European Data Protection Board and Supervisor Tentatively Back GDPR Tweaks
The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) offered preliminary support Thursday for an upcoming European Commission proposal to make changes to the General Data Protection Regulation (GDPR).
Sign up for a free preview to unlock the rest of this article
The authorities' letter noted their understanding that the EC proposal involves extending the GDPR's exemption from record-keeping requirements for organizations with fewer than 250 employees to "small mid-cap companies" (those with fewer than 500 employees and a certain annual revenue) as well as to nonprofits with fewer than 500 employees.
In addition, the authorities said, the EC is considering a provision stating that such a modification wouldn't apply if the data processing "is likely to result in a high risk to the rights and freedoms of natural persons."
Based on the available information, the EDPS and EDPB said they support the initiative. However, they added, the EC should better evaluate the impact of this change on covered organizations to determine whether it adequately ensures a fair balance between personal data protection and the interests of organizations with fewer than 500 employees. They said they'll contribute further during the consultation to be launched after the proposed legislation is published.