Dec 22019

EDPB Stakeholder Event Highlights Continued Confusion over Data Subject Rights Compliance under the GDPR

William RM Long, Francesca Blythe and Jasmine Agyekum
, ,

On 4 November 2019, the European Data Protection Board (EDPB), the EU-wide data supervisory authority, held a stakeholders’ event on data subject rights under the GDPR. At the event, various stakeholders including e.g., corporates and NGOs, raised a number of issues including, for example:

  • Overall confusion around the scope and applicability of data subject rights. Stakeholders noted some requests were too broad, in turn, making it difficult to identify which data subject right was being exercised (e.g., erasure, objection or access);
  • Difficulties identifying data subjects, in particular children;
  • How to reconcile compliance with Article 12 of the GDPR (the requirement for information to be provided to data subjects in a concise, intelligible and easily accessible manner) and Article 15 (the requirement to provide extensive information to data subjects on the processing of their personal data);
  • Where technical data concerning a data subject is collected (e.g., clickstreams and page interactions), how this should be provided to data subjects in an accessible way;
  • How controllers can delete personal data and, if requested, prove to data protection authorities that personal data has been deleted; and
  • What is the burden of proof for compelling legitimate interest grounds in order to rebut the application of the right to object.

The wide-ranging concerns raised by stakeholders before the EDPB highlight the confusion organisations face in responding to data subject requests. Upcoming guidance to be developed and published by the EDPB will be welcomed in providing much needed clarity and a streamlined and best practice approach for organisations, who are receiving an influx of data subject requests since the entry into force of the GDPR.

William RM Long

London

wlong@sidley.com

Francesca Blythe

London

fblythe@sidley.com

Jasmine Agyekum

jagyekum@sidley.com

You might also like
UK Sets Out It’s “Pro-Innovation” Approach To AI Regulation

On 29 March 2023, the UK’s Department for Science Innovation and Technology (“DSIT”) published its long awaited White Paper on its “pro-innovation approach to AI regulation” (the “White Paper”), along with a corresponding impact assessment. The White Paper builds on the “proportionate, light touch and forward-looking” approach to AI regulation set out in the policy paper published in July 2022. Importantly, the UK has decided to take a different approach to regulating AI compared to the EU, opting for a decentralised sector-specific approach, with no new legislation expected at this time. Instead, the UK will regulate AI primarily through sector-specific, principles based guidance and existing laws, with an emphasis on an agile and innovation-friendly approach. This is in significant contrast to the EU’s proposed AI Act which is a standalone piece of horizontal legislation regulating all AI systems, irrespective of industry.

EU Moving Closer to an AI Act – Key Areas of Impact for Life Sciences/MedTech Companies

The European Union is moving closer to adopting the first major legislation to horizontally regulate artificial intelligence. Today, the European Parliament (Parliament) reached a provisional agreement on its internal position on the draft Artificial Intelligence Regulation (AI Act). The text will be adopted by Parliament committees in the coming weeks and by the Parliament plenary in June. The plenary adoption will trigger the next legislative step of trilogue negotiations with the European Council to agree on a final text. Once adopted, according to the text, the AI Act will become applicable 24 months after its entry into force (or 36 months according to the Council’s position), which is currently expected in the second half of 2025, at the earliest.

New EU Cyber Law for the Financial Services Industry with Significant Impact on ICT Service Providers

The new EU Regulation on Digital Operational Resilience for the Financial Sector (DORA) recently entered into force. DORA establishes cybersecurity requirements for information and communication technology (ICT) systems supporting the business processes of financial entities and represents a paradigm shift for the ICT sector.  Critical ICT third-party service providers, who are providing services to regulated financial entities, will also be directly regulated under DORA and subject to regulatory supervision by a regulator to be established under DORA (a so-called ‘Lead Overseer’).