On Wednesday 29 May, the European Commission published guidelines to clarify the link between the General Data Protection Regulation (GDPR) and the Regulation on the free movement of non-personal data, the day after the latter came into force.
This document complies with a provision of Regulation 2018/1807 on non-personal data. As a reminder, this Regulation, adopted at the end of 2018, prohibits the unjustified location of data (except for reasons of public security) in order to further increase cross-border data exchanges and stimulate the data economy (see EUROPE 12045/7). Regulation 2016/679, the famous GDPR, provides for a unified framework for the processing of personal data.
In its guidelines, the Commission also points out that there is no contradiction between the two European regulations in that they both make it possible for all data to move freely within the EU. However, it clarifies some concepts, such as "mixed data" or "inextricably linked data". In particular, it takes the example of an electronic medical file, which contains both personal and non-personal data, and points out that, in this case, the GDPR applies, although, it notes, the data contained in mixed data sets containing health-related data can be a valuable source of information, for example for further medical research.
The guidelines also focus on self-regulatory approaches supporting the free flow of data, encouraged in the 2018 Regulation. They call on companies to take into account, in particular, good practices, minimum information requirements, approaches to certification schemes and communication roadmaps when developing these codes. The Commission specifies that the drafting of the standard contractual clauses, which should complement the codes of good practice, should be completed by 29 November 2019.
Link to the guidelines: https://bit.ly/2YWbis6. (Original version in French by Sophie Petitjean)