Author: Stephanie Schiedermair

 

1. By 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council. The reports shall be made public.
2. In the context of the evaluations and reviews referred to in para. 1, the Commission shall examine, in particular, the application and functioning of:

(a) Chapter V on the transfer of personal data to third countries or international organisations with particular regard to decisions adopted pursuant to Art. 45 para. 3 of this Regulation and decisions adopted on the basis of Art. 25 para. 6 of Directive 95/46/EC;

(b) Chapter VII on cooperation and consistency.

3. For the purpose of para. 1, the Commission may request information from Member States and supervisory authorities.
4. In carrying out the evaluations and reviews referred to in paras. 1 and 2, the Commission shall take into account the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources.
5. The Commission shall, if necessary, submit appropriate proposals to amend this Regulation, in particular taking into account of developments in information technology and in the light of the state of progress in the information society.

 

I. Introduction

Art. 97 GDPR creates the duty of the Comm to review and evaluate the GDPR and communicate to the public a report on its findings. Hence, this is a duty to prepare an ex post assessment with a view to improving law-making. Art. 97 para. 1 addresses the above duty; para. 2 specifies particular topics of the report; para. 3 provides for the right of the Comm to ask for information to be communicated by the Member States or the SAs; para. 4 sets out the grounds of the report; and para. 5 refers to the duty of the Comm to suggest amendments (where necessary).

II. Legal background

Art. 97 GDPR replaces Art. 33 of the DPD, which had subjected the Comm to the obligation to report on the implementation of the DPD on a regular basis. The Comm was to fulfil this obligation for the first time three years after the end of the transposition period. Due to the sluggish implementation of the DPD in the Member States, the Comm published its first report on the implementation of the DPD 18 months later, in May 2003. No further reports were prepared pursuant to Art. 33 of the DPD.

III. Analysis

Art. 97 now endeavours to put a more efficient provision in place. It contains more detailed and more specific requirements regarding the Comm’s reporting obligation. The first reporting period, spanning the period leading up to 25 May 2020, is based on the fact that the GDPR is to apply as of 25 May 2018, as set out in Art. 99 para. 2. This means that the Comm had two years to submit its first report. This period is short compared with the earlier provision and highlights the general aim of the GDPR to make progress on the more effective implementation of data protection within the EU. Within the context of this short first period, it is, however, important to bear in mind that the GDPR already came into force on 24 May 2016. This means that, based on the date of entry into force, the Comm has no less than four years to prepare its first report. The Comm is then obliged to report at four-year intervals.

The Comm must submit its reports to the EP and the Council every four years. As the primary legislative authority within the EU, both institutions must be jointly informed of developments relating to the application and implementation of the GDPR in order to take legislative action as and when required.

The reports also must be made public. This requirement is met by publication on the Comm’s website. The reports can, however, also be published in the EU’s Official Journal in series C (Communication). The publication requirement aims to make the application of the GDPR more transparent and, in doing so, gives the general public, a category that includes experts and data protection practitioners, more of an opportunity to scrutinise developments. With one month of delay, the first report of the Comm was published on the website on 24 June 2020. In its report, the Comm is to evaluate and review the GDPR. As far as the content of the Comm’s report is concerned, the GDPR sets out much more specific provisions than Art. 33 of the DPD. This once again highlights the GDPR’s aim of putting more effective provisions in place. The provisions state that the Comm’s report is to review, in particular, the application and functioning of Chapter V (transfer of personal data to third countries or international organisations).

 

 

[…]