The EU announces modest (first) red tape cuts to the GDPR

Yesterday, the European Commission announced its fourth omnibus package, aimed at simplifying overlapping, excessive, or outdated rules and requirements that create a high administrative burden for European businesses. 

The fourth package outlined two digital-oriented changes: simplified record-keeping requirements under the GDPR for larger companies, and the introduction of a ‘digital-first’ principle for product licensing for a limited number of sectors.

Underwhelming impressions, little room for maneuvre for the Commission?

First impressions are somewhat underwhelming. The European competitiveness gap won’t be closed by incremental changes. Worse - European entrepreneurs who are rooting for a more competitive Europe, eagerly sharing every optimistic media headline about the EU “finally slashing red tape!", “rethinking the AI Act” or “reviewing the GDPR” may end up feeling discouraged. 

Yes, the proposed simplification measures will help European SME's save some money, however, it is unlikely to have a much-needed breakthrough effect, needed to empower local entrepreneurs in the global tech race.

The European Commission is indeed in a difficult position. On one hand, inspired by Mario Draghi's competitiveness report, many Europeans are calling for changes to how the EU bureaucracy functions. “Competitiveness” has become a mantra, which means different things to different people, but it needs to be addressed. Meanwhile, the Commission believes it cannot afford to reopen certain digital and data regulations in fear of getting bogged down in years-long negotiations again.

Yet meaningful change is unlikely without revisiting at least some of the regulations - or, at the very least, issuing clear recommendations to Member States on how to ease certain elements of, for example, data protection rules, where doing so could deliver tangible societal benefits for consumers.

We can only hope for bolder actions in the upcoming omnibus packages and the promised digital fitness check.

Easier record keeping for companies with under 750 employees

The main change in reducing the administrative burden under the GDPR is that companies with fewer than 750 employees, up from the previous threshold of 250, will now benefit from more relaxed record-keeping requirements.

Currently, the GDPR provides that this obligation is not mandatory for SMEs or organisations with fewer than 250 employees, unless that entity's processing is likely to result in a risk to data subjects' rights, the processing is not occasional, or the processing includes sensitive personal data or data on criminal offences.

The Single Market Simplification proposal would extend this derogation to SMCs and organisations with fewer than 750 people. The proposal would also simplify the record-keeping obligation for these entities by only requiring record-keeping in case of ‘high risk' processing at large-scale. The proposal will help avoid situations where SMEs would still be obliged to maintain records, even though they are not processing data that is considered high risk. 

‘Digital by default’ principle in some areas: should be a norm in 2025 

The other digital-oriented proposal - the application of the “digital by default” principle, which would remove mandatory paper requirements in product legislation - is a step in the right direction. Yet it's unfortunate that these types of measures are still needed in 2025, when this principle should already be the norm.

The Commission believes this could “encourage public authorities to rethink their processing of submissions or reporting by companies”. If only the Commission had the power to offer not just carrots, but also sticks to Member States that fail to meet the basic digital standards expected in the developed world - standards that European consumers and entrepreneurs rightfully deserve.

“The proposal foresees the digitalisation of the EU declaration of conformity, as well as the exchanges between competent national authorities and economic operators. The proposal additionally gives the possibility for manufacturers to provide instructions for use to end users in digital format in lieu of paper; <...> 

The sectors affected are: outdoor noise equipment, transportable pressure equipment, restriction of hazardous substances in electrical and electronic equipment, recreational crafts, simple pressure vessels, electromagnetic compatibility, non-automatic weighing instruments, measuring instruments, lifts, ATEX, low voltage, radio equipment, pressure equipment, marine equipment, cableways, personal protective equipment, gas appliances, machinery, batteries and ecodesign.”