Jan 22019

EU Commission Decision Reconciles Data Protection Rules with the Need for Effective Trade Defence and Trade Policy Investigations

Wim Nauwelaerts and Paul Greaves
, ,

On December 17, 2018, European Commission Decision (EU) 2018/1996 (the ‘Decision’) was published in the Official Journal of the European Union. The Decision lays down rules designed to reconcile the rights of individuals respecting their personal data, with the need for effective trade defence and trade policy investigations in the EU.

The power to adopt the Decision is provided for by EU Regulation 2018/1725 (the ‘Regulation’), which regulates the processing of personal data by the European Union’s institutions, bodies, offices and agencies (‘Union Institutions and Bodies’). The Regulation imposes obligations on Union Institutions and Bodies with respect to personal data, many of which reflect the rules that the EU General Data Protection Regulation (the ‘GDPR’) imposes on companies, individuals and other organizations. The rules imposed by the Regulation include:

  • Obligations to provide certain ‘transparency’ information to individuals when processing those individuals’ personal data;
  • Obligations to comply with requests from individuals where they wish to, for example, access their personal data, have such personal data deleted, or restrict the processing of their personal data; and
  • Obligations to inform individuals, in certain circumstances, where there has been a data breach involving those individuals’ personal data.

The Decision recognises that during trade defence and trade policy investigations, the European Commission (the ‘Commission’) will inevitably collect and process personal data (for example, during verification visits). In some circumstances, the Commission’s compliance with certain obligations under the Regulation could jeopardize the Commission’s trade defence and trade policy activities. The Decision therefore sets out, for example:

  • Rules to be followed by the Commission to inform individuals of the processing of their personal data when the Commission is conducting those investigations;
  • The conditions under which the Commission can restrict the application of certain rights and obligations provided for by the Regulation; and
  • Additional requirements to be complied with where the Commission restricts the application of those rights and obligations. This includes a requirement on the Commission to keep a record which, amongst other things, sets out the justification for the restriction.
Wim Nauwelaerts

wnauwelaerts@sidley.com

Paul Greaves

pgreaves@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.

New EU Cyber Law for the Financial Services Industry with Significant Impact on ICT Service Providers

The new EU Regulation on Digital Operational Resilience for the Financial Sector (DORA) recently entered into force. DORA establishes cybersecurity requirements for information and communication technology (ICT) systems supporting the business processes of financial entities and represents a paradigm shift for the ICT sector.  Critical ICT third-party service providers, who are providing services to regulated financial entities, will also be directly regulated under DORA and subject to regulatory supervision by a regulator to be established under DORA (a so-called ‘Lead Overseer’).