Privacy issues in 2020

Robin Data: Even in 2020, the GDPR will remain at the centre of data protection in Europe and Germany. Which activities of the Federal Data Protection Commissioner are affected by the GDPR this year, as far as can be foreseen at the moment?

Hermerschmidt: At the EU level, the meetings of the European Data Protection Board, which brings together the supervisory authorities of the EU member states, are coming up. The committee decides on further guidelines for the implementation of the GDPR. At the national level, the laws implementing the GDPR have been adopted in recent years, so no changes are to be expected here. By the way, this also applies to data protection legislation in general in 2020, at least as far as it concerns companies.

An important date is the publication of the evaluation results of the GDPR on 25.5.2020, two years after its entry into force. This review is provided for in the GDPR. The supervisory authorities of the EU states will jointly publish something on this. The German Data Protection Conference, the conference of independent federal and state supervisory authorities, has already published a Report on the experience with the application of the GDPR adopted.

Robin Data: After the data protection conference has already commented on the evaluation of the GDPR, what other priorities does it set for 2020?

Hermerschmidt: Last year it was artificial intelligence, but this year no focal point is clear yet. But the data protection conference will deal with Windows 10, for example: How can the operating system be used in a data protection-compliant manner, what does the operating system report back to Microsoft? Also on the agenda is the modernization of the register landscape of public authorities, which the Federal Ministry of the Interior is striving for. In future, the exchange of information across registers is to be facilitated, with the data protection authorities pressing for implementation in line with data protection requirements.

Robin Data: What judgements of the European Court of Justice are pending?

Hermerschmidt: The so-called Schrems II judgement is particularly noteworthy here. The Austrian Max Schrems has filed a lawsuit against the Privacy Shield, which concerns the exchange of data between the EU and the USA. Formally, the lawsuit was directed against the Irish supervisory authority responsible for Facebook. The Irish High Court then referred the issues to the CJEU. The ruling is expected in the second quarter of 2020. As the CJEU's first Schrems ruling was far-reaching, Schrems II is eagerly awaited.