav?start=%2F%2F*%5B%40attr_id%3D%27bgbl117s2097.pdf%27 %5D#__bgbl__%2F%2F*%5B%40attr_id%3D%27bgbl117s2097.pdf%27 %5D__1513091793362 ). (42) For the overview of the state of play of the legislative process in the different Member States see http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetail&groupID=3461 (43) The European Data Protection Board will be an EU body with legal personality in charge of ensuring the consistent application of the Regulation. It will be composed of the head of each data protection authority and of the European Data Protection Supervisor, or their representatives. (44) Recital 117 and previously stated already in Recital 62 of Directive 95/46. (45) Communication from the Commission to the European Parliament and the Council on the follow-up of the Work Programme for better implementation of the Data Protection Directive, COM(2007) 87 final, 7 March 2007. (46) Article 52 Regulation. (47) Article 52(4) Regulation. (48) The guidance will contribute to a better understanding of EU data protection rules, but only the text of the Regulation has legal force. As a consequence, only the Regulation is liable to create rights and obligations for individuals. (49) Grants provided under the Rights and Citizenship 2016 Programme https://ec.europa.eu/research/participants/portal/desktop/en/opportunities/rec/calls/rec-data-2016.html#c,topics=callIdentifier/t/REC-DATA-2016/1/1/1/default-group&callStatus/t/Forthcoming/1/1/0/default-group&callStatus/t/Open/1/1/0/default-group&callStatus/t/Closed/1/1/0/default-group&+identifier/desc ). (50) http://ec.europa.eu/research/participants/portal/desktop/en/opportunities/rec/topics/rec-rdat-trai-ag-2017.html (51) Delegated act for information to be presented by the icons and the procedures for providing standardised icons (Article 12(8) Regulation); Delegated act for requirements to be taken into account for certification mechanism (Article 43(8) Regulation); implementing act for laying down technical standards for certification mechanisms and data protection seals and marks, and mechanisms to promote and recognise those certification mechanisms, seals and marks (Article 43(9) Regulation); implementing act for the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules (Article 47(3) Regulation); implementing acts for format and procedures for mutual assistance and for the exchange of information by electronic means between supervisory authorities (Articles 61(9) and 67 Regulation). (52) For information on the state of play, see http://www.efta.int/eea-lex/32016R0679. (53) https://ec.europa.eu/commission/publications/position-paper-use-data-and-protection-information-obtained-or-processed-withdrawal-date_en (54) See Commission Notice to stakeholders: withdrawal of the United Kingdom and EU rules in the field of data protection (http://ec.europa.eu/newsroom/just/document.cfm?action=display&doc_id=49245).

← doc__heading__7__para__3 · All articles · doc__heading__8__para →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07 · Text as adopted (Official Journal); later amendments are not incorporated in this text.