Context
The European Data Protection Board (EDPB) and its Secretariat process personal data in the context of their activities, which are respectively defined in Articles 70 and 75 of Regulation (EU) 2016/679 (also known as the General Data Protection Regulation, or GDPR) and in the EDPB’s Rules of Procedure.
Any processing of personal data conducted by the EDPB (including its Secretariat) is done in compliance with Regulation (EU) 2018/1725, the legal act applicable to the processing of personal data by EU institutions, bodies and offices.
We put in place measures to guarantee that your data are kept up-to-date and processed securely.
Please note: the EDPB is not a supervisory authority and it does not process any personal data unrelated to its activities and objectives (you can find more about the EDPB’s mission here). The EDPB does not have investigative, corrective or sanctioning powers. It does not have a centralised access to personal data processing operations or to any databases of private or public organisations holding personal data.
Therefore, if you have a request or a complaint regarding the processing of your personal data by any other organisation, be it public or private, unrelated to the EDPB and/or its Secretariat, please contact said organisation directly. In alternative, you can always contact the supervisory authority of your country/lander of residence (for European Economic Area residents). You can find the list and contact details of national supervisory authorities here.
Here below we provide you with some general information regarding the processing of personal data on our website. Specific information about processing activities of the EDPB (including its Secretariat) can be found through the following link. As stipulated in Article 31 of Regulation 2018/1725, the EDPB has a centralised registry of records of its processing activities involving the processing of personal data. Please note that the registry will be updated on a regular basis. The EDPB and/or its Secretariat may update any of its records and notices when required or relevant, as part of its continuous assessment of its processing operations.
How to exercise your data protection rights at the EDPB
You have specific rights when it comes to the processing of your personal data by the EDPB (including its Secretariat). These rights are outlined in Chapter III of Regulation 2018/1725 (Articles 17 to 24) (see more below). The EDPB has a designated DPO, in accordance with Article 43 of Regulation 2018/1725. The DPO’s position and tasks are defined in Articles 44 and 45 of said Regulation, and further detailed in the EDPB DPO Implementing Rules.
If the EDPB (including its Secretariat) is processing your personal data and you would like to exercise your data protection rights, please send us or our DPO a written request either in electronic form, or by post in a sealed envelope. Out contact details are available here.
In principle, we cannot accept verbal requests (telephone or face-to-face) as we may not be able to deal with your request immediately without first analysing it and reliably identifying you.
Your request should contain a detailed, accurate description of the personal data you want access to. When there are reasonable doubts regarding your identity, you might be asked to provide a copy of a document, which help us to verify your identity. It can be any document such as your ID card or passport. Should you provide any other documents, personal details such as your name and your address should be in clear in order to be able to identify you, while any other data such as a photo or any personal characteristics, may be blacked out.
Our use of the information on your identification document is strictly limited: the data will only be used to verify your identity and will not be stored for longer than needed for this purpose. You can learn more about how we process your personal data in this context by reading the specific data protection notice.
Relationship with the European Data Protection Supervisor (EDPS)
The EDPB, as all other EU institutions, bodies and offices subject to Regulation 2018/1725, is subject to the supervision of the European Data Protection Supervisor (EDPS), whose role, tasks and powers are defined in Chapter VI of Regulation 2018/1725. If you have any complaints concerning the processing of your personal data by the EDPB and/or its Secretariat, you can contact the EDPS via their webpage. You can also find more information about the EDPS at edps.europa.eu.
Please note: while the EDPS and the EDPB work very closely together (the EDPS is a member of the Board and ensures the staffing of the Secretariat of the EDPB), they are two different bodies, each with its own legal personality and with different mandates, tasks and roles. You can find more information about the EDPB - EDPS relations in the EDPB-EDPS Memorandum of Understanding.
Your personal data and our website
The EDPB website is our most important communication tool. Here, we communicate our work such as our guidelines, recommendations, best practices, advices, opinions and decisions. In addition, we communicate data protection news and information about data protection topics to the general public, as well as to our more expert audiences.
Some of the information and services offered on our website require the processing of your personal data.
We do not reuse the information for other purposes unless specifically indicated in a privacy notice for a specific processing operation.
We will never process your personal data for direct marketing purposes.
Under certain conditions outlined in law, we may disclose your information to third parties, (such as the European Anti-Fraud Office, the Court of Auditors, or law enforcement authorities) if it is necessary and proportionate for lawful, specific purposes.
As a rule, we do not keep your personal information for longer than necessary for the purposes for which we collected it. We may keep your personal data for a longer period for historical or scientific purposes with the appropriate safeguards in place.
You can check our specific privacy notices to learn how we may process your personal data, including when it is collected through our website.
Social Media
The EDPB uses social media to present its work through widely used channels. The ideas and views expressed by the EDPB on social media are for information purposes only. No communication through social media shall be deemed to constitute legal or official notice on behalf of the Board.