The EU Data Protection Board (EDPB) recently held a workshop on data subject rights, allowing interested stakeholders to attend for the first time. Freshfields participated, and we got some interesting insights into current thinking – we set these out below (additional detail can also be seen in the EDPB's own blog-post on the workshop). As a result of the workshop, we expect the EDPB to issue draft guidelines in late February/early March 2020. These will be opened up to public consultation, with the final guidelines likely to be adopted in around spring 2021.
The workshop was attended by a range of stakeholders, including individual companies, trade associations and consumer rights groups. It focused on three main topics: the right of access, the right to rectification/erasure, and the right to restrict processing/object. The debate was lively, with stakeholders clearly welcoming the opportunity to raise practical concerns, debate competing principles and discuss possible solutions. The openness of the debate was helped by the fact that it was held under the Chatham House Rule. That means we can’t go into the details of the discussion here, but there are some high-level points worth mentioning.
- Regarding the data subject access right, there was a clear ideological divide between consumer groups and industry representatives. Industry raised several concerns about the level of resources needed to answer access requests - particularly in the context of legal disputes - and the time constraints when data subjects don’t respond to emails.
- On the right to rectification, the conversation focused on the distinction between factually incorrect information and statements of opinion. On erasure, the biggest concern raised by companies was the definition. Many argued that data subjects don’t fully understand their rights and that this can lead to problems: including where a company has deleted data for most purposes but has kept it for others - e.g. if there is a legal duty to keep it.
- In relation to the right to restrict processing and object, stakeholders raised similar issues about data subjects misunderstanding their rights, and asked for updated EDPB guidance on processing data on the basis of ‘legitimate interest’.
- It was thought that the draft guidance should be sector-neutral, but include sector-specific examples.
In parallel, the UK Information Commissioner’s Office has launched a public consultation on its draft guidance on data subject access rights, which is open until 12 February 2020.
The EDPB has said it will organise two further workshops in 2020, one of which will be in late February/early March. Potential topics include ‘legitimate interest’, data portability and children’s rights. We expect businesses to be able to attend again, but they should apply quickly – the November workshop was oversubscribed in roughly 24 hours.
If you’d like to discuss how you could engage with EU or national data regulators, please contact us.
