The European Commission wants to simplify rules, to reduce the "regulatory burden" for smaller companies. That is why the Commission is amending several laws, including the General Data Protection Regulation (AVG). A good goal, and where it can be done it should certainly be done, the Autoriteit Persoonsgegevens AP) and the other privacy regulators in Europe believe. But only if this does not jeopardize the protection of people's fundamental rights.
This is stated in a joint opinion of European privacy regulators, including the AP. They are responding to a European Commission proposal to amend the AVG to reduce the regulatory burden for companies with up to 750 employees.
The rules dealing with the processing register will be clarified, making it easier for companies to determine whether they need to keep a processing register. The Commission proposes that from now on, those companies will no longer have to keep a processing register as long as there is no high-risk processing ("high-risk processing"). A processing register is an overview of all processing of personal data within an organization.
In addition, there is a new group of companies that will be covered by the exception. Now this exception only applies to organizations with fewer than 250 employees (unless there are a number of situations that pose a risk to citizens). So the Commission wants to raise that limit to 750, and that exception will only not apply if there are high risk situations. As in the case of blacklists, credit scores or systematic profiling of people.
A good goal, the European privacy regulators think. However, they do have areas for improvement, the most important being:
Make it clear that the exception does not apply to government organizations. Government organizations have an extra large responsibility towards citizens and an exemplary role. It is not clear now from the text whether the new exception also applies to government organizations.
Make it clear that smaller companies should only register so-called high-risk processing operations in their processing register. A small company with one high-risk processing does not then have to register all other, less risky processing operations. In this way the regulatory burden remains limited for those companies as well.
The European Parliament and the European Council will now consider the proposal. This proposal to simplify the AVG is part of a series of measures the European Commission plans to take to reduce the regulatory burden on small businesses. More proposals to amend the AVG may follow. The privacy regulators will also review those proposals and provide advice where appropriate.
The opinion was written by the European Data Protection Supervisor (EDPS) and the European Data Protection Board (EDPB). The EDPS is the EU's independent privacy supervisor. The EDPB is the alliance of Europe's national privacy supervisors. The AP is part of the EDPB.
