d) Assessing the need to make use of the Commission’s empowerments

The Regulation 51 allows the Commission to issue implementing or delegated acts to further support the implementation of the new rules. The Commission will only make use of these empowerments when there is a clearly demonstrated added-value and based on feedback from stakeholders' consultation. In particular, the Commission will look into the issue of certification based on a study contracted with external experts and input and advice on this issue from the multi-stakeholder group on the Regulation established at the end of 2017. The work done by the European Union Agency for Network and Information Security (ENISA) in the field of cybersecurity will also be relevant in this context. e) Integration of the Regulation into the EEA-Agreement The Commission will pursue its work with the three EFTA States (Iceland, Liechtenstein, and Norway) in the European Economic Area (EEA) to integrate the Regulation into the EEA agreement. 52 It is only once the integration of the Regulation into the EEA agreement is in force, that personal data can flow freely between EU and EEA countries in the same way as they do between EU Member States. f) Withdrawal of the United Kingdom from the EU In the context of the negotiations of a withdrawal agreement between the EU and the United Kingdom on the basis of Article 50 of the Treaty on the European Union, the Commission will pursue the objective to ensure that the provisions of Union law on personal data protection applicable on the day preceding the withdrawal date continue to apply to personal data in the United Kingdom processed before the withdrawal date 53 . For example, the individuals concerned should continue to have the right to be informed, the right of access, the right to rectification, to erasure, to restriction of processing, to data portability as well as the right to object to processing and not to be subject to a decision based solely on automated processing, on the basis of relevant provisions of Union law applicable on the withdrawal date. Personal data referred to above should be stored no longer than is necessary for the purposes for which the personal data was processed. As of the withdrawal date, and subject to any transitional arrangement that may be contained in a possible withdrawal agreement, the rules of the Regulation for transfers of personal data to third countries will apply to the United Kingdom. 54 g) Taking stock in May 2019 After 25 May 2018, the Commission will closely monitor the application of the new rules and will stand ready to take action should any significant problems arise. One year after the Regulation enters into application (2019) the Commission will organise an event to take stock of different stakeholders’ experiences of implementing the Regulation. This will also feed into the report the Commission is required to produce by May 2020 on the evaluation and review of the Regulation. This report will focus in particular on international transfers and the provisions on cooperation and consistency which pertain to the work of data protection authorities. Conclusion On 25 May, a new single set of data protection rules will enter into effect across the EU. The new framework will bring significant benefits to individuals, companies, public administrations and other organisations alike. It is also an opportunity for the EU to become a global leader in personal data protection. But the reform can only succeed if all those involved embrace their obligations and their rights. Since the adoption of the Regulation in May 2016, the Commission has actively engaged with all concerned actors — governments, national authorities, business, civil society — in view of the application of the new rules. A significant amount of work has been dedicated to ensure widespread awareness and full preparation, but there is still work to do. Preparations are progressing at various speeds across Member States and among the various actors. Moreover, knowledge of the benefits and opportunities brought by the new rules is not evenly spread. There is in particular a need to step up awareness and accompany compliance efforts for SMEs The Commission therefore calls on all concerned actors to intensify the ongoing work to ensure the consistent application and interpretation of the new rules across the EU and to raise awareness among businesses and citizens alike. The Commission will support these efforts with funding and administrative support and will help raise general awareness, notably by launching the online guidance toolkit. Data are becoming very valuable for today's economy and are essential to daily lives of the citizens. The new rules offer a unique opportunity for businesses and the public alike. Businesses, especially the smaller ones, will be able to benefit from the innovation-friendly single set of rules and put their houses in order in terms of personal data to restore consumer's trust and use it as their competitive advantage across the EU. Citizens will be able to benefit from the stronger protection of personal data and gain better control over how the data are handled by the companies. In a modern world with a booming digital economy the European Union, its citizens and businesses must be fully equipped to reap the benefits and understand the consequences of data economy. The new Regulation offers the necessary tools to make Europe fit for the 21st century. The Commission will undertake the following actions: Towards Member States ·The Commission will continue working with Member States to promote consistency and limit fragmentation in the application of the Regulation, taking into account Member States’ room for specification under the new legislation; ·After May 2018 the Commission will closely monitor the application of the Regulation in Member States and take appropriate actions as necessary, including the recourse to infringement actions; Towards data protection authorities ·Until May 2018 the Commission will support the work of the data protection authorities in the context of the Article 29 Working Party and in the transition towards the future European Data Protection Board; after May 2018, it will contribute to the work of the European Data Protection Board; ·In 2018-2019 the Commission will co-finance (total budget of up to EUR 2 million) awareness-raising actions undertaken by data protection authorities at national level (projects implemented from mid-2018 onwards); Towards stakeholders ·The Commission will launch an online practical guidance tool that includes questions and answers aimed at citizens, businesses and public administrations. The Commission intends to promote this guidance to the target audiences through an information campaign addressed to business and the public in the run-up to May 2018 and afterwards; ·In 2018 and beyond the Commission will continue actively engaging with stakeholders notably through the multi-stakeholder group on the implementation of the Regulation and level of awareness of the new rules; Towards all actors ·In 2018-2019 the Commission will assess the need to make use of its power to adopt delegated or implementing acts; ·In May 2019, the Commission will take stock of the Regulation implementation and will report on the application of the new rules in 2020. Two workshops with the industry in July 2016 and April 2017, two business Round Tables in December 2016 and May 2017, a workshop on health data in October 2017, and a workshop with SMEs representatives in November 2017.

← sec_c_financial_support_for_national_campaigns_and_a · All articles

Source: EUR-Lex (Cellar) · retrieved 2026-09-07