Dear Ministers,
I thank you for the invitation to represent the Fundamental Rights Agency in this working session. The practical and clear implementation of data protection safeguards is very important for efficient fundamental rights protection in practice, especially so in our increasingly digitalised world. Therefore, I am happy to share the recommendations of the Agency and to offer our assistance in maintaining these safeguards.
In order to offer such assistance, it is important for us to understand where Member States see challenges and potential areas for improvement in the implementation of GDPR, and I welcome the candid discussions here today.
FRA’s Fundamental Rights Survey – which interviewed 35,000 people across the EU – showed that over 50% of people are concerned that their online personal data are accessed for criminal purposes and a third are concerned that their data are used by companies without their knowledge or permission.
Fundamental rights protection is Europe’s competitive advantage. Having in place strong data protection compliance is essential for sustainable business – as it creates the necessary trust and uptake of services by people. This extends beyond business; FRA’s current research on the digitalisation of justice shows the positive finding that data protection and privacy are core rights that are typically considered in the development of digital tools in the justice sector.
In other less sensitive sectors, FRA understands that there may be the potential for reducing administrative burdens. Yet, first and foremost, we need to explore how this could be done through providing clearer guidance, and targeted resources.
This is confirmed by FRA’s 2024 report on the GDPR in practice, in which we spoke to representatives of Data Protection Authorities from all EU Member States. Respondents highlighted the importance of clear guidance for data controllers, both to ensure the correct implementation of the GDPR and to reduce DPAs’ workload when investigating data processing. Some DPAs highlighted that many data controllers lack understanding of the potential risks of inadequate data processing, while others indicated that their current resources limit possibilities to provide targeted advice and expertise.
More broadly, and with respect to the overall EU policy focus on simplification, any simplification considerations need to be evidence-based and informed through the experiences of stakeholders, including the public. Any efforts towards simplification must not lower existing fundamental rights protections, which underpin our functioning democratic societies.
Thank you.