Thread by @gabrielazanfir

A couple of things I noted in today's GDPR review report published by the European Commission that I find interesting:
1) The One Stop Shop mechanism came out of it stronger than I would have expected; technically, ~it needs more time to become effective~
ec.europa.eu/info/sites/inf…

2) There are two potential legislative updates mentioned on the long run, both of them very narrow: harmonizing the age of consent for children for online services and record keeping by SMEs. COM is giving the GDPR more time to settle in before considering any serious reviews.

3) There seems to be a preoccupation for clarifying rules related to processing of personal data for research and for the public good, particularly in relation to health - this being mentioned a couple of times in the report.
#healthdata

4) In fact, COM mentioned it contracted out an 'Assessment of the Member States’ rules on health data in the light of GDPR', which is to be carried out by this consortium euhealthsupport.eu; COM also asks EDPB to publish Guidelines for processing data for research purposes;

5) Data portability is another key preoccupation. COM feels it is not used at its top potential and it could be a key player in facilitating competition... but also the use of 'data for the public good' or 'data altruism'.
#dataportability #GDPR #GDPRReview

6) One other interesting initiative announced in a footnote is a 'project on age identification tools – pilot project to demonstrate an interoperable technical infrastructure for child protection, including age-verification and parental consent.' Definitely to be followed.

7) On international data transfers: COM is pushing the EDPB to finalize their opinion on the interplay of Art 3.2 (extraterritorial direct applicability of the GDPR) and Chapter V (Int data transfers rules); COM is waiting Schrems II judgment before adopting updated SCCs.

8) COM also highlighted its commitment to rebuke data localization efforts of third countries (including by not shying away of using trade agreements to this end); & committed to collabs with OECD, ASEAN and G20; Truly going global.

9) Speaking of going global, COM also announced it will create a *Data Protection Academy* "a platform where EU and foreign data protection authorities would share knowledge, experience and best practices to facilitate and support cooperation between privacy enforcers". Familiar?

10) One last point: keep your eyes on the Proposal of a Directive for representative actions for consumers, currently in legislative process, which the Commissions says will streamline and harmonize Article 80 type of representative actions also for data protection breaches. FIN