The GDPR contains a large number of provisions that allow the Member States (MS) to set the rules in many important contexts, i.e., that effectively still allow for divergences between the data protection rules in the MS.
In some respects, this need not necessarily be seriously problematic.
For instance, the Regulation stipulates, in Article 9(2)(b), that sensitive data may be processed if the “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law”. The relevant employment and social security laws in the different MS are likely to differ in the specifics of such requirements, e.g., as to whether trade union membership or race or disability may or must be recorded in certain forms.
This should not cause too many problems as these matters apply almost solely within one state, and most employers and employees may be expected to be familiar with their own laws and forms in these respects. Even then, a certain convergence can be expected, in that the Regulation adds to the above that the relevant national requirements must be laid down in “Union law or Member State law or a collective agreement pursuant to Member State law”; and that these legal instruments must “provid[e] for adequate safeguards for the fundamental rights and the interests of the data subject”. The latter means that compliance of the relevant instruments with these conditions can now be checked by the courts, and ultimately the CJEU.
But other provisions allowing for divergences are much more problematic. Some are so broad as to give states almost complete freedom to evade the normal requirements of the Regulation in large areas. Others are particularly problematic in the online environment and threaten the functioning of the Digital Single Market – one of the top priorities of the Commission and many MS.
European Digital Rights, a European public interest organization, has done a very interesting study about these potential divergences
