EUROPEAN COMMISSION Brussels, 24.1.2018 COM(2018) 43 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Stronger protection, new opportunities - Commission guidance on the direct application of the General Data Protection Regulation as of 25 May 2018



Communication from the Commission to the European Parliament and the Council Stronger protection, new opportunities - Commission guidance on the direct application of the General Data Protection Regulation as of 25 May 2018 Introduction On 6 April 2016, the EU agreed to a major reform of its data protection framework, by adopting the data protection reform package, comprising the General Data Protection Regulation (GDPR) replacing the twenty years old Directive 95/46/EC (‘Data Protection Directive’) and the Police Directive. On 25 May 2018, the new EU-wide data protection instrument, the General Data Protection Regulation, ("the Regulation"), will become directly applicable, two years after its adoption and entry into force. The new Regulation will strengthen the protection of the individual’s right to personal data protection, reflecting the nature of data protection as a fundamental right for the European Union. Providing for a single set of rules directly applicable in the Member States legal orders, it will guarantee the free flow of personal data between EU Member States and reinforce trust and security of the consumers, two indispensable elements for a real Digital Single Market. In this way, the Regulation will open up new opportunities for businesses and companies, especially the smaller ones, also by making clearer rules for international transfers of data. Even though the new data protection framework has been built on the existing legislation, it will have a wide ranging impact and will require significant adjustments in certain aspects. For this reason, the Regulation provided for a transition period of 2 years - until 25 May 2018 - to give Member States and stakeholders time to fully prepare for the new legal framework. Over the past two years all stakeholders, from national administrations and national data protection authorities to data controllers and processors, have engaged in a number of activities to ensure that the importance and the scale of the changes brought about by the new data protection are well understood and that all actors are ready for its application. As the deadline of 25 May approaches, the Commission believes that it is necessary to take stock of this work and look into any further steps that may be useful to ensure all elements are in place for a successful entry into effect of the new framework. This Communication: ·recaps the main innovations and opportunities opened up by the new EU data protection legislation; ·takes stock of the preparatory work undertaken so far at EU level; ·outlines what the European Commission, national data protection authorities and national administrations should still do for bringing the preparation to a successful completion; ·Sets out measures that the Commission intends to take in the coming months. Furthermore, in parallel with the adoption of this Communication, the Commission launches an online toolkit to help stakeholders prepare for the application of the Regulation and, with the support of the Representation offices, an information campaign in all Member States. 1.THE NEW EU DATA PROTECTION FRAMEWORK — STRONGER PROTECTION and NEW OPPORTUNITIES The Regulation continues to follow the approach of the Data Protection Directive, but, building on 20 years of EU data protection legislation and relevant case law, it clarifies and modernises the data protection rules; it introduces a number of novel elements that strengthen the protection of individual rights and open opportunities for companies and business, in particular: ·A harmonised legal framework leading to a uniform application of rules to the benefit of the EU digital single market. This means one single set of rules for citizens and businesses. This will address today’s situation where EU Member States have implemented the Directive’s rules differently. To ensure a uniform and consistent application in all Member States, a one-stop-shop mechanism is introduced; ·A level-playing field for all companies operating in the EU market. The Regulation requires companies based outside the EU to apply the same rules as companies based in the EU if they are offering goods and services related to the personal data or are monitoring the behaviour of individuals in the Union. Companies operating from outside the EU and active in the Single market must, in certain circumstances, appoint a representative in the EU that citizens and authorities can address in addition to or instead of the company based abroad;

·The principles of data protection by design and by default creating incentives for innovative solutions to address data protection issues from the start; ·Stronger individuals’ rights: The Regulation introduces new transparency requirements; strengthened rights of information, access and erasure (‘right to be forgotten’); silence or inactivity will no longer be considered as valid consent as a clear affirmative action to express the consent is required; protecting children online; ·More control over personal data for individuals. The Regulation establishes a new right to data portability, allowing citizens to ask a company or an organisation to receive back personal data he/she provided to that company or organisation on the basis of consent or contract; it will also allow for such personal data to be transmitted directly to another company or organisation, when it is technically feasible. Since it allows the direct transmission of personal data from one company or organisation to another, this right will also support the free flow of personal data in the EU, avoid the 'lock-in' of personal data, and encourage competition between companies. Making it easier for citizens to switch between different service providers will encourage the development of new services in the context of the digital single market strategy; ·Stronger protection against data breaches. The Regulation lays down a comprehensive set of rules on personal data breaches. It clearly defines what is a ‘personal data breach’, it introduces an obligation to notify the supervisory authority at the latest within 72 hours when the data breach is likely to pose a risk to the individual’s rights and freedoms. In certain circumstances, it obliges to inform the person whose data is concerned by the breach. This greatly reinforces the protection compared to the current situation in the EU, in which only electronic communication service providers, operators of essential services and digital service providers are obliged to notify data breaches under the Directive on privacy and electronic communications ('ePrivacy Directive') and the Directive on the security of network and information systems (NIS) Directive respectively; ·The Regulation gives all data protection authorities the power to impose fines on controllers and processors. Currently not all of them have this power. This will allow for better implementation of the rules. The fines can go up to EUR 20 million or, in the case of a company, 4% of the worldwide annual turnover; ·More flexibility for controllers and processors processing personal data due to unambiguous provisions on responsibility (the accountability principle). The Regulation moves away from a system of notification to the principle of accountability. This latter is implemented through scalable obligations depending on risk (e.g. the presence of a Data Protection Officer or the obligation to conduct data protection impact assessments). A new tool is introduced in order to help to assess the risk before one starts with the processing: the data protection impact assessment. The latter is required whenever processing is likely to result in a high risk to the rights and freedoms of individuals. Three situations are specifically mentioned as such under the Regulation: when a company evaluates systematically and extensively personal aspects of an individual (including profiling), when it processes sensitive data on a large scale or systematically monitors public areas on a large scale. National data protection authorities will have to make public the lists of cases requiring a data protection impact assessment; ·More clarity on the obligations of processors and the responsibility of controllers when selecting a processor; ·A modern governance system to ensure that the rules are enforced more consistently and strongly. This includes harmonised powers for the data protection authorities including on fines and new mechanisms for these authorities to cooperate in a network; ·The protection of the personal data guaranteed by the Regulation travels with the data outside the EU ensuring a high level of protection. While the architecture of the rules on international transfers in the Regulation remains essentially the same as that of the 1995 Directive, the reform clarifies and simplifies their use and introduces new tools for transfers. As regards adequacy decisions the Regulation introduces a precise and detailed catalogue of elements that the Commission must take into account when assessing whether a foreign system adequately protects personal data. The Regulation also formalises and expands on the number of alternative transfer instruments, such as standard contractual clauses and binding corporate rules. The revised Regulation for EU institutions, bodies and offices and agencies and the Regulation on Privacy and Electronic Communications ('ePrivacy Regulation') which are currently being negotiated, once adopted, will ensure that the EU is equipped with a strong and comprehensive set of data protection rules . 2.Preparatory work undertaken so far at EU level The successful application of the Regulation requires cooperation between all those involved in data protection: Member States, including public administrations, national data protection authorities (DPAs), businesses, organisations processing personal data and individuals as well as the Commission. 2.1 Actions by the European Commission Shortly after the Regulation entered into force mid-2016, the Commission has engaged with Member States’ authorities, data protection authorities and stakeholders to prepare the application of the Regulation and provide support and advice. a) Supporting Member States and their authorities The Commission has been working very closely with the Member States to support their work during the transition period, with a view to ensuring the highest possible level of consistency. To this end, the Commission has set up an Expert Group to accompany the Member States in their effort to prepare for the Regulation. The Group, which met already 13 times, acts as a forum where the Member States can share their experiences and expertise . The Commission also engaged in bilateral meetings with Member States’ authorities to discuss issues arising at national level. b) Supporting the individual data protection authorities and the creation of the European Data Protection Board The Commission has been actively supporting the work of the Article 29 Working Party also in view of ensuring a smooth transition to the European Data Protection Board. c) International outreach The Regulation will further strengthen the EU ability to actively promote its data protection values and facilitate cross border data flows by encouraging the convergence of legal systems globally. EU data protection rules are increasingly recognised at international level as setting out some of the highest standards of data protection in the world. Council of Europe Convention 108, the only legally binding multilateral instrument in the area of personal data protection, is also being modernised. The Commission is working for it to reflect the same principles as those enshrined in the new EU data protection rules and thus help install a uniform set of high data protection standards. The Commission will actively promote the swift adoption of the modernised text of the Convention with a view to the EU becoming a Party to it. The Commission encourages non-EU countries to ratify Council of Europe Convention 108 and its additional Protocol.

Furthermore, several countries and regional organisations outside the EU, from our immediate neighbourhood to Asia, Latin America and Africa, are adopting new data protection legislation or updating the existing one in order to harness the opportunities offered by the global digital economy and respond to the growing demand for stronger data security and privacy protection. While countries differ in their approach and their level of legislative development, there are signs that the Regulation serves increasingly as a reference point and a source of inspiration. In this context, the Commission is pursuing its international outreach in line with its January 2017 Communication by actively engaging with key trading partners, notably in East and South-East Asia and Latin America to explore the possibility to adopt adequacy decisions. In particular, the Commission is working with Japan towards achieving a simultaneous finding of an adequate level of protection by both sides by early 2018, as announced by President Juncker and Prime Minister Abe in their joint declaration of 6 July 2017. Talks have also been launched with South Korea in view of a possible adequacy decision. The adoption of an adequacy decision would ensure the free flow of data with the concerned third countries while ensuring that a high level of protection applies when personal data is transferred from the EU to these countries. At the same time, the Commission is working with stakeholders with a view to harnessing the full potential of the GDPR toolkit for international transfers by developing alternative transfer mechanisms adapted to the particular needs of specific industries and/or operators. d) Engaging with stakeholders The Commission has organised a number of events to reach out to stakeholders. A new workshop aimed at consumers is planned for the first quarter of 2018. Dedicated sectoral discussions in areas such as research and financial services have also taken place. The Commission has also set up a multi-stakeholder group on the Regulation composed of civil society and business representatives, academics and practitioners. This group will advise the Commission in particular on how to achieve an appropriate level of awareness about the Regulation among stakeholders. Finally, the European Commission through its Framework Programme for research and innovation Horizon 2020 has funded actions to develop tools supporting the effective application of the rules under the Regulation in relation to consent and on privacy-preserving methods of data analytics such as multi-party computing and homomorphic encryption. 2.2 Actions by the Article 29 Working Party / European Data Protection Board The Article 29 Working Party, which groups all national data protection authorities, including the European Data Protection Supervisor, plays a key role in preparing the application of the Regulation by issuing guidelines for companies and other stakeholders. As enforcers of the Regulation and direct contacts for stakeholders, national data protection authorities are best placed to provide additional legal certainty regarding the interpretation of the Regulation. Guidelines/working documents by the Article 29 Working Party in view of the entry into application of the Regulation Right to data portability Adopted on 4-5 April 2017 Data protection officers Designation of the lead Supervisory Authority Data protection impact assessment Adopted on 3-4 October 2017 Administrative fines Adopted on 3-4 October 2017 Profiling Work ongoing Data breach Work ongoing Consent Work ongoing Transparency Work ongoing Certification and accreditation Work ongoing Adequacy referential Work ongoing Binding corporate rules for controllers Work ongoing Binding corporate rules for processors Work ongoing The Article 29 Working Party is working to update existing opinions, including on the tools for transferring data to non-EU countries. Since it is essential for operators to have a coherent and single set of guidelines, the current guidelines at national level need to be either repealed or brought into line with those adopted by the Article 29 Working Party/European Data Protection Board on the same topic. The Commission attaches great importance to the fact that those guidelines are subject to public consultation before finalisation. It is essential that stakeholders’ input in this process be as precise and concrete as possible as this will help identify best practices and bring industry and sectoral features to the attention of the Article 29 Working Party. The final responsibility for those guidelines remains with the Article 29 Working Party and the future European Data Protection Board, and the data protection authorities will refer to them when enforcing the Regulation. It should be possible to amend the guidelines in the light of developments and practices. To this end, it is essential for data protection authorities to promote a culture of dialogue with all stakeholders, including businesses. It is important to recall that, where questions regarding the interpretation and application of the Regulation arise, it will be for courts at national and EU level to provide the final interpretation of the Regulation. 3.Remaining steps for successful preparation 3.1 Member States to finalise the set-up of the legal framework at national level

The Regulation is directly applicable in all the Member States. This means that it enters into force and applies irrespective of any national law measures: the provisions of the Regulation can normally be directly relied on by citizens, business, public administrations and other organisations processing personal data. Nevertheless, in accordance with the Regulation, Member States have to take the necessary steps to adapt their legislation by repealing and amending existing laws, and setting up national data protection authorities, choosing an accreditation body and laying down the rules for the reconciliation of freedom of expression and data protection. Also, the Regulation gives Member States the possibility to further specify the application of data protection rules in specific fields: public sector, employment and social security, preventive and occupational medicine, public health, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, national identification number, public access to official documents, and obligations of secrecy. In addition, for genetic data, biometric data and data concerning health, the Regulation empowers Member States to maintain or introduce further conditions, including limitations. Member States’ actions in this context are framed by two elements: 1.Article 8 of the Charter, meaning that any national specification law must meet the requirements of Article 8 of the Charter (and the Regulation which builds on Article 8 of the Charter), and 2.Article 16(2) TFEU, under which national legislation cannot impinge on the free flow of personal data within the EU. The Regulation is the opportunity to simplify the legal environment, and so have fewer national rules and greater clarity for operators. When adapting their national legislation, Member States have to take into account the fact that any national measures which would have the result of creating an obstacle to the direct applicability of the Regulation and of jeopardising its simultaneous and uniform application in the whole of the EU are contrary to the Treaties. Repeating the text of regulations in national law is also prohibited (e.g. repeating definitions or the rights of individuals), unless such repetitions are strictly necessary for the sake of coherence and in order to make national laws comprehensible to those to whom they apply. Reproducing the text of the Regulation word for word in national specification law should be exceptional and justified, and cannot be used to add additional conditions or interpretations to the text of the regulation. The interpretation of the Regulation is left to the European courts (the national courts and ultimately the European Court of Justice) and not to the Member States’ legislators. The national legislator can therefore neither copy the text of the Regulation when it is not necessary in the light of the criteria provided by the case law, nor interpret it or add additional conditions to the rules directly applicable under the Regulation. If they did, operators throughout the Union would again be faced with fragmentation and would not know which rules they have to obey. At this stage, only two Member States have already adopted the relevant national legislation; the remaining Member States are at different stages in their legislative procedures and have schedules for adopting the legislation by 25 May 2018. It is important to give operators enough time to prepare for all the provisions that they have to comply with. Where Member States do not take the necessary actions required under the Regulation, are late in taking them or make use of the specification clauses provided for under the Regulation in a manner contrary to the Regulation, the Commission will make use of all the tools it has at its disposal, including recourse to the infringement procedure.



3.2 Data protection authorities to ensure that the new independent European Data Protection Board is fully operational It is essential that the new body established by the Regulation, the European Data Protection Board, the successor of the Article 29 Working Party, is fully operational as of 25 May 2018. The European Data Protection Supervisor, which is the data protection authority responsible for supervising EU institutions and bodies, will provide the secretariat of the European Data Protection Board to enhance synergies and effectiveness. In the past months, the European Data Protection Supervisor has started the necessary preparation to this effect. The European Data Protection Board will be at the centre of data protection in Europe. It will contribute to a consistent application of data protection law and provide a strong basis for cooperation among data protection authorities, including the European Data Protection Supervisor. The European Data Protection Board will not only issue guidelines on how to interpret core concepts of the Regulation but will also be called on to issue binding decisions on disputes regarding cross-border processing. This will ensure the uniform application of EU rules and prevent the same case being dealt with differently in different Member States. The smooth and efficient functioning of the European Data Protection Board is therefore a condition for the system as a whole to function well. More than ever before, the European Data Protection Board will have to create a common data protection culture among all the national data protection authorities to ensure that the rules of the Regulation are interpreted consistently. The Regulation fosters the cooperation between the data protection authorities by giving them the tools to cooperate effectively and efficiently: they will notably be able to do joint operations, adopt decision in agreement and resolve divergences they might have concerning the interpretation of the Regulation within the Board by means of opinions and biding decisions. The Commission encourages the data protection authorities to embrace these changes and adjust their functioning, financing and work culture to be able to meet the new rights and obligations. 3.3 Member States to provide the necessary financial and human resources to national data protection authorities The establishment of fully independent supervisory authorities in each Member State is essential to ensure the protection of natural persons with regard to the processing of their personal data in the EU. Supervisory authorities cannot effectively safeguard individual rights and freedoms unless they act completely independently. Any failure to ensure their independence and the effective exercise of their powers has a wide-ranging negative impact on the enforcement of data protection legislation. The Regulation codifies the requirement of any data protection authority to act completely independently. It strengthens national data protection authorities’ independence and provides them with uniform powers across the EU, so that they are properly equipped to deal effectively with complaints, carry out effective investigations, take binding decisions and impose effective and dissuasive sanctions. It also gives them the power to issue administrative fines on controllers or processors up to EUR 20 million, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

The data protection authorities are the natural interlocutors and first point of contact for the general public, businesses and public administrations for questions regarding the Regulation. The data protection authorities' role includes informing controllers and processors of their obligations and raising the general public’s awareness and understanding of the risks, rules, safeguards and rights in relation to data processing. It does not mean, however, that controllers and processors should expect to be provided by the data protection authorities with the kind of tailored, individualised legal advice that only a lawyer or a data protection officer can provide. The national data protection authorities therefore play a central role, but the relative imbalance between the human and financial resources allocated to them in different Member States can jeopardise their effectiveness and ultimately the complete independence required under the Regulation. It can also negatively impact the way the data protection authorities are able to exercise powers such as their investigation powers. Member States are encouraged to fulfil their legal obligation to provide their national data protection authority with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of their powers. 3.4 Businesses, public administrations and other organisations processing data to get ready for the application of the new rules The Regulation did not substantially change the core concepts and principles of the data protection legislation put in place back in 1995. This should mean that the vast majority of controllers and processors, provided that they are already in compliance with the existing EU data protection laws, will not need to make major changes to their data processing operations to comply with the Regulation. The Regulation impacts most on operators whose core business is data processing and/or dealing with sensitive data. It also impacts on those that regularly and systematically monitor individuals on a large scale. These operators will most probably have to appoint a data protection officer, conduct a data protection impact assessment and notify data breaches if there is a risk to the rights and freedoms of individuals.Regulation It is important for controllers and processors to undertake thorough reviews of their data policy cycle so as to clearly identify which data they hold, for what purpose and on what legal basis (e.g. cloud environment; operators in the financial sector). They also need to assess the contracts in place, in particular those between controllers and processors, the avenues for international transfers and the overall governance (what IT and organisational measures to have in place), including the appointment of a Data Protection Officer. An essential element in this process is to ensure that the highest level of management is involved in such reviews, provides its input and is regularly updated and consulted on changes to the business’s data policy. To this end, some operators make recourse to compliance checklists (either internal or external), seek advice from consultancies and law firms and look for products that can deliver on the requirements of data protection by design and by default. Each sector must work out arrangements that are appropriate to the specific nature of its area and are adapted to their business model. Businesses and other organisations processing data will also be able to take advantage of the new tools provided for in the Regulation as an element to demonstrate compliance, such as codes of conduct and certification mechanisms. These constitute bottom-up approaches which come from the business community, associations or other organisations representing categories of controllers or processors and reflect best practice, important developments in a given sector or can inform about the level of data protection required by certain products and services. The Regulation provides for a streamlined set of rules for such mechanisms while taking into account market realities (e.g. certification by a certification body or by a data protection authority). However, while big companies are actively preparing for the application of the new rules, many SMEs are not yet fully aware of the forthcoming data protection rules. In short, operators should prepare and adjust to the new rules and see the Regulation as: ·an opportunity to put their house in order in terms of what personal data they process and how they manage it; ·an obligation to develop privacy- and data protection-friendly products and build a new relationship with their customers based on transparency and trust; and ·an opportunity to reset their relations with data protection authorities through accountability and proactive compliance. 3.5 To inform stakeholders, in particular citizens and small and medium-size businesses The success of the Regulation rests on proper awareness of all those affected by the new rules (the business community and other organisations processing data, the public sector and citizens). At national level, the task of raising awareness and being the first point of contact for controllers, processors and individuals lies primarily with the data protection authorities. As enforcers of data protection rules in their territory, data protection authorities are also the best placed to explain the changes introduced by the Regulation to companies and the public sector, and to familiarise citizens with their rights. Data protection authorities have started informing stakeholders in line with the specific national approach. Some hold seminars with public administrations, including at regional and local level, and run workshops with different business sectors in order to raise awareness about the main provisions of the Regulation. Some run specific training programmes for data protection officers. Most of them provide information materials in various formats on their websites (checklists, videos, etc.). However, there is not yet a sufficiently widespread level of awareness among the citizens of the changes and enhanced right that the new data protection rules will bring. The training and awareness raising initiative set in motion by Data Protection Authorities should be continued and intensified, with a particular focus on SMEs. Furthermore, national sectoral administrations can support the activities of data protection authorities and based on their input do their own outreach among the different stakeholders. 4.Next steps In the coming months, the Commission will continue actively supporting all actors in preparing for the application of the Regulation. a) Work with Member States

The Commission will continue working with Member States in the lead-up to May 2018. From May 2018 onward, it will monitor how Member States apply the new rules and take appropriate action as necessary. b) New online guidance in all EU languages and awareness-raising activities The Commission is making available practical guidance materials to help businesses, in particular SMEs, public authorities and the public to comply with and benefit from the new data protection rules. The guidance takes the form of a practical online tool available in all EU languages. The online tool will be regularly updated and is intended to serve three main target audiences: citizens, businesses (in particular SMEs) and other organisations, and public administrations. It comprises questions and answers selected based on feedback received from stakeholders with practical examples and links to various sources of information (e.g. articles of the Regulation; guidelines of Article 29 Working Party/European Data Protection Board; and materials developed at national level). The Commission will regularly bring up to date the tool, adding questions and updating the answers, based on the feedback received and in the light of any new issues arising from implementation. The guidance will be promoted through an information campaign and dissemination activities in all Member States, targeting businesses and the public. As the Regulation provides for stronger individual rights, the Commission will also engage in awareness-raising activities and participate in events across the Member States to inform citizens about the benefits and impact of the Regulation.



c) Financial support for national campaigns and awareness raising The Commission is supporting awareness-raising and compliance efforts undertaken at national level by awarding grants that can be used to provide training within data protection authorities, public administrations, legal professions and data protection officers and to familiarise them with the Regulation. Around EUR 1.7 million will be allocated to six beneficiaries covering more than half of EU Member States. Funding will be targeted at local public authorities, including data protection officers of local public authorities, of public authorities and from the private sector, judges and lawyers. The grants will be used to develop training materials for data protection authorities, data protection officers and other professionals, as well as ‘train the trainer’ programmes. The Commission has also issued a call for proposals specifically aimed at data protection authorities. It will have a total budget of up to EUR 2 million and will support them in reaching out to stakeholders. The objective is to provide 80 % co-financing to measures taken by data protection authorities in 2018-2019 to raise awareness among businesses, in particular SMEs, and reply to their queries. This funding can also be used to raise awareness among the general public. d) Assessing the need to make use of the Commission’s empowerments The Regulation allows the Commission to issue implementing or delegated acts to further support the implementation of the new rules. The Commission will only make use of these empowerments when there is a clearly demonstrated added-value and based on feedback from stakeholders' consultation. In particular, the Commission will look into the issue of certification based on a study contracted with external experts and input and advice on this issue from the multi-stakeholder group on the Regulation established at the end of 2017. The work done by the European Union Agency for Network and Information Security (ENISA) in the field of cybersecurity will also be relevant in this context.



e) Integration of the Regulation into the EEA-Agreement The Commission will pursue its work with the three EFTA States (Iceland, Liechtenstein, and Norway) in the European Economic Area (EEA) to integrate the Regulation into the EEA agreement. It is only once the integration of the Regulation into the EEA agreement is in force, that personal data can flow freely between EU and EEA countries in the same way as they do between EU Member States. f) Withdrawal of the United Kingdom from the EU In the context of the negotiations of a withdrawal agreement between the EU and the United Kingdom on the basis of Article 50 of the Treaty on the European Union, the Commission will pursue the objective to ensure that the provisions of Union law on personal data protection applicable on the day preceding the withdrawal date continue to apply to personal data in the United Kingdom processed before the withdrawal date. For example, the individuals concerned should continue to have the right to be informed, the right of access, the right to rectification, to erasure, to restriction of processing, to data portability as well as the right to object to processing and not to be subject to a decision based solely on automated processing, on the basis of relevant provisions of Union law applicable on the withdrawal date. Personal data referred to above should be stored no longer than is necessary for the purposes for which the personal data was processed.