1. Effective implementation: from Principles to Realities
E-VOLUTION OF DATA PROTECTION
7-8 September 2017, Tartu
Effective implementation: from Principles to Realities
ERIC SITBON

2. Some key principles
1. A Regulation which is directly applicable in all Member States and fully harmonises certain data protection rules
2. A Regulation based on Article 16 TFEU
3. A Regulation covering the private and public sectors but excluding certain activities from its scope
4. A Regulation which seeks to ensure a more effective enforcement of data protection rules
5. A Regulation containing directly applicable rules which will be applied consistently by national Courts with the involvement of the CJEU

3. Principle 1: a Regulation which is directly applicable in all Member States – Reality? (1)
No transposition. However, in some instances, see Recital 8
The Regulation lays down general rules and principles.
Several provisions of the Regulation may be specified by Member States; however, it does not amount to minimal harmonisation. Public sector: Articles 6(2)&(3) (more specific provisions to adapt the application of the Regulation)

4. Principle 1: a Regulation which is directly applicable in all Member States – Reality? (2)
Some examples of powers given to Member States:
Rules on child’s consent (information society services) : Article 8(1) by MS law between the age of 13 and 16 years old;
Article 23 on restrictions
Freedom of expression and information : Article 85
Public access to official documents: Article 86
Processing in the context of employment: Article 88
Safeguards and derogations in certain areas (e.g. statistics or research): Article 89

5. Principle 2: a Regulation based on Article 16 TFEU
What are the implications compared to Directive 95/46/EC based on Article 114 TFEU?
How has the CJEU interpreted Article 16 TFEU and Article 8 of the Charter in recent case law?
Reality on the ground: how will the big players of the digital economy apply the GDPR?

6. Principle 3: a Regulation covering the private and public sectors but excluding certain activities from its scope
The GDPR has a broad scope but excludes certain activities, some of which are regulated by national law or by other Union acts applying adapted rules
Delineation may prove difficult to implement in some instances

7. Principle 4: a Regulation which seeks to ensure a more effective enforcement of data protection rules
Harmonised administrative fines but a broad margin of appreciation to calculate the amount of the fines – which actor(s) will ensure a consistent application of those fines? In addition, exceptions have been introduced in Article 83 (7) and (9) (see corresponding Recitals 150 and 151)
The binding decisions of the European Data Protection Board to resolve disputes between national supervisory authorities: a more consistent implementation?

8. Principle 5: a Regulation containing directly applicable rules which will be applied consistently by national Courts with the involvement of the CJEU
An increased role for national courts?
An increased role for the CJEU through preliminary rulings and direct actions (see Recital 143)?

9. Recommendations and conclusion
Member States should ‘screen’ their national laws as early as possible to enable a smooth application of the GDPR in May 2018
supervisory authorities, especially those likely to often be ‘lead authorities’, should be properly staffed and proactive

10. THANK YOU !