Cross-border data flow in the digital single market: study on data location restrictions operation Prohibition against third party access and/or disclosure
(SMART 2015/0054)
supervisory authorities. Ensuring sufficient security/confidentiality
Clarification from national regulators, supervisors and lawmakers that the requirement can be met if substantive access to the contents of financial data is made impossible. Offsite storage should not necessarily be considered as constituting third party access and disclosure.
The overview above illustrates that part of the solution – alignment on substantive requirements – is comparable to the state of play for health data. However, financial data faces an additional challenge through the requirements imposed by national regulators and supervisors, who require the ability to access and audit data processing facilities. 2.3.3 Citizen data and company records Overview and subtypes of data Correspondents were also invited to identify barriers to the free flow of data for two other types of information which are examined together in this section of the report:
Citizen data: basic identity registers, particularly any official records in relation to a country’s citizens or residents (such as their names, addresses, date of birth) or to legal entities; Company data: company records, such as balance sheets, income statements or annual accounts submitted by companies.
These two categories of data are examined together here, as they all relate to fundamental information about natural or legal persons which is considered authoritative and therefore has high requirements in relation to trustworthiness and security. A second similarity is that these records tend to be managed as a part of a specific statutory or legislative mandate provided by the public sector. The following overview can be provided for the reported barriers: Figure 8 – Types of barrier observed (Citizen data and company records)
Country
Source
Belgium
Wet van 8 augustus 1983 tot regeling van een Rijksregister van de natuurlijke personen / Loi
36
Restriction imposed on providers / users / data Any party that wants to access or use
Direct or indirect Indirect
Summary of obligation / restriction The law identifies the Minister of Foreign Affairs as the competent authority to maintain the Register (Article 4), and notes that an authorisation is
