EU Council agrees position to simplify data protection, privacy and cybersecurity rules

Main elements of the EU normative simplification

The proposal introduces modifications to the General Data Protection Regulation, modernises cookie rules established in the Electronic Privacy Directive, derogates provisions of the Platform-to-Business Regulation, consolidates single market data rules (the so-called "community acquis") and introduces a mechanism for a single notification point for cybersecurity and data incidents.

General Data Protection Regulation

Starting from the Commission proposal, the mandate includes a series of modifications to the GDPR, to simplify and rationalise provisions while maintaining adequate protection of fundamental rights.

First, the Council mandate retains the current definition of personal data and introduces a new provision on pseudonymisation and identification of natural persons, in order to help companies comply with their GDPR obligations by clarifying the corresponding rules. Likewise, it simplifies compliance rules for unfounded or excessive requests and for information obligations in certain low-risk circumstances.

The Council supports a definition of "scientific research" based on principles, which facilitates consistent application of personal data processing for this purpose. It intends to incorporate exemptions from certain obligations so that research entities can operate in a simplified framework as regards data protection.

Additionally, it introduces safeguards for the recent proposal of an exception, which allows processing of sensitive data for biometric verification and in the context of development and functioning of AI systems. Innovation and AI development are reinforced with clarifications on the legal basis for personal data processing and the need to maintain appropriate safeguards.

The Council also supports the Commission proposal to extend the deadline for notification of personal data breaches, as well as other measures to facilitate GDPR compliance and ensure greater consistency. Such measures include a single list for the EU of categories of processing that may pose a high risk to individuals, and the establishment of common models for companies and institutions to comply with regulatory obligations.

Data acquisition and trade secrets

The mandate consolidates and simplifies rules on data altruism and data intermediary services. It offers advantages for public authorities managing sector data and for those reusing it, as they can streamline processes and reduce administrative burden associated with interpreting and applying various national laws.

The mandate introduces the possibility for public sector bodies to set different conditions and charge higher fees for reuse by large companies and, in particular, those designated as gatekeepers. It also responds to the urgent need to strengthen safeguards against the risk of trade secret leakage to third countries. The mandate specifically stipulates that trade secrets shall only be disclosed once the data holder and the user have adopted all necessary measures to preserve their confidentiality.

Electronic privacy directive and cookies

The Council mandate maintains online cookie and other tracking technology rules in accordance with the Electronic Privacy Directive. This framework is updated with clearer and additional purposes for which cookie installation on the user's device will not require consent, thus reducing the number of cookie notices during browsing. This would apply, for example, when necessary for service provision, for audience measurement or to ensure user device security.

The mandate also modifies certain provisions relating to the regulation on protection of natural persons regarding personal data processing by Union institutions, bodies, offices and agencies and to the free circulation of these data (EUDPR), adapting them to proposed GDPR changes.

Cybersecurity and data incident notification

The Council mandate replaces the single EU entry point with a national entry point in each Member State, which supports and facilitates notification of incidents and connected events in accordance with different EU legislation.

Additionally, it proposes the establishment of a EU-level information point for incident notification, as well as specific provisions for a harmonised incident notification framework and for cross-border incident notifications.