June 3, 2019

The European Commission has published new guidance on the interaction between the new Regulation on the free flow of non-personal data (2018/1807/EU), which allows data to be stored and processed everywhere in the EU without unjustified restrictions, and the General Data Protection Regulation (2016/679/EU).

The guidance is to help users, in particular SMEs, understand the interaction between the two Regulations when datasets are composed of both personal and non-personal data.

The free flow of non-personal data Regulation prevents EU countries from putting laws in place that unjustifiably force data to be held solely inside national territory. The Commission says that the new rules “increase legal certainty and trust for businesses and make it easier for SMEs and start-ups to develop new innovative services, to make use of the best offers of data processing services in the internal market, and to expand business across borders”.

The guidance provides practical examples on how the rules should be applied when a business is processing datasets composed of both personal and non-personal data. It also: explains the concepts of personal and non-personal data, including mixed datasets; lists the principles of free movement of data and the prevention of data localisation requirements under both, the GDPR and the free flow of non-personal data Regulation; and covers the notion of data portability under the free flow of non-personal data Regulation. The guidance also covers the self-regulatory requirements set out in the two Regulations. To access the guidance, click here.