Commission Guidance on the direct application of the General Data Protection Regulation as of 25 May 2018.

State of affairs

With the adoption of the Data Protection Reform Package in May 2016, the EU agreed on a major overhaul of its data protection framework. The package includes inter alia the General Data Protection Regulation (GDPR), which replaces the twenty-years-old Data Protection Directive. On 25 May 2018, the GDPR becomes directly applicable throughout the EU, two years after its adoption and entry into force. 

Guidance

In the coming months, the Commission will continue to actively support the preparation for applying the GDPR and has published guidance with the following information: 

• key innovations and opportunities opened up by the new GDPR, 
• a recap of preparations already undertaken at EU level, 
• what the European Commission, the national data protection agencies and the national administrations still should do to successfully complete preparations and 
• measures which the Commission intends to put in place in the coming months.  

The Commission is also launching online support to help stakeholders prepare for the application of the Regulation and an information campaign in the Member States. 

Changes at national level

The German legislator has commenced the adaptation of national rules to the GDPR in several legislative steps. Initial measures were taken with the Data Protection Adaption and Implementation Act. In a second step, amendments to Books I and XX of the German Social Code were made with the Act amending the Federal War Victims Relief Act and other regulations. These two books of the Social Code standardise the basic rules on social data protection applicable to all areas of social protection. 

Nevertheless, further sector-specific adjustments need to be made in the other books of the Social Code. This also applies to Book V and Book XI of the Social Code as the relevant social legislation for statutory health and long-term care insurance. However, the legislator is yet to present a draft for this.  

Next steps

Starting from May 2018, the Commission will review the application of the new rules by the Member States and, if necessary, take appropriate action. In 2019, one year after the date of application of the Regulation, it will take stock and collect the experiences of different stakeholders. A report on the evaluation and review of the Regulation will then be presented by May 2020.  

GDPR guidance.