“Better Regulation”, part II: improving the GDPR – or not? (Art. 1, 2, 4(1), 5 & 30)

The European Commission’s announcement that it will consider simplifying regulatory regimes, notably in relation to data and technology, seems to open Pandora’s box. Is it a chance to draw lessons from what works well and what works less well?

In this series on “Better Regulation” in relation to the digital economy, I will be exploring various laws and topics.

The first instalment of this “Better Regulation” series looked at the ePrivacy Directive and questioned its continued relevance.

The second topic I will look at is the broad topic of the GDPR & better regulation. Because the GDPR is a very long piece of legislation, it makes little sense to discuss it, Article by Article, in just one long analysis. Instead, I will be examining it, almost Article by Article, in a series of analyses.

[So no 24-page PDF as in the case of ePrivacy, but also no 100-page one instead at this stage. Perhaps I will compile them all together once I have finished.]

Today’s piece will look at Articles 30, 1, 2, 4(1) and 5.

---

I. Does the GDPR really need to be reformed?

The GDPR was adopted 9 years ago, and in the past 7 years of enforcement, we have seen many cases before supervisory authorities and before the Court of Justice of the European Union. In addition, supervisory authorities have adopted at national level or at EU level (through the European Data Protection Board) guidance of various degrees of binding effect on a wide range of topics.

As the case law and guidance has evolved, though, certain more dogmatic positions have emerged or been confirmed that, put together, suggest a strengthening of the rules in many respects. While that may be positive on paper for data subjects, the truth is that several of these positions bring into question the very intent behind the rules themselves.

For instance, in my following piece I intend to discuss Article 6 on legal grounds, but evolutions to how the “contract” and “legitimate interest” legal grounds are interpreted (in practice, more and more restrictively) are gradually making consent the primary legal ground, despite the absence of any hierarchy between legal grounds.

Likewise, some regulators’ restrictive practice surrounding Article 36 on prior consultation – a provision intended to allow some discussion with regulators in potentially high-risk processing situations – has meant that there are few opportunities to discuss plans with regulators without risking an investigation. The appearance of informal “regulatory sandboxes” is redressing the balance, but what is a regulatory sandbox if not precisely the type of mechanism that Article 36 was intended to foster?

In other words: yes, the GDPR could be reformed, in order to take into account case law and regulatory evolutions but also in order to take into account their excesses and unintended consequences. Rethinking the GDPR does not mean rewriting it in its entirety but making sure that it is and remains a workable framework for data protection. It is then more a matter of improving it, and not replacing or diminishing it.

---

II. Art. 30 – ROPA (record of processing activities)

I would normally have left Article 30 (on the “record of processing activities” or “ROPA”) until much later, but the Commission announced that it is looking at removing the obligation to maintain a ROPA for organisations with less than 500 employees (to simplify).

This does not seem to be the right approach.

A. Why ROPAs really matter and what they contain

A ROPA is the result of the most useful exercises in documentation as far as controllers are concerned, namely data mapping. It forces controllers to understand what personal data they are processing (Art. 30(1)(c) GDPR), whose personal data (same), why they are processing it (Art. 30(1)(b) GDPR), to whom they are or will be disclosing personal data (Art. 30(1)(d) GDPR), in which countries (Art. 30(1)(e) GDPR), for how long (Art. 30(1)(f) GDPR) and how they will secure that personal data (Art. 30(1)(g) GDPR).

The biggest omission from Article 30(1) GDPR (on ROPAs for controllers) is the legal ground for processing, but documenting legal grounds is critical also for internal data management purposes, such that many ROPAs actually include legal grounds anyway.

For processors, the obligation is a little different, as the types of information to be included are more limited, but they still comprise for whom exactly the processing takes place (identity and contact details of each controller – Art. 30(2)(a) GDPR), what they are processing (categories of data – Art. 30(2)(b) GDPR), in which countries (Art. 30(2)(c) GDPR) and how they will secure that personal data (Art. 30(2)(d) GDPR).

In practice, a ROPA comes in handy in many situations, such as in the event of a (potential) personal data breach or a data subject access request.

But is it so much work? Yes, it can be, depending on how detailed a ROPA has to be.

B. Issues with Art. 30 GDPR

This leads me to the reasons why the obligation to maintain a ROPA is being criticised in various circles:

• The GDPR states that non-compliance with Article 30 can lead to fines of up to 2% / 10 million EUR (Art. 83(4) GDPR);
• Yet authorities would like to see a lot of detail in ROPAs, while organisations whose core activities are not data-focussed do not see the value in adding so much detail;
• Plus, failure to cooperate with the supervisory authority (Art. 31 GDPR) can also lead to fines of up to 2% / 10 million EUR (Art. 83(4) GDPR) and will potentially be counted as a separate infringement (based on guidance on administrative fines[1] issued by the European Data Protection Board / EDPB) if the supervisory authority considers any refusal to provide more detail in the ROPA as an infringement that finds its source in a different intention).

Specifically for processors, the point about having a controller-specific ROPA (with identity and contact details of the controller) is not workable in the strict sense when it comes to actually maintaining a ROPA. If you imagine the ROPA as a document that exists and can be provided as such, no processor with more than a couple of customers as controllers will have one. Instead, they will inevitably resort to a system that allows them to export a ROPA upon request, with the data concerning a particular controller. Yet the strict wording of Art. 30(2)(a) GDPR doesn’t work with this – the processor has to maintain a record that contains the name and contact details of each controller in a ROPA. No processor I know uses a ROPA as customer management system.

Even beyond this requirement, the “categories of data” requirement has always been problematic for processors, even in the context of Article 28 GDPR (and in the context of any Standard Contractual Clauses for international transfers, too), in particular for processors involved in activities such as hosting.

“Be cautious then, better to over-declare”, some might say. This is all fine, but regulators and courts are quick to criticise over-declaring, such as privacy notices containing conditional verbs and words such as “may” or “might” and responses to data subject requests in which a range of potential recipients are mentioned rather than the precise recipients (even if this is difficult to assess in many cases for reasons I will tackle when looking at Art. 15 GDPR in another part of this series).

C. Changing the threshold won’t solve these issues

Setting a threshold of 500 employees to determine whether an organisation should have a ROPA or not is then not the problem. The key problem is one of alignment of expectations between controllers and processors on the one hand, and regulators on the other hand.

In addition, the exceptions to the ROPA exception foreseen in Article 30(5) GDPR are very broad:

“The [obligation to maintain a ROPA] shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.”

I would be very intrigued to see which companies with even just 1 person in employ only carry out occasional processing (no e-mail? no payslips? nothing?) – let alone those with more than 50 / 100 / 250 persons in employ.

Even if the “occasional processing” exception to the ROPA exception were to disappear, there would still be special categories of data – and case law has said that even the name of a spouse or partner can reveal sexual orientation. Good luck with escaping the ROPA obligation then if you have emergency contact details for your employees, based on that case law (which I will examine when looking at Art. 9 GDPR in a later piece in this series).

D. What would actually help

Instead, the solution might be very simple:

• Remove Art. 30 GDPR from the scope of sanctions, or
• Leave it there but (i) make the level of detail linked to the nature of the processing and the risk it presents (through a reference to the risk-based approach either in Article 30(3) GDPR or in a new Article 30(6) GDPR) and (ii) take that level of risk explicitly into account in the assessment of sanctions (through an addition of the risk-based approach to Article 83(2) GDPR, as a new Article 83(2)(l) GDPR).

[This last point, about introducing the risk-based approach into Article 83(2) GDPR, is something I will spend a little more time on hereunder.]

Such an approach would maintain the obligation to have a ROPA and thus ensure that this good practice remains mandatory, while giving additional flexibility to organisations for whom the processing of personal data is not the main activity but rather a byproduct of having employees, working with digital tools etc.

It would allow a better alignment of expectations and make the rule workable. Better regulation, then.

---

III. Art. 1 – Subject matter and objectives

The first Article of the GDPR enshrines the principle that the GDPR “protects fundamental rights and freedoms” (Art. 1(2) GDPR) and the principle of “free movement of personal data” within the EU (Art. 1(3) GDPR).

A. Fundamental rights: from equality of many to primacy of one

Art. 1(2) GDPR has to be read in conjunction with Recital 4 of the GDPR, which states the following:

“[…] The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and observes the freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular the respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity.”

In practice, though, recent regulatory guidance and case law appears to have forgotten the key message of Recital 4 GDPR. The following are some of the clearer examples:

• The Bundeskartellamt judgment of the CJEU[2]? Personalisation of content, despite being “useful to the user”, did “not appear to be necessary in order to offer that user the services of the online social network” according to the CJEU. This despite the fact that an online social network necessarily is personalised, given that its whole purpose is to be influenced by the network that the user builds (and which is necessarily, inherently personalised). Why does this forget Recital 4? Simply because the CJEU has given an indication of how it would define a business – thus challenging the freedom to conduct a business (Art. 16 of the EU Charter of Fundamental Rights) by suggesting its own view of what a service inherently is and depriving businesses from the contract legal ground based on this idea.

[Sure, the CJEU said “subject to verification by the referring court”, but it remains a perspective that appears to ignore the very fundamentals of the freedom to conduct a business.]

• The Consent or Pay Opinion of the EDPB[3]? The EDPB’s de facto requirement for “large online platforms” (whatever that might be) to make a “further alternative available to data subjects”[4], next to a “pay” version and a “consent to profile-based advertising”, is another example of a failure to take into account the freedom to conduct a business. The EDPB helpfully specifies that “there is no obligation for large online platforms to always offer services free of charge”, but this is just before saying that failure to do so brings into question the validity of any consent given. In other words, the EDPB is imposing business model changes (i.e. an infringement on the freedom to conduct a business, Art. 16 of the EU Charter of Fundamental Rights) – despite the fact that no higher court has ever ruled that a “subscription-based or ad-based” type of offering is prohibited.
• A recent judgment by the Polish Supreme Administrative Court (the “NSA”) illustrates this further. In its judgment of 5 February 2025, the Polish Supreme Administrative Court held that where “legitimate interest” (Art. 6(1)(f) GDPR) is relied upon, the controller has a burden of proof to demonstrate the necessity of processing and that general business practice or hypothetical risks do not justify data retention. On the issue of whether data could be kept after the end of a service in order to have evidence in case of a potential legal claim, according to the court, “if […] the set of factual circumstances related to the proper performance of the [contract] indicates that there are no claims of the parties against each other, it should be assumed that there will be no “new relationship” between them (e.g. court proceedings) and in such a situation there is no further processing of personal data on this basis”. In other words, if there is no concrete and identifiable risk of a legal claim following the end of a service, the idea of keeping data for the defence against legal claims cannot be invoked to justify the retention of data, according to the court. In effect, data protection prevails over the right to defend oneself if it is not obvious from the start that there would be legal proceedings. This forgets about Recital 4 due to the clear importance of being able to defend oneself (Art. 47 & 48 of the EU Charter of Fundamental Rights), not just against obvious legal claims but also against less obvious ones.

In other words, the idea that the GDPR “protects fundamental rights and freedoms” seems to have given way to the primacy of the fundamental right to data protection.

B. What would actually help: equality with other fundamental rights

A simple solution to mitigate the risk of such excesses in the future would be to include parts of the text of Recital 4 directly in Article 1(2) of the GDPR or as a new Article 1(4) GDPR.

Proportionality is critical in this respect. While it is already referred to in Articles 83 and 84 (on fines and other penalties), proportionality in relation to other fundamental rights and freedoms needs additional safeguards, and their more explicit inclusion in Article 1 might make regulatory and court practice more in line with Recital 4 GDPR.

C. Free movement of data vs national enforcement

On a more macro level, the national approach to enforcement is creating a state of near permanent infringement of Article 1(3) GDPR, which states the following:

“The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.”

By “national approach to enforcement”, I mean the way in which national supervisory authorities take action on their own in many cases. I will likely devote time later to a more critical analysis of enforcement and the need (in my view) to centralise enforcement, potentially by combining the forces of national authorities, but the example of the reactions in January and early February 2025 of data protection authorities to the appearance on the European market of the DeepSeek AI model and related app were an illustration of this point:

• Italy started by banning the DeepSeek mobile app on 30 January 2025;
• Some authorities (e.g. Croatia, Ireland) asked questions from DeepSeek about their processing of personal data;
• Others (e.g. Lithuania, Netherlands, Poland) cautioned citizens regarding the use of DeepSeek;
• Investigations were also started by others, some on the basis of complaints (e.g. Belgium, Greece).

While this is not an example of intra-EU data movement, the fragmented approach is revelatory: each authority still considers its own territory as the first that matters.

The same can be seen in relation to the GDPR angle to enforcement of Article 5(3) of the ePrivacy Directive (as many authorities enforce it through a GDPR-compliance perspective, such as the Criteo decision of the CNIL). For instance, one area in which inconsistencies have appeared relates to the look of cookie consent buttons and so-called “dark patterns”. These divergences appear through the topics on which there was no agreement to be found in the EDPB’s Cookie Banner Taskforce report of 17 January 2023, or for instance when comparing a German court’s acceptance of blue as an “accept” button colour[5] to the Belgian Data Protection Authority’s rejection of dark red as an “accept” button colour[6] (despite the respective colours in question being in both cases the brand colour).

As I will argue in a later piece, a centralised approach to enforcement would help avoid such issues in terms of free movement of personal data.

---

IV. Art. 2 + 4(1) – Material scope & “personal data”

Article 2 GDPR continues to require interpretation, notably as regards the issue of whether the oral disclosure of personal data leads the recipient to be involved in the processing of personal data.

The bigger issue that merits clarification in the event of GDPR reform, however, relates not to the notion of “processing” but to the notion of “personal data”, i.e. information that relates to an identified or identifiable natural person.

A. Evolutions to the concept of “personal data”

Recital 26 GDPR is important in this respect, as it states that:

“[…] To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. […]”

Case law over the past decade has revisited the notion of “personal data” as well.

The Breyer judgment made it clear that there is no “identifiable” natural person if “identification of the data subject was prohibited by law or practically impossible on account of the fact that it requires a disproportionate effort in terms of time, cost and man-power, so that the risk of identification appears in reality to be insignificant”[7]. In other words, a person or entity must have a way to identify the natural person itself, or to lawfully compel a third party to provide identification data.

Then the Scania judgment stated that a vehicle identification number (VIN) – i.e. non-personal data to start with – could be personal data for independent operators (= repairers) where they “may reasonably have at their disposal the means enabling them to link a VIN to an identified or identifiable natural person”, that it would not in and of itself be personal data for vehicle manufacturers but that it would indirectly constitute personal data for the vehicle manufacturer making the VIN available to the independent operator from whose perspective it is personal data[8].

The CJEU thus appears to have confirmed the idea of what I call “potentially personal data”, i.e. information that is likely to be personal data from the perspective of the recipient to whom an entity discloses that information, even if that information is not personal data from the perspective of the disclosing entity (because the disclosing entity does not itself have any lawful means at its disposal to identify the natural person or to compel another to provide identification data).

Both cases suggest that “personal data” is a concept that is relative to the would-be controller (i.e. information that is personal data for entity X1 might not be for entity X2 if X2 is unable to obtain identification data [lawfully] from X1).

Whether the CJEU takes the step of confirming this relative approach in the SRB v EDPS case is unclear at this stage, but the Advocate General’s Opinion certainly does so.

The idea of “potentially personal data” (or “indirectly” personal data if one wishes to use the vague wording of the CJEU) highlights two issues with the notion of “personal data”:

• Supervisory authorities assume that everything is personal data and do not prove their own jurisdiction but assume that they have jurisdiction;
• It is unclear what a “potential controller” has to do under the GDPR.

Because authorities are quick to assume that anything is personal data, they equally assume rapidly that the full scope of GDPR obligations applies. An illustration of this took place in the IAB Europe / TCF case, and a recent Market Court judgment annulled the Belgian Data Protection Authority’s decision (before confirming parts of it) on the basis of the fact that the Belgian Data Protection Authority had not properly justified why it considered the information being examined as personal data[9].

B. What would actually help: clarifying obligations and burden of proof

Integrating clearer rules on the burden of proof and on the obligations of “potential controllers” would help make the GDPR more workable.

While burden of proof rules are normally a matter for national law, nothing prevents the GDPR from specifically stating in a new Article 2(5) that the GDPR does not apply to the processing of information that is not established to be personal data from the perspective of the natural or legal person assumed to act as (joint) controller within the meaning of the GDPR.

Alternatively, it could be possible for the legislator to consider which obligations precisely make sense for someone who has not been shown to be actually processing personal data, and to explicitly only list such obligations as applying to such a someone when transmitting, disclosing or otherwise making such information available to a recipient who is in a position to view it as personal data.

For instance, a general privacy statement (provided it can be in the conditional – see earlier point about conditionality) could always be useful, but data subject rights themselves do not make sense if the entity is unable to consider information as personal data.

Such changes would both reduce the risk of excesses by regulators and increase legal certainty, while making GDPR compliance more workable in situations of lack of clarity.

---

V. Art. 5 – Data protection principles

Finally, as last provision to be examined in today’s piece, let us look at Article 5 on data protection principles.

The data protection principles themselves under Article 5(1) GDPR are not particularly problematic in practice, because they are intended to be open principles and thus necessarily have to be interpreted based on the context.

I will likely come back on Article 5(1)(e) GDPR (on storage limitation) if I get around to examining Article 89(1) GDPR, as the issue of reuse of data for commercial research purposes is a tricky one that merits examination and potentially some clarifications in the GDPR (as “statistical purposes” can be commercial research, and AI systems are inherently about patterns and probabilities).

Instead, I wish to focus for now on Article 5(2), on accountability, and on whether an additional principle of risk-based approach might make sense.

A. Art. 5(2): accountability

The first point worth stressing is that accountability does not mean that the controller has the full burden of proof. Article 5(2), much like Article 24 (on “responsibility of the controller”), has been interpreted by supervisory authorities and claimants alike as a justification for demanding evidence of compliance.

However, the obligation of accountability does not involve any obligation to prove anything to data subjects, nor does it entitle data subjects to demand access to documents such as a data protection impact assessment or any other compliance documentation. Data subjects have a right to information regarding the processing, not evidence of compliance.

So far, this has not given rise to significant issues, but requests by complainants to be involved in the monitoring of compliance with orders by supervisory authorities are coming more frequently than previously.

A potential solution might involve adding some words to Article 5(2), namely stating that the controller must “be able to demonstrate to a competent supervisory authority or court compliance with” the data protection principles.

Moreover, as mentioned in the previous section on the notion of “personal data”, supervisory authorities often assume that everything is personal data. They also assume that anyone involved is a controller or joint controller. Yet the accountability obligation only applies to (actual) controllers. The burden of proof thus still rests on supervisory authorities to show that (i) there is processing of personal data and (ii) a particular person or entity is a (sole or joint) controller.

Strictly speaking, no changes would be needed if supervisory authorities followed the rules, but in practice Articles 83 and 84 on fines and penalties do not specify that only controllers and processors can be the recipients of such sanctions. It might therefore be sufficient in this respect to add to Article 55 (on competence of supervisory authorities) a paragraph 4 stating that supervisory authorities “shall be competent to take sanctions in accordance with Articles 83 and 84 only in respect of any natural or legal person that is established to be a controller or processor under this Regulation”.

B. Art. 5(3): risk-based approach & proportionality?

Finally, one important consideration worth having for any GDPR reform has to do again with proportionality, this time in the form of the integration of the risk-based approach as a guiding data protection principle.

Some campaigners have rejected the idea of a “risk-based approach” as an excuse for non-compliance, but in reality “risk-based approach” is the same as proportionality. It is a way to ensure that the rules remain workable, taking into account the nature of the processing being contemplated.

Risk is already explicitly taken into account in Articles 24 (on accountability), 25(1) (data protection by design), 27(2) (EU representative), 30(5) (exception to the ROPA exemption), 32 (security), 33 & 34 (data breach notifications), 35 (DPIA), 36 (prior consultation) and 39 (DPO tasks). Proportionality is taken into account in Article 83 (fines) & 84 (penalties).

Yet risk should be taken into account throughout the GDPR. As mentioned higher, data protection authorities require more detail for privacy statements or notices, while organisations with lower risk processing activities do not consider it proportionate to include as much detail.

The same would make sense in relation to all data protection obligations, from transparency to the due diligence obligation in relation to processors (and the level of detail to be included in a data processing agreement).

Making proportionality more obviously a general principle of data protection would then not create any risk for data subjects but reinforce the need for authorities to take context into account.

Much has already been written about the importance of a risk-based approach in relation to data transfers, a topic in relation to which the absence of a codified principle regarding proportionality has led to significant legal uncertainty regarding business practices that are not brought into question outside of data protection concerns.

This is best illustrated by the way in which the EDPB drafted its “Supplementary Measures” Recommendations, in relation to the measures to be taken in addition to Standard Contractual Clauses for data transfers or binding corporate rules in order to safeguard personal data against (hypothetical or known) risks stemming from the laws of the country of destination. In a first version[10], those recommendations included an absolute view of risk regarding transfers, while after significant feedback and criticism the EDPB released a second version[11] that included a more nuanced take:

“you may decide to proceed with the transfer without being required to implement supplementary measures, if you consider that you have no reason to believe that relevant and problematic legislation will be applied, in practice, to your transferred data and/or importer”

The “no reason to believe” embodies a risk-based approach, but it was ignored in the EDPB’s first version of these recommendations.

If this approach can be promoted by supervisory authorities in relation to data transfers, why not apply it also in relation to other sections of the GDPR where it is also possible for the data subject to exercise rights and for the supervisory authority to exercise its authority?

Adding a general reference to proportionality and the adaptation of obligations to the risk presented by processing might help significantly assuage the fears of organisations whose data risk profile is more limited. It would not prevent the 2-person individualised medical data startup from having to comply with obligations, nor should that probably be the ambition. Size after all really should not matter here. But it would ensure a more workable framework – one that is tailored to the actual risk.

If there is no desire to include this in Article 5, Articles 83 and 84 remain good choices for additional detail on how to take risk into account in assessing penalties and fines. But something needs to be done to reflect risk better to make the rules more tailored.

Better regulation ultimately, then: rules that are workable without the need to sacrifice the principles guiding the GDPR.

---

This was the first part of my “rethinking the GDPR” analysis. For more from the Better Regulation series, read:

• My take on rethinking the ePrivacy Directive
• More to come.

---

[1] EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.1, 24 May 2023.

[2] Court of Justice of the European Union, 4 July 2023, Bundeskartellamt, C-252/21, EU:C:2023:537, para. 102.

[3] EDPB, Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, 17 April 2024.

[4] Ibidem, para. 76.

[5] LG Passau, Endurteil v. 09.04.2024 – 4 O 260/23, para. 62 – machine translation: “The fact that the ‘Allow all cookies’ button is coloured blue does not constitute a violation of Art. 25 (2) GDPR (data protection-friendly default setting). This is not a ‘default setting’, but a common and permitted visual emphasis that does not affect the user’s active decision-making ability.”

[6] Belgian Data Protection Authority, decision 113/2024 of 6 September 2024. That decision was overturned on appeal on other grounds.

[7] CJEU, 19 October 2016, Breyer, C-582/14, EU:C:2016:779, para. 46.

[8] CJEU, 9 November 2023, Scania, C-319/22, EU:C:2023:837, para. 49.

[9] Belgian Market Court, 14 May 2025, IAB Europe v Belgian Data Protection Board, 2022/AR/292, p. 70.

[10] EDPB, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, 10 November 2020.

[11] EDPB, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, version 2.0, 18 June 2021.