Ref.

Ares(2020)1873825 - 01/04/2020

ROADMAP
Roadmaps aim to inform citizens and stakeholders about the Commission's work in order to allow them to provide
feedback and to participate effectively in future consultation activities. Citizens and stakeholders are in particular
invited to provide views on the Commission's understanding of the problem and possible solutions and to make
available any relevant information that they may have.
TITLE OF THE INITIATIVE Report on the application of the General Data Protection Regulation
LEAD DG – RESPONSIBLE UNIT DG JUST.C3 and C4
LIKELY TYPE OF INITIATIVE Report from the Commission on the application of the General Data Protection
Regulation
INDICATIVE PLANNING Q2 2020
ADDITIONAL INFORMATION https://ec.europa.eu/info/priorities/justice-and-fundamental-rights/data-
protection/2018-reform-eu-data-protection-rules/eu-data-protection-rules_en
This Roadmap is provided for information purposes only and its content might change. It does not prejudge the final
decision of the Commission on whether this initiative will be pursued or on its final content. All elements of the
initiative described by the Roadmap, including its timing, are subject to change.

A. Context, Problem definition and Subsidiarity Check

Context
1
The General Data Protection Regulation (GDPR) , applicable since 25 May 2018, strengthens the individual’s
right to personal data protection, reflecting the nature of data protection as a fundamental right for the European
Union. It provides for a single set of rules directly applicable in the Member States legal orders and guarantees
the free flow of personal data between EU Member States, therefore improving business opportunities.
As requested by Article 97 of the GDPR, the Commission will report on the application of this Regulation two
years after its entry into application.
The report will take into account the contribution from the Council, the European Parliament, the European Data
Protection Board and those received from the GDPR Multi-Stakeholder Group (business and civil society
representatives).
It will also build on the Communication “Data protection rules as a trust-enabler in the EU and beyond – taking
2
stock” issued on 24 July 2019 (COM(2019) 374 final). as well as the Communication “Exchanging and
3
Protecting Personal Data in a Globalised World” issued on 10 Jan. 2017 (COM/2017/07 final).

Problem the initiative aims to tackle

The objective of the report is to identify possible issues in the application of the GDPR. As required by the Article
97 of GDPR, it will in particular cover the issue of international transfer of personal data to third countries
(Chapter V of GDPR), with a special focus on existing adequacy decisions, and the cooperation and consistency
mechanism between national data protection authorities (Chapter VII of GDPR).
Basis for EU intervention (legal basis and subsidiarity check)
This report is a legal obligation stemming from Article 97 of the GDPR.
B. What does the initiative aim to achieve and how
Building on the stock-taking exercise conducted in June 2019, referred to above, the report will evaluate the
application of the GDPR in particular as regards international transfer of personal data to third countries and the
cooperation and consistency mechanism between national data protection authorities.

1
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
2
https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=COM:2019:374:FIN
3
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=COM%3A2017%3A7%3AFIN
C. Better regulation
Consultation of citizens and stakeholders
The input from stakeholders will be gathered through consultation of the GDPR Multi-Stakeholder Group
4
established by the Commission and ensuring a balanced representation of business and civil society.
It will complement the contribution from the Council, from the European Parliament, and from the Data Protection
Authorities and the European Data Protection Board.
As regards adequacy decisions, information will be collected also on the basis of bilateral dialogues with the
concerned third countries authorities.
Evidence base and data collection
The information underpinning the report will be gathered notably through:
 the Council position and findings on the application of the General Data Protection Regulation (already
5
adopted).
 the input from the European Parliament
 the replies to be received on the detailed questionnaire sent to the Data Protection Authorities and to the
6
European Data Protection Board
 the replies to be received on the detailed questionnaire sent to the members of the GDPR Multi-Stakeholder
Group

4
https://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetail&groupID=3537
5
https://data.consilium.europa.eu/doc/document/ST-14994-2019-REV-1/en/pdf
6
https://edpb.europa.eu/our-work-tools/our-documents/other/contribution-edpb-evaluation-gdpr-under-article-97_en