EUROPEAN COMMISSION Brussels, 24.7.2019 COM(2019) 374 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Data protection rules as a trust-enabler in the EU and beyond – taking stock

















Communication from the Commission to the European Parliament and the Council Data protection rules as a trust-enabler in the EU and beyond – taking stock I.Introduction The General Data Protection Regulation (hereafter ‘the Regulation’) applies across the European Union since over one year. It is at the centre of a coherent and modernised EU data protection landscape that also includes the Data Protection Law Enforcement Directive and the Data Protection Regulation for EU institutions and bodies. This framework is to be completed by the e-Privacy Regulation which is currently in the legislative process. Strong data protection rules are essential to guarantee the fundamental right to the protection of personal data. They are central to a democratic society and an important component of an increasingly data-driven economy. The EU aspires to seize the many opportunities that the digital transformation offers in terms of services, jobs and innovation, while at the same time tackling the challenges these bring. Identity theft, leaks of sensitive data, discrimination of individuals, in-built bias, sharing illegal content and the development of intrusive surveillance tools are just a few examples of issues that increasingly feature in the public debate where it is clear that people expect their data to be protected. Data protection has become a truly global phenomenon as people around the world increasingly cherish and value the protection and security of their data. Many countries have adopted or are in the process of adopting comprehensive data protection rules based on principles similar to those of the Regulation, resulting in a global convergence of data protection rules. This offers new opportunities to facilitate data flows, between commercial operators or public authorities, while improving the level of protection for the personal data in the EU and across the globe. Data protection is taken more seriously than ever before and it has a wide-ranging impact on different stakeholders and sectors. The Commission is determined to lead the EU to a successful implementation of the new data protection regime and to support all aspects of it becoming fully operational. With this Communication, the Commission takes stock of the results achieved so far as in relation to the consistent implementation of the data protection rules across the EU, the functioning of the new governance system, the impact on citizens and businesses and the EU’s efforts in promoting global convergence of data protection regimes. It follows-up on the Commission Communication on the application of the Regulation of January 2018, and it has been informed by the work of the Multi-stakeholder Group, in particular its contribution to the one-year stocktaking exercise as well as the discussions held at the stocktaking event organised by the Commission on 13 June 2019. This Communication is also a contribution to the review that the Commission plans to carry out by May 2020. The EU data protection legislative framework is a cornerstone of the European human-centric approach to innovation. It is becoming part of the regulatory floor for a widening range of policies including health and research, artificial intelligence, transport, energy, competition and law enforcement. The Commission has consistently emphasised the importance of a proper implementation and enforcement of the new data protection rules, as highlighted in its Communication on the application of the Regulation issued in January 2018 and its Guidance on the use of personal data in the electoral context published in September 2018. At the time of this Communication, a lot of progress had been made towards this objective, although more work is certainly needed for the Regulation to become fully operational. II.One continent, one law: the data protection framework is in place in Member States One key objective of the Regulation was to do away with a fragmented landscape of 28 different national laws that existed under the previous Data Protection Directive and to provide legal certainty for individuals and businesses throughout the EU. That objective has been largely met.



The harmonisation of the legal framework Although the Regulation is directly applicable in the Member States, it obliged them to take a number of legal steps at national level, in particular to set up and allocate powers to the national data protection authorities, lay down rules on specific issues, such as the reconciliation of the protection of personal data with freedom of expression and information, and amend or repeal sectoral legislation with data protection aspects. At the time of this Communication, all but three Member States had updated their national data protection law. Work on adapting sectoral laws is still on-going at national level. Following its incorporation in the European Economic Area Agreement, the application of the Regulation was extended to Norway, Iceland and Lichtenstein which have also adopted their national data protection law. However, stakeholders are calling for an even higher degree of harmonisation in some areas. Indeed, the Regulation allows Member States some scope to further specify its application in certain areas such as the age of consent by children for online services or the processing of personal data in areas such as medicine and public health. In this case, the action of Member States is framed by two elements: I)any national specification law must meet the requirements of the Charter of Fundamental Rights (and not go beyond the limits set by the Regulation which builds on the Charter); II)it may not impinge on the free flow of personal data within the EU. In some instances, Member States have introduced national requirements on top of the Regulation, in particular through many sectoral laws and this leads to fragmentation and results in creating unnecessary burdens. One example of an additional requirement introduced by Member States on top of the Regulation is the obligation under the German legislation to designate a Data Protection Officer in companies with 20 employees or more permanently involved in automated processing of personal data. Continuing efforts towards greater harmonisation The Commission engages in bilateral dialogues with national authorities, where it pays particular attention to the national measures in relation to:

·the effective independence of data protection authorities, including through adequate financial, human and technical resources; ·how national laws restrict the rights of data subjects; ·the fact that national legislation should not introduce requirements going beyond the Regulation when there is no margin for specification, such as additional conditions for processing; ·fulfilling the obligation to reconcile the right to the protection of personal data with freedom of expression and information, taking into account that this obligation should not be misused to creating a chilling effect on journalistic work. The work of the data protection authorities, cooperating in the context of the European Data Protection Board (‘the Board’), is a key driver to a consistent application of the new rules: enforcement actions affecting several Member States go through the cooperation and consistency mechanism within the Board and the guidelines adopted by the Board contribute to a harmonised understanding of the Regulation. There is nevertheless an expectation on the part of stakeholders for the data protection authorities to go further in this direction. The work of national courts and the Court of Justice of the European Union is also helping to create consistent interpretation of data protection rules. National courts have recently issued judgements invalidating provisions in national laws which depart from the Regulation. III.All the pieces of the new governance system are falling into place The Regulation created a new governance structure, putting at its centre the independent national data protection authorities, as enforcers of the Regulation and first contact points for stakeholders. While most data protection authorities have benefited in the past year from increased resources, there still remain great differences between Member States. Data protection authorities use their new powers The Regulation equips the data protection authorities with stronger enforcement powers. Contrary to fears expressed by some stakeholders before May 2018, national data protection authorities have adopted a balanced approach to enforcement powers. They have focused on dialogue rather than sanctions, in particular for the smallest operators which do not process personal data as a core activity. At the same time, they did not shy away from using their new powers effectively whenever this was necessary, including by launching investigations in the area of social media and imposing administrative fines ranging from a few thousand euros to several million, depending on the gravity of the infringements of data protection rules. Examples of fines imposed by data protection authorities: ·EUR 5 000 on a sport betting café in Austria, for unlawful video surveillance; ·EUR 220 000 on a data broker company in Poland for failure to inform individuals that their data was being processed; ·EUR 250 000 imposed on the Spanish football league LaLiga, for lack of transparency in the design of its smartphone application; ·EUR 50 million on Google in France, because of the conditions for obtaining consent from users. When conducting investigations, it is essential that data protection authorities gather relevant evidence, respect all procedural steps under national legislation and ensure due process in often complex files. This requires time and involves a significant amount of work, which explains why most of the investigations launched after the entry into application of the Regulation are still on-going. That being said, the success of the Regulation should not be measured by the number of fines imposed, but by changes in the culture and behaviour of all actors involved. In this context, data protection authorities have other tools at their disposal such as imposing a temporary or definitive limitation on processing including a ban or ordering the suspension of data flows to a recipient in a third country. Some data protection authorities have created new tools, such as help lines and toolkits for businesses while others have developed novel approaches, such as regulatory sandboxes to assist companies in their compliance efforts. However, a number of stakeholders still consider that they have not received enough support and information, in particular small and medium size enterprises in some Member States. To help remedy this situation, the Commission provides grants to data protection authorities for them to reach out to stakeholders, in particular individuals and small and medium size enterprises.



The European Data Protection Board is operational

The data protection authorities have intensified their work in the European Data Protection Board. This intense work has allowed the Board to adopt around 20 guidelines on key aspects of the Regulation. The future areas of work of the Board are presented in a 2-year programme as required by the Regulation. In cross-border cases each data protection authority is no longer simply a national authority but is part of a truly EU-wide process across all stages, from the investigation to the decision. Such close cooperation has become daily practice: by end-June 2019, 516 cross-border cases had been managed through the cooperation mechanism. The Commission contributes actively to the work of the Board to promote the letter and spirit of the Regulation, and recalls the general principles of EU law. Towards the creation of an EU data protection culture The new governance system still needs to realise its full potential. It is important for the Board to further streamline its decision-making and develop a common EU data protection culture among its members. The possibilities for data protection authorities to pool their efforts on issues affecting more than one Member State, for instance to carry out joint investigations and enforcement measures, can contribute to such an objective while mitigating resources’ constraints. Many stakeholders wish to see even more cooperation and a uniform approach by national data protection authorities. They also request more consistency in the advice provided by data protection authorities, and a full alignment of national guidelines with those of the Board. Some also expect further clarifications of key concepts of the Regulation such as the risk-based approach, taking particular account of the concerns notably of small and medium size enterprises. In this context, allowing stakeholders to better feed into the work of the Board is essential. This is why the Commission welcomes the systematic public consultation organised by the Board on guidelines. This practice, together with the organisation of stakeholder workshops on targeted topics at an early stage of the reflection, should be continued and amplified to ensure the transparency, inclusiveness and relevance of the work of the Board. IV.Individuals make use of their rights but awareness-raising should continue Another key objective of the Regulation was to strengthen individuals’ rights. The Regulation is widely considered by civil rights associations and consumer organisations as an important contribution to a fair digital society built on mutual trust. A stronger awareness of data protection rights Individuals in the EU are increasingly aware of data protection rules and of their rights: 67% of respondents to a May 2019 Eurobarometer are aware of the Regulation and 57% know that there is a national data protection authority to which they can turn for information or to lodge complaints. 73% have heard of at least one of the rights granted by the Regulation. However, a sizeable number of individuals in the EU still do not take active steps to protect their personal data when they go online. For instance, 44% of individuals have not changed their default privacy settings on social networks. Individuals increasingly exercise their rights This increased awareness of rights has led individuals to exercise them more intensively by means of customer queries and by turning more often to data protection authorities to ask for information or lodge complaints. Businesses also report that requests for access to personal data have increased in several sectors, such as banking and telecommunications. Individuals have also more often withdrawn their consent and exercised their right to object to commercial communications. However, some operators reported misunderstandings by individuals about data protection rules, such as the belief that individuals should consent to all processing, or that the right to erasure is absolute (while for instance personal data sometimes have to be kept by the operators due to legal obligations). On their side, civil society organisations complain about long delays in replying by some business and data protection authorities. Importantly, several representative actions were launched by non-governmental organisations after being mandated by individuals, making use of the new possibility under the Regulation. The recourse to representative actions would have been easier if more Member States had made use of the possibility provided for by the Regulation to allow non-governmental organisations to launch actions without a mandate.



The need to continue awareness-raising efforts The dialogue and awareness-raising efforts focusing on the general public must therefore continue at national and EU level. To this end, the Commission launched a new online campaign in July 2019 to encourage individuals to read privacy statements and to optimise their privacy settings. V.Businesses are adapting their practices The Regulation aims to support business in the digital economy by offering future-proof solutions. Businesses generally welcome the Regulation’s accountability principle which moves away from the previous burdensome ex ante approach (elimination of notification requirements, scalability of obligations, and flexibility of the data protection by design and by default principle allowing competition on the basis of privacy friendly solutions). At the same time, some call for more legal certainty and additional or clearer guidelines from data protection authorities.

Sound data management While companies report a number of challenges in adjusting to the new rules, many emphasise that it was also an opportunity to bring the issue of data protection to the attention of the company boards, put their house in order in terms of the data they hold, improve security, be better prepared for incidents, reduce exposure to unnecessary risks and build more trusting relationships with their customers and commercial partners. On transparency, business and civil society organisations mention the delicate balance to be struck between giving to individuals all required information under the Regulation while also using clear and plain language and a form that individuals can understand. Operators are developing innovative solutions in this direction. In general, businesses indicated that they were able to implement the new data subject rights, although it was sometimes challenging to meet deadlines due to an increased number of requests and their more wide-ranging character, or to check the identity of the person making the request.



Impact on innovation The Regulation not only allows but encourages the development of new technologies while respecting the fundamental right to protection of personal data. This is the case in areas such as artificial intelligence. Businesses have started developing their offer of new, more privacy-friendly services. For instance, search engines which do not track users or use behavioural advertising are progressively gaining market shares in some Member States. Other companies are developing services that build on new rights granted to individuals, such as the portability of their personal data. An increasing number of businesses have promoted respect for personal data as a competitive differentiator and a selling point. These developments are not confined to the EU but also concern very innovative foreign economies. The specific situation of ‘low risk’ micro and small size enterprises Although the situation varies between Member States, micro and small size enterprises which do not process personal data as their core business have been among the stakeholders with the most questions about the application of the Regulation. While these seem to stem partially from a lack of awareness of the data protection rules, their concerns are also sometimes exacerbated by campaigns from consultancies seeking to provide paid-for advice, by the spread of incorrect information, for instance on the need to systematically obtain consent from individuals, and by additional requirements imposed at national level. In this context, micro and small size enterprises are calling for guidelines that are tailored to their specific situation and that provide very practical information. Some data protection authorities have already done this at national level. To supplement national initiatives, the Commission has issued information material to help such companies comply with the new rules through a series of practical steps. Making use of the toolbox under the Regulation The Regulation provides for tools to demonstrate compliance, such as standard contractual clauses, codes of conduct and the newly introduced certification mechanisms. Standard contractual clauses are model clauses which can be included on a voluntary basis in a contract, for instance between a data controller and a data processor, and which lay down the obligations of the contracting parties under the Regulation. The Regulation expands the possibilities to use standard contractual clauses both for international transfers and within the EU. In the area of international transfers, their broad use indicates that they are very helpful to businesses in their compliance efforts and of particular benefit to companies that do not have the resources to negotiate individual contracts with each of their data processing contractors. A number of sectors also regard the adoption of standard contractual clauses as a useful way to foster harmonisation, in particular when it is the Commission that adopts them. The Commission will work together with stakeholders to make use of the possibilities provided by the Regulation and to update existing clauses. The adherence to codes of conduct is another operational and practical tool at the disposal of industry to facilitate demonstrating compliance with the Regulation. Those codes should be developed by trade associations or bodies representing categories of controllers and processors and should describe how the data protection rules can be implemented in a specific sector. By calibrating the obligations with the risks, they can also prove to be a very useful and cost-effective way for small and medium size enterprises to meet their obligations. Finally, certification can also be a useful instrument to demonstrate compliance with specific requirements of the Regulation. It can increase legal certainty for businesses and promote the Regulation globally. The certification and accreditation guidelines recently adopted by the European Data Protection Board will enable the development of certification schemes in the EU. The Commission will be monitoring these developments and, if appropriate, will make use of the empowerment provided under the Regulation to frame the requirements for certification. The Commission may also issue a standardisation request to EU standardisation bodies on elements relevant for the Regulation. VI.Upward convergence is progressing at international level The demand for protection of personal data is not limited to the EU. As shown by a recent global survey on internet security, the trust deficit is widening around the globe causing people to change the way they behave online. A growing number of companies are addressing these concerns by extending of their own volition the rights created by the Regulation to their non-EU based customers. Moreover, as countries around the world are increasingly addressing similar challenges, they are equipping themselves with new data protection rules or modernising existing ones. These laws often have a number of common features that are shared by the EU data protection regime, such as an overarching legislation rather than sectorial rules, enforceable individual rights and an independent supervisory authority. This trend is truly global, running from South Korea to Brazil, from Chile to Thailand, from India to Indonesia. The increasingly universal membership of the Council of Europe’s ‘Convention 108’ – recently modernised with a significant contribution from the Commission – is another clear sign of this trend of upward convergence. Promoting safe and free data flows through adequacy decisions and beyond

This developing convergence offers new opportunities to facilitate data flows, and consequently trade as well as cooperation between public authorities, while improving the level of protection for the data of individuals in the EU when it is transferred abroad. Implementing the strategy laid out in its 2017 Communication on Exchanging and Protecting Personal Data in a Globalised World, the Commission intensified its engagement with third countries and other international partners building on and further developing elements of convergence between privacy systems. This included exploring the possibility of adopting adequacy findings with selected third countries. This work has yielded important results, in particular, the entry into force in February 2019 of the EU-Japan mutual adequacy arrangement that created the world’s largest area of free and safe data flows. Adequacy negotiations with South Korea are at an advanced stage and exploratory work is ongoing with a view to launching adequacy talks with several Latin American countries – such as Chile or Brazil – depending on the completion of ongoing legislative processes. Developments are also promising in some parts of Asia, such as India, Indonesia and Taiwan, as well as in the European Eastern and Southern neighbourhood, which could open the door to future adequacy decisions. At the same time, the Commission welcomes the fact that other countries that have put in place transfer instruments similar to the Regulation’s adequacy have recognised that the EU as well as countries recognised by the EU as ‘adequate’ ensure the required level of protection. This has the potential to create a network of countries where data can flow freely. Alongside this, intense work is ongoing with other third countries, such as Canada, New Zealand, Argentina and Israel to ensure the continuity under the Regulation of adequacy decisions adopted on the basis of the 1995 Data Protection Directive. Meanwhile, the EU-US Privacy Shield has proven to be a useful tool to ensure transatlantic data flows based on a high level of protection, with more than 4,700 participating companies. Its annual review ensures that the correct functioning of the framework is regularly checked and that new issues can be addressed in time. As there is no one-size-fits-it-all solution for data flows, the Commission is also working with stakeholders and the Board to harness the full potential of the Regulation’s toolkit for international transfers. This concerns instruments such as standard contractual clauses, the development of certification schemes, codes of conduct or administrative arrangements for public bodies. In that respect, the Commission is interested in the exchange of experience and best practices with other systems that may have developed a specific expertise in some of these tools. The Commission will consider making use of the empowerments granted under the Regulation with respect to those transfer tools, especially the standard contractual clauses. Beyond purely bilateral tools, it could also be worth exploring whether like-minded countries could establish a multinational framework in this area at a time when data flows are an increasingly crucial component of trade, communications and social interactions. Such an instrument would allow data to flow freely amongst the contracting parties, while ensuring the required level of protection on the basis of shared values and converging systems. It could be developed, for example, building on the modernised Convention 108 or drawing inspiration from the ‘data free flows with trust’ initiative launched by Japan at the beginning of this year. Developing new synergies between trade and data protection instruments While promoting convergence of data protection standards at international level, the Commission is also determined to tackle digital protectionism. To that end, it has developed specific provisions on data flows and data protection in trade agreements which it systematically tables in its bilateral and multilateral negotiations, such as the current WTO e-commerce talks. These horizontal provisions rule out purely protectionist measures, such as forced data localisation requirements, while preserving the regulatory autonomy of the parties to protect the fundamental right to data protection. Whereas dialogues on data protection and trade negotiations must follow separate tracks, they can complement each other: the EU-Japan mutual adequacy arrangement is the best example of such synergies, further easing commercial exchanges and in this way amplifying the benefits of the Economic Partnership Agreement. In fact, this type of convergence, based on shared values and high standards and backed-up by effective enforcement, provides the strongest foundation for the exchange of personal data, something which is increasingly recognised by our international partners. Given that companies increasingly operate across borders and prefer to apply similar sets of rules in all their business operations worldwide, such convergence helps create an environment conducive to direct investment, facilitating trade and improving trust between commercial partners. Facilitating exchange of information to combat crime and terrorism based on appropriate safeguards Greater compatibility between data protection regimes can also significantly facilitate the much needed exchanges of information between EU and foreign regulatory, police and judicial authorities and, in this way, contribute to more effective and rapid law enforcement cooperation. To that end, the Commission considers to make use of the possibility to adopt adequacy decisions under the Data Protection Law Enforcement Directive to deepen its cooperation with key partners in the fight against crime and terrorism. Moreover, the EU-US ‘Umbrella Agreement’, which entered into force in February 2017, can be used as a model for similar agreements with other important security partners. Other examples pointing to the importance of high data protection standards as a basis for stable law enforcement cooperation with third countries are the transfer of Passenger Name Records (PNR), and the exchange of operational information between Europol and important international partners. In this regard, negotiations on international agreements are currently ongoing or poised to commence with several countries of the Southern Neighbourhood. Strong data protection safeguards will also be an essential component of any future agreement on cross-border access to electronic evidence in criminal investigations, at bilateral (EU-US agreement) or multilateral level (Second Additional Protocol to the Council of Europe ‘Budapest’ Convention on Cybercrime). Promoting cooperation between data protection enforcers At a time when privacy compliance issues or security incidents may affect large number of individuals simultaneously in several jurisdictions, closer forms of cooperation between supervisory authorities at international level can help ensure both a more effective protection of individual rights and a more stable environment for business operators. Against that background and in close contact with the Board, the Commission will work on ways to facilitate enforcement cooperation and mutual assistance between EU and foreign supervisory authorities, including by making use of the new powers provided in this area by the Regulation. This could cover different forms of cooperation from developing common interpretative or practical tools to exchanging information on on-going investigations. Finally, the Commission also intends to step up its dialogue with regional organisations and networks, such as the Association of Southeast Asian Nations (ASEAN), the African Union, the Asia Pacific Privacy Authorities forum (APPA) or the Ibero-American Data Protection Network, which play an increasingly important role in shaping common data protection standards, promoting the exchange of best practices and fostering cooperation between enforcers. It will also work with the Organization for Economic Cooperation and Development and the Asian-Pacific Economic Cooperation Organisation to build convergence towards a high level of data protection. VII.Data protection legislation as an integral part of a wide range of policies The protection of personal data is guaranteed and integrated in several policies of the Union. Telecommunications and electronic communication services The Commission adopted its proposal for a Regulation on Privacy and Electronic Communications in January 2017. The proposal aims to protect confidentiality of communications, as provided for in the Charter of Fundamental Rights, but also to protect personal data that may be a part of a communication as well as terminal equipment of end-users.

The proposed ePrivacy Regulation particularises and complements the Regulation by laying down specific rules for the abovementioned purposes. It modernises the current EU e-privacy rules to reflect technological and legal developments. It enhances individuals’ privacy by extending the scope of the new rules to also cover over-the-top communications service providers, thereby creating a level playing field for all electronic communications services. While the European Parliament adopted a mandate to launch trilogues in October 2017, the Council has not yet agreed on a general approach. The Commission remains fully committed to the ePrivacy Regulation and will support the co-legislators in their efforts to achieve a swift adoption of the proposed Regulation. Health and research Facilitating exchanges of health data, which are sensitive data under the Regulation, between Member States is becoming increasingly important in the area of public health for reasons of general interest. These include the provision of healthcare or treatment, protection against serious cross-border threats to health, and ensuring high standards of quality and safety of health care and of medicinal products or medical devices. The Regulation lays down the rules that ensure lawful and trustworthy processing and exchanges of health data across the EU. These rules also apply to access by third parties to the medical data of patients, including to data held in patients summaries, ePrescriptions, and in the long run comprehensive electronic health records, and their use for scientific research purposes. In the specific field of clinical trials, the Commission has also prepared specific Question and Answers on the interplay between the Clinical Trials Regulation and the General Data Protection Regulation. Artificial intelligence (‘AI’) As AI gains strategic importance, it is essential to shape global rules for its development and use. In promoting the development and uptake of AI, the Commission has opted for a human-centric approach, meaning that AI applications must comply with fundamental rights. In this context, the rules laid down in the Regulation provide a general framework and contain specific obligations and rights that are particularly relevant for the processing of personal data in AI. For instance, the Regulation includes the right not to be subject to solely automated decision-making except in certain situations. It also includes specific transparency requirements on the use of automated decision-making, namely the obligation to inform about the existence of such decisions and to provide meaningful information and explain its significance and the envisaged consequences of the processing for the individual. These core principles of the Regulation have been recognised by the High Level Expert Group on AI, the Organization for Economic Cooperation and Development and G20 as particularly relevant to address the challenges and opportunities arising from AI. The European Data Protection Board has identified AI as one of the possible topics in its 2019-2020 Work Programme. Transport The development of connected cars and smart cities relies increasingly on the processing and exchanges of large amounts of personal data between multiple parties, including cars, car manufacturers, telematics service providers, and public authorities in charge of road infrastructure. This multi-party environment entails a certain complexity concerning the allocation of the roles and responsibilities of the various actors involved in the processing of personal data, and on how to ensure lawfulness of processing by all actors. Compliance with the Regulation and the ePrivacy legislation are essential for the successful deployment of intelligent transport systems in all modes of transport and the spread of digital tools and services enabling greater mobility of individuals and goods. Energy The development of digital solutions in the energy sector increasingly relies on the processing of personal data. The legislation adopted as part of the Clean Energy for All Europeans package includes new provisions enabling the digitalisation of the electricity sector and rules on data access, data management and interoperability that allow for the handling of consumers’ real-time data for achieving savings and encouraging self-generation and participation in the energy market. Therefore, compliance with data protection rules is of great importance for the successful implementation of these provisions.



Competition The processing of personal data is increasingly an element to be considered in competition policy. Given that data protection authorities are the only authorities entrusted with assessing a violation of the data protection rules, competition, consumer and data protection authorities cooperate and will continue to cooperate when necessary in the intersection of their respective competences. The Commission will foster such cooperation and follow developments closely. Electoral context In its Guidance on the use of personal data in the electoral context, issued in September 2018 as part of the electoral package, the Commission drew attention to rules of particular importance for the actors involved in elections, including issues relating to micro-targeting of voters. This Guidance was echoed in a Statement from the European Data Protection Board and a number of data protection authorities issued guidance at national level. The electoral package also included a call on each Member State to set up a national election network involving national authorities with competence in electoral matters and those responsible for monitoring and enforcing rules, such as data protection, on online activities relevant to the elections. New measures were also adopted to introduce sanctions for infringements of data protection rules by European political parties and foundations. The Commission recommended that Member States adopt the same approach at national level. The evaluation of the 2019 elections to the European Parliament, due to be issued in October 2019, will also take data protection aspects into account. Law enforcement An effective and genuine Security Union can only be built on the full compliance with the fundamental rights enshrined in the EU Charter and secondary EU legislation, including appropriate data protection safeguards to enable the secure exchange of personal data for law enforcement purposes. Any restrictions of the fundamental right to privacy and data protection are subject to strict necessity and proportionality test.



VIII.Conclusion On the basis of information available to date and the dialogue with stakeholders, the Commission’s preliminary assessment is that the first year of application of the Regulation has been overall positive. Nevertheless, as shown in this Communication, further progress is necessary in a number of areas. Implementing and complementing the legal framework: