European Commission proposes simplification of GDPR rules: no more data processing register for organisations with fewer than 750 employees

Simplification of GDPR rules

Since May 2018, all organisations in the European Union have to comply with the General Data Protection Regulation (GDPR). This involves a great deal of work to ensure compliance with all the rules. Among other things, they must keep a data processing register, have a privacy statement, carry out Data Protection Impact Assessments (DPIAs), take appropriate security measures, report data breaches and provide safeguards when data is transferred to countries outside the European Economic Area.

The Commission's proposal means that organisations with fewer than 750 employees will no longer be required to keep a processing register, unless their processing of personal data is likely to pose a high risk to the rights and freedoms of data subjects.

Currently, the exemption from the obligation to keep a processing register only applies to organisations with fewer than 250 employees. However, these organisations cannot invoke this exemption if:

• The processing is likely to result in a risk to the rights and freedoms of data subjects;
• The processing is not occasional;
• Special categories of personal data are processed (e.g., health data); or
• Personal data relating to criminal convictions and offences are processed.

In practice, this means that virtually no organisation can invoke this exception. The European Commission's new proposal aims to change this.

European Commission simplification plans

The proposal is part of a broader package of simplification plans by the Commission to promote a favourable business climate in Europe (the Omnibus package). These simplification plans for certain small and medium-sized enterprises focus on:

• Sustainability reporting
• Due diligence rules
• EU investments
• Common agricultural policy
• Defence
• Investment targets
• Chemical industry
• Digitalisation

What next

The Commission's proposal still needs to be adopted by the European Parliament and the Council of the European Union. Until then, the current rules apply.

Questions

Our privacy team provides daily advice on the rules of the GDPR. Please feel free to contact them at privacy@ploum.nl. Our other lawyers are also available to answer any questions you may have about the Commission's other simplification plans. You can reach them at info@ploum.nl.