Between the lines: GDPR in the EU Data Strategy Union consultation

The European Commission’s DG Connect recently published a summary of the consultation on the European Data Union Strategy, which sought feedback on the interplay between the Open Data Directive (ODD), the Data Act, and the Free Flow of Non-Personal Data.

The summary provides no surprises: although the General Data Protection Regulation (GDPR) was not a main focus, 25% of respondents called for its review.

Also, more Europeans responded to the Call for Evidence than to the Commission’s questionnaire. Lastly, Western European countries have traditionally been more active in consultations than their Eastern or Northern counterparts. 

Europeans are more active in providing unique feedback

The European Commission generally consults stakeholders in two ways (aside from ad-hoc Implementation Dialogues, Reality Checks, and more): first, through a Call for Evidence (where stakeholders can submit free-form feedback), and second, through a controlled Public Consultation questionnaire, which is increasingly criticised as one-sided, since opponents of the proposed direction have limited space to explain their views.

We are ready to correct ourselves if we're wrong, but this critique helps explain why participation differed between the two in this particular case: 247 organisations and individuals responded to the Call for Evidence, while only 171 completed the Commission’s questionnaire (See Pictures below). The Commission traditionally doesn’t publish a thorough summary for Europeans' unique feedback, raising doubts about whether that input is considered at all.

Central and Eastern Europe is traditionally passive

Of the 171 respondents to the Commission’s questionnaire, 49,12% came from Western Europe (Germany 19,88%, Belgium 19,88% (note: many associations have HQs in Brussels), France 9,36%).

Southern European responses accounted for 12,23% (Italy 4,09%, Spain 4,09%, Greece 2,34%, Portugal 1,71%).

Nordic countries contributed 9,93% (Sweden 5,26%, Finland 2,92%, Denmark 1,75%).

Central and Eastern Europe remained passive: organisations from 11 CEE Member States made up just 8,16% of responses (Romania 1,75%, Hungary 1,75%, Estonia 1,75%, Czechia 1,17%, Slovenia 0,58%, Poland 0,58%, Lithuania 0,58%).

No responses were received from Bulgaria, Slovakia, Latvia, Croatia, Malta, Cyprus, or Luxembourg.

What about the GDPR? 

Although the General Data Protection Regulation (GDPR) was not the focus of the consultation or Call for Evidence (and we believe that if it had been, far more respondents would have called for a review), stakeholders still cited the GDPR as a stumbling block for the EU’s data economy.

Put simply: if European companies cannot access non-vulnerable data because it is classified as “personal” and Member States are not proactive in granting legal exemptions for certain data types, then changes to the Open Data Directive or the Data Act will not help.

Despite no focus on the GDPR in the consultation’s supporting documents, the European Commission’s report states that  27% of respondents still believe the GDPR should be included in data-legislation consolidation efforts. Additionally, many stakeholders believe the ePrivacy framework is outdated and call for alignment with the GDPR.

“Moreover, 27% want to include the GDPR in the consolidation efforts. <...> Many stakeholders believe the ePrivacy framework is outdated or call for an alignment with the GDPR.”

Respondents also highlighted persistent data issues: fragmented enforcement, one-sided interpretations by local data protection authorities,  and the GDPR’s “kiss of death” effect through an overly broad reading of what constitutes “personal data”.

"Among respondents who give more detail to their answers, the majority reports that the inconsistent enforcement and one-sided interpretation of regulations by data protection authorities is a significant issue. Key areas for clarification include the interplay of the GDPR with the Data Act and the AI Act, and the interpretation of “personal data”, especially in the context of IoT."

Of the 136 stakeholders who believe the EU should review current legal regimes, 25% identified the GDPR as needing the most urgent action, other regimes drew far less support.

"Most of the 136 responding stakeholders think the EU should re-examine legal regimes to facilitate data usage for AI training (yes: 70%; no: 30%). Of those saying “yes”, 34 respondents identify the GDPR, 15 the Copyright Directive, 12 the AI Act, 9 the Data Act and 4 the ePrivacy Directive as the main legal regimes to be re-examined. The majority reports the need to strike a balance between protecting personal data and enabling the use of data for AI."

Lastly, respondents (using the Commission’s own language) “repeatedly” highlighted the need to simplify GDPR compliance. While that’s important, we believe that the broader tasks shouldn’t be forgotten: reviewing the GDPR itself, clarifying what counts as “personal data” and assessing how Member States apply the rules (and how active they are in creating exemptions): 

Stakeholders repeatedly highlight the importance of international cooperation and adequacy decisions to simplify GDPR-compliance.