Recital 48a

The free movement of personal data within the Union and the protection of natural persons are objectives of equal rank of this Regulation. Where a provision of this Regulation is open to more than one interpretation in respect of processing privileged under Article 10a, preference is to be given to the interpretation that gives effect to both objectives. The privilege rests on an exchange: the controller or processor obtains a presumption of compliance and relief from documentation duties, and in return makes data available for objectives of general interest; that exchange establishes, in the assessment under Article 52(1) of the Charter, the proportionality of the privilege as a whole. The extent of the data to be made available should be proportionate to the nature and scale of the processing and to the size and capacity of the controller or processor. Standards applied in the market, including international standards, may afford safeguards equivalent to those of approved codes of conduct and certification mechanisms; the Board should include a standard in its list where compliance with the standard is independently verifiable and monitored and where its safeguards afford an equivalent level of protection, and should remove it where those conditions cease to be met. The ordinary commercial activities of a micro, small or medium-sized enterprise do not include the making available of personal data against remuneration as its principal activity. Article 10a provides a basis in Union law for the purposes of points (g) and (j) of Article 9(2); whether the processing is necessary remains to be assessed in the individual case, and the essence of the right to data protection is to be respected in every application of the Article. Specific and substantiated indications require concrete elements relating to the processing in question; the assertion of an infringement does not suffice, and full proof is not required. Standardised information fulfils the purpose of Articles 13 and 14 where it enables data subjects to identify the controller, understand the purposes of the processing and exercise their rights. For transfers to third countries, the presumption leaves intact the requirement that data subjects enjoy a level of protection essentially equivalent to that guaranteed within the Union. The rights of data subjects do not depend on the commitment; its withdrawal ends the privilege for the future and leaves obligations already incurred unaffected. The powers of supervisory authorities and the rights and remedies of data subjects shall remain unaffected.

The incident reporting obligations under Union cybersecurity and digital legislation impose a significant administrative burden on entities especially because they have divergent timelines, deadlines, reporting thresholds, and other divergent reporting obligations. A harmonised approach is therefore necessary.