When thinking about the aim of GDPR, one of the first things that comes to mind is the set of rules, obligations, and restrictions on the processing of personal data. When in fact, as the full title of GDPR – General Data Protection Regulation – and its recitals explain, the subject matter and purpose of this regulation is not only the protection of personal data of natural persons but also the free flow of such data.
GDPR– Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
To further increase the cross-border exchange of data and boost the data economy in Europe, the European Union have adopted another regulation, which supplements GDPR with respect to non-personal data. The Free Flow of Non-Personal Data Regulation (FFNPDR) became effective from May 28, 2019 – one year after GDPR.
FFNPDR– Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union (The Free Flow of Non-Personal Data Regulation).
The FFNPDR introduces the principles of free movement of data and prohibits data localisation requirements within the EU, including indirect measures such as certification of local providers. It also establishes co-operation to ensure local authorities have sufficient access to data stored in other countries. Lastly, it provides incentives for data portability through codes of conduct.
This recent regulation also applies to mixed datasets, in other words documents containing both personal and non-personal data. In case of any conflict between the FFNPDR and GDPR, the latter takes precedence.
It is worth mentioning that the regulation has implications for the future as it will not affect current localisation requirements in the EU or its Member States’ legislation in effect prior to May 2019. Taking invoicing as an example, EU Member States may still need to notify local tax authorities about their intention to archive invoices in another EU country. Similar obligations may no longer be introduced in new legislation.
The clear aim of the FFNPDR is to create legal certainty for businesses to process their data wherever they want in the EU. It certainly raises trust in data processing services, such as digital archives, from other EU countries.
Take Action
Sovos Trustweaver provides eArchiving solutions for clients in over 50 countries. Find out more and follow us on LinkedIn and Twitter to keep up-to-date with regulatory news and other updates.
