The European Data Protection Board (EDPB) has been invited to express its views on the forthcoming simplification of the Data Protection Regulation, planned by the European Commission between now and the end of May, and has declared its “preliminary support” for the initiative, subject to a number of conditions.
In a response letter sent to the European Commission on 8 May, the EDPB believes that the Commission’s proposal should “retain a risk-based approach”, as “even very small companies can still engage in high-risk processing” of the data in their custody.
The EDPB would like the Commission to present an impact assessment on the details of the simplification to understand “the number of companies and organisations that would benefit [and assess] whether the draft Proposal ensures a proportionate and fair balance between the protection of personal data and the interests of organisations”.
Consumer Protection Commissioner Michael McGrath has confirmed that the Commission is considering reviewing the obligations of the GDPR for businesses or organisations employing fewer than 500 people (including small and medium-sized enterprises or SMEs).
This targeted reopening could form part of the next ‘omnibus’ simplification package for SMEs, expected on 21 May.
To see the EDPB’s response, go to https://aeur.eu/f/gqc (Original version in French by Isalia Stieffatre)