GDPR simplification misses the mark

Ron De Jesus, Field Chief Privacy Officer at Transcend, writes in an op-ed for Bloomberg that the European Commission's proposed simplification of the EU General Data Protection Regulation (GDPR) falls short, as it fails to genuinely reduce administrative burdens or increase clarity. While data protection practitioners hoped for more proportionate compliance for SMEs, the proposal, focusing on Records of Processing Activities (RoPAs) under Article 30, merely exempts more companies from keeping these records.

De Jesus argues that much of the information required in RoPAs is duplicated by the point of collection transparency requirements under Article 13, which applies to all companies regardless of size. This overlap means non-exempt organisations still face duplicative documentation.

For genuine simplification, De Jesus suggests aligning Articles 13 and 30 into a single, living, and public document. A consolidated approach such as this would eliminate duplicated efforts across data protection compliance and legal teams, provide data subjects with a single view of data usage, and strengthen trust with EU regulators.