On Thursday 13 July, 10 European associations in the banking, insurance and financial sectors expressed concerns at the initial versions of the guidelines on the applications of the regulation (2016/679) on data protection, adopted at the beginning of April by the 'Article 29' working group, which is made up of the data protection authorities of the European Union.
The source of their concern, explained in a letter to the First Vice-President of the European Commission, Frans Timmermans, and the chair of the group, Isabelle Falque-Pierrotin, lies in the fact that the guidelines add additional rules that infringe the original agreement reached by the co-legislators (see EUROPE 11795). Although these guidelines are not binding, the may be brought in as compulsory requirements at national level, they reiterate the letter.
Speaking to EUROPE on Monday 17 July about the provisions in question, Richard Middleton of the Association for Financial Markets in Europe (AFME) - a signatory of the letter - said that guidelines specifying which operations would automatically require an impact assessment on data protection are too prescriptive. He argues that "the guidelines should include factors for data controllers to consider, while making clear that the controller should determine, using the risk-based approach from level I, whether a data protection impact assessment is needed".
Another concern raised is the deadline to respond to the public consultation on some of these guidelines, which is 30 days. Arguing that this is too short, the European industry recommends a “reasonable” period of eight weeks. It also calls on the working group to finalise the guidelines as quickly as possible so as to make it possible to prepare properly for the entry into force of the regulation at the end May 2018. (Original version in French by Marion Fontana)