22. July 2019

Implementation of GDPR: current state of legislation of the EU member states UPDATE

    Update on July 15, 2019: Our overview is updated continuously. New entries for Estonia and Italy.

    Since 25 May 2018, the General Data Protection Regulation (GDPR) has been effective and companies affected have to adapt to far-reaching changes throughout the EU. In 1993, the European Community adopted Directive 95/46/EC, which has since become a benchmark for data protection in the EU Member States. The Directive required legal transformation in the Member States. By contrast, the GDPR is directly applicable in the Member States as a regulation and has application priority over national law (see Article 288 (2) TFEU). In principle, the General Data Protection Regulation is therefore the most important source for the clarification of data protection issues. However, the GDPR provides a large number of opening clauses granting the Member States regulatory powers.

    Germany is the first state to pass a corresponding GDPR transposition law. This also applies since 25 May 2018 and replaces the previous Federal Data Protection Act (FDPA). As many companies are uncertain about the current legal status of data protection rules in other European countries, we have compiled an overview that shows the legal status in most of EU Member States. We update our overview regularly.

    Belgium

    In Belgium, the GDPR is primarily applied directly. However, a law has been passed to transform the former “Commission for the Protection of the Privacy” into a supervisory authority that meets the requirements of the GDPR. This was accompanied by an increase in the budget.

    Official title: „Loi du 3 décembre 2017 portant création de l’Autorité de protection des données“.

    Current status of the legislative procedure: Concluded on 10 January 2018

    Source text: link

    Further information (in national language): link

     

    Bulgaria

    In Bulgaria, the draft of an implementation law is still in the public debate. The slow implementation process is criticized nationally. According to a statement by the Bulgarian Industry Federation: “The lack of information on the forthcoming legislative changes creates the conditions for disseminating misinformation from various sources and prevents companies from adequately preparing themselves.” (Source: СЕГА)

    Title of the act to implement the GDPR: „ЗАКОНА ЗА ЗАЩИТА НА ЛИЧНИТЕ ДАННИ“.

    Current status of the legislative procedure: In public debate since 14 May 2018

    Source text: link

    Recitals to the draft: link

    Further information (in national language): link

     

    Denmark

    In Denmark, the GDPR is subject to Denmark’s own data protection law, which contains supplementary provisions for various areas.
    Official title: „Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninger (databeskyttelsesloven)“.

    Current status of the legislative procedure: Concluded on 17 May 2018

    Source text: link

    Further information on process (in national language): link

    Further information (in national language): link

     

    Estonia

    In Estonia, the new Data Protection Act on the adaptation of data protection law in Estonia to the GDPR entered into force in January 2019.

    Official title: „Isikuandmete kaitse seadus 616 SE“.

    Source text: link

    Further information (in national language) is to be provided

     

    Finland

    In Finland, the government introduced a draft for a new data protection law on 01 March 2018.

    Official title: „Hallituksen esitys eduskunnalle EU:n yleistä tietosuoja-asetusta täydentäväksi lainsäädännöksi HE 9/2018“.

    Current status of the legislative procedure: First reading concluded

    Source text: link

    Further information on process (in national language): link

    Further information (in national language): link

     

    France

    The law on implementation was adopted by the National Assembly on 14 May 2018.

    Official title: „Projet de loi relatif à la protection des données personnelles (JUSC1732261L)“.

    Current status of the legislative procedure: concluded on 14 May 2018

    Source text: link

    Further information on process (in national language): link

     

    Greece

    A bill was published on 20 February 2018. The consultation on the draft took place on 05 March 2018.

    Official title: „Νόμος για την Προστασία Δεδομένων Προσωπικού Χαρακτήρα σε εφαρμογή του Κανονισμού (ΕΕ) 2016/679“.

    Current status of the legislative procedure: consultation on 05 March 2018

    Source text: link

    Information on process (in national language): link

    Further information (in national language): link

     

    Ireland

    The transposition law was adopted on 18 May 2018 by the Dáil Éireann.

    Official title: „Data Protection Bill 2018“.

    Current status of the legislative procedure: concluded on 18 May 2018

    Source text: link

    information on process (in national language): link

    Further information (in national language): link

     

    Italy

    In Italy, the legislative process is still ongoing.

    Official title: „Decreto Legislativo 10 agosto 2018, n.101)“. This amended the Italian Data Protection Act (Decreto Legislativo 30 giugno 2003, n. 196) in order to adapt Italian data protection law to the GDPR requirements.

    Current status of the legislative procedure: The new law of 10 August 2018 contains transitional provisions. In particular, in cases initiated before the new law enters into force, lower fines may be imposed.
    In addition, an opinion of „Commissione speciale su atti urgenti del Governo“ (a special commission on urgent government matters) on further transposition laws is expected.

    Source text: link

    information on process (in national language): link_1 & link_2

     

    Croatia

    The Implementation Act was adopted by Parliament on 27 April 2018 and entered into force on 25 May 2018.

    Official title: „ZAKONO PROVEDBI OPĆE UREDBE O ZAŠTITI PODATAKA – NN24/2018“.

    Current status of the legislative procedure: concluded on 27 April 2018

    Source text: link

    Further information (in national language): link

     

    Latvia

    On Thursday, April 12, the Saeima supported the draft law on the processing of personal data at first reading.

    Official title: „Personas datu apstrādes likums“.

    Current status of the legislative procedure: Draft in the second reading in the Saeima.

    Source text: link

    Information on process (in national language): link

    Further information (in national language): link

     

    Lithuania

    In Lithuania, the legislative process is still ongoing.

    Official title: „IETUVOS RESPUBLIKOS ASMENS DUOMENŲ TEISINĖS APSAUGOS ĮSTATYMAS“.

    Current status of the legislative procedure: The bill will be examined by the Sejma on 26 June 2018.

    Source text: link

    Further information (in national language): link

     

    Luxembourg

    In Luxembourg, the process is still ongoing.

    Official title: „Projet de loi portant création de la Commission nationale pour la protection des données et la mise en oeuvre du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 relatif à la protection des personnes physiques à l’égard du traitement des données à caractère personnel et à la libre circulation de ces données, portant modification du Code du travail et de la loi modifiée du 25 mars 2015 fixant le régime des traitements et les conditions et modalités d’avancement des fonctionnaires de l’Etat et abrogeant la loi du 2 août 2002 relative à la protection des personnes physiques à l’égard du traitement des données à caractère personnel“.

    Current status of the legislative procedure: Opinions and amendments to the draft are obtained.

    Source text: link

    Further information (in national language): link

     

    Malta

    In Malta, the process is still ongoing.

    Official title: „l-Att tal-2018 dwar il-Protezzjoni u l-Privatezza tad-Data“.

    Current status of the legislative procedure: Third reading at 24 May 2018.

    Source text: link

    Further information (in national language): link

     

    Netherlands

    In the Netherlands, the procedure has already been completed.

    Official title: „Uitvoeringswet Algemene verordening gegevensbescherming“.

    Current status of the legislative procedure: Completed on 15 May 2018 as a hammer piece.

    Source text: link

    Further information (in national language): link

     

    Austria

    In Austria, the implementation was carried out by several amendment acts to the national data protection law.

    Official title: „Datenschutzgesetz DSG“.

    Current status of the legislative procedure: Last amendment to act on 15 May 2018.

    Source text: link

    Further information (in national language): link

     

    Poland

    In Poland, the process is still ongoing. A draft is being dealt with in the Sejm.

    Official title: „Ustawa o ochronie danych osobowych“.

    Current status of the legislative procedure: Statement from the „Konferencja Rektorów Akademickich Szkół Polskich“ on 23 May 2018.

    Source text: link

    Further information (in national language): link

     

    Portugal

    In Portugal, the process is still ongoing.

    Official title: „Proposta de Lei 120/XIII“.

    Current status of the legislative procedure: Draft submitted on 26 March 2018.

    Source text: link

     

    Romania

    In Romania, a law implementing the GDPR came into force on 31 July 2018. The Romanian legislature barely makes use of opening clauses of the GDPR to clarify open questions and definitions. For example, it remains unclear how the requirements of Article 37 of the GDPR are substantiated for the appointment of a data protection officer. On the other hand, it includes privileges for authorities and parties in case of violations of the GDPR, that is for example lower fines than for violations by private entities.

    Official title: Law No. 190/2018

    Current status of the legislative procedure: Concluded on 31 July 2018.

    Source text: link

    Further information (in national language): link

     

    Sweden

    In Sweden the process is already concluded.

    Official title: „Ny Dataskyddslag“.

    Current status of the legislative procedure: concluded on 18 April 2018

    Source text: link

    Further information (in national language): link

     

    Slovakia

    In Slovakia the process is already concluded.

    Official title: „Zákon o ochrane osobných údajov a o zmene a doplnení niektorých zákonov“.

    Current status of the legislative procedure: concluded on 30 January 2018

    Source text: link

    Information on process (in national language): link

     

    Slovenia

    In Slovenia, the process is still ongoing.

    Official title: „OSNUTEK ZAKONA O VARSTVU OSEBNIH PODATKOV (ZVOP-2)“.

    Current status of the legislative procedure: Government bill submitted on 23 January 2018

    Source text: link

     

    Spain

    In Spain, the process is still ongoing.

    Official title: „Proyecto de Ley Orgánica de Protección de Datos de Carácter Personal“.

    Current status of the legislative procedure: The draft was approved by the Council of Ministers on 11 April 2018 for referral to the Cortes Generales

    Source text: link

    Information on process (in national language): link

     

    Czech Republic

    In Czech Republic, the process is still ongoing.

    Official title: „Návrh zákona o zpracování osobních údajů“.

    Current status of the legislative procedure: Government bill submitted on 21 March 2018

    Information on process (in national language): link

     

    Hungary

    In Hungary, the process is still ongoing.

    Official title: „jogról és az információszabadságról szóló 2011. évi CXII. törvény jogharmonizációs célú módosításáról szóló törvény“.

    Current status of the legislative procedure: Draft of 25 September 2017

    Source text: link

     

    United Kingdom

    In the United Kingdom the process is already concluded.

    Official title: „Data Protection Act 2018“.

    Current status of the legislative procedure: concluded on 23 May 2018

    Source text: link

    Information on process (in national language): link

     

    Cyprus

    In Cyprus, the process is still ongoing.

    Official title: „της προστασίας των φυσικών προσώπων έναντι της επεξεργασίας των δεδομένων προσωπικού χαρακτήρα και για την ελεύθερη κυκλοφορία των δεδομένων αυτών Νόμος του 2018.“.

    Current status of the legislative procedure: Consultation on draft on 04 April 2017

    Source text: link

    Information on process (in national language): link

    Newsletter

    Stay up to date about Data Protection!