EU Council releases statement at first reading on the upcoming GDPR

23. March 2016

On March 17th, the EU Council issued its position on the draft of the GDPR.

The statement of the EU Council identifies and analyzes the following key aspects of the GDPR:

  • Material, formal and territorial scope of application of the GDPR in order to achieve a harmonization at a EU level.
  • Principles of the data processing, especially “pseudonymization” and “data minimization”
  • Lawfulness of the processing based on the consent of the data subject, a contract, a legal obligation, etc.
  • Empowerment of data subjects through the enhancement of their rights as data subjects to access the information that is held about them, the right to be forgotten, right to transparency on the processing, right to object to the processing of their personal data, etc.
  • Controller and processor´s accountability for the processing operations. Additionally their obligation to appoint a Data Protection Officer (DPO) in order to ensure compliance with the GDPR.
  • Transfers of personal data to third countries on the basis of adequacy decisions or other mechanisms that ensure an adequate level of data protection in third countries.
  • The EU DPAs supervisory role on the application of the GDPR on each Member State.
  • Remedies, liabilities and penalties as compensation mechanism in case of data breaches or damages caused to the data subjects.
  • Specific data processing situations, for example regarding employee´s personal data

The EU Council remarks that the GDPR reflects the compromise reached between the EU Parliament and the EU Council. Furthermore, it invites the EU Parliament to formally approve the position of the EU Council.