GDPR 5 years on – Key areas of improvement needed in the the Data and Marketing Industry

Five years after its adoption, the impact of the GDPR on Europe’s data protection and privacy landscape cannot be overstated. Not only did the GDPR provide upgraded rights to consumers and aimed at harmonising the rules across the continent; its effect went beyond Europe to influence the debate around other countries’ data protection legislation and spark renewed interest in issues of data privacy.

However, despite the attempts of the European Commission, the European Data Protection Board (EDPB), the European Data Protection Supervisor (EDPS) and the national Data Protection Authorities (DPAs) to ensure a consistent application of the law, fragmentation and legal certainty remain. Ultimately contradicting the harmonisation goal of the GDPR, these ongoing challenges undermine the potential of the GDPR to uptake the opportunities of the data economy while protecting individuals’ privacy.

In this context, FEDMA carried out an assessment of the effective application of the Regulation, accompanied by concrete recommendations to address some of the challenges faced by the Data and Marketing Industry.

Reflecting over the past five years, the Data and Marketing Industry identified the following key areas of improvement:

1. GDPR Risk-based approach: Setting the risk-based approach as the decision-making compass in the interpretation and implementation of the GDPR
2. GDPR oversight by Data Protection Authorities (DPAs): Promoting an inter-regulatory approach in the implementation and enforcement of the GDPR
3. GDPR legal bases for data-driven marketing: Promoting the added value of Legitimate Interest for data subjects
4. International Data Transfers: Enhancing proportionality and legal certainty
5. Privacy Enhancing Technologies (PETs): Encouraging organisations to invest in pseduonymisation and anonymization techniques
6. Data controller & data processors: Preserving a clear and proportionate allocation of responsibilities

This work is based on the feedback received in an internal survey where several FEDMA’s and DMA’s members shared their experience in complying with the GDPR.

Find here the full report.