On March 16 in Amsterdam, the Centre for Information Policy Leadership kicked off the first in a series of workshops entitled “Towards a Successful and Consistent Implementation of the GDPR.” The workshops bring industry and EU regulators together to develop consensus interpretations of the GDPR, and will be followed up with interpretive position papers being developed for delivery to the Article 29 Working Party.  The importance of this project to the data protection community is difficult to overstate — although the GDPR’s effective date is still over two years away, there are a significant number of areas where the GDPR will be subject to additional interpretation. Those interpretations will have material implications for the strategies multinational businesses adopt relative to many of the GDPR’s provisions. Given the already daunting task of preparing for GDPR, it is crucial to settle as many issues of interpretation as soon as possible.

The CIPL workshops include a broad swath of industry representatives, including Internet companies, telcos, pharmaceuticals, media, financial services, consumer products, education, common carriers, and data companies. Regulators attending the kickoff workshop included CNIL director Isabelle Falque-Pierrotin, who also chairs the Article 29 Working Party, and representatives from the data protection authorities of Belgium, Hungary, Ireland, Netherlands, Poland, Spain, and the UK.  Karolina Mojzesowicz, director of data protection reform, represented the EU Commission.

The kickoff meeting had an encouragingly collaborative tone, with both industry and regulators recognizing that ongoing dialogue and engagement is needed to address the myriad of interpretive issues presented by the GDPR. Given the wide range of issues identified, however, it is clear that this process of dialogue and interpretation will be ongoing for some time, likely until and even after the GDPR’s implementation date. There was also broad recognition that the GDPR brings with it substantial changes, and that implementation will not be a trivial exercise for the majority of companies doing business in the EU. Indeed, for many, even the two-year+ timeframe presents some daunting challenges.

These challenges are exacerbated by the number of questions that still surround the GDPR. For instance, what are the elements of accountability for demonstrating compliance under the GDPR? Must a DPO be based in Europe? To which role in an organization should they report? Is PIA guidance from DPAs needed? At what moment will an organization be deemed to have first become aware of a security breach? How will the right of data portability be applied in practice? Will industry be consulted on the development of standardized icons for privacy notices? These and a considerable list of other questions remain to be answered. While industry can propose answers, ultimately, it is the regulators and courts which will have the final say.

For its part, WP29 has announced that it will tackle the following four issues first: (1) data portability; (2) the concept of "high risk" and data protection impact assessments; (3) certifications, and, (4) data protection officers. It also announced that it will convene a “Fab Lab” (fabulous laboratory) event to receive the next round of industry feedback during the month of June, details to be announced. From there, it is unclear how the ongoing process of engagement and dialogue will continue, but CIPL is planning additional workshops and is looking at options for participation in this vital project by non-members. The WP29 will also be looking for other fora for engaging with the private sector, but indicated a willingness to stay engaged with the process launched in Amsterdam.

Given the potential impacts that different possible interpretations of GDPR requirements will have for businesses, it is important that these efforts have the broadest possible representation from industry. 

It is also worth noting that while a broad range of trade associations and industry groups will be conducting their own GDPR interpretive exercises, the CIPL workshops, along with the WP29’s Fab Lab, are the only processes in which a substantial number of DPAs are currently directly engaged. Accordingly, for businesses with an interest in the outcome of the interpretive process (read: nearly everyone with operations in, or serving, EU countries), the time to get actively involved in this process is now.