European Data Protection Board

EDPB News

2018

Generic press release icon
05 December 2018

Brussels, 5 December - On December 4th and 5th, the European Data Protection Authorities, assembled in the European Data Protection Board, met for their fifth plenary session. During the plenary a wide range of topics were discussed.
 
EU-Japan draft adequacy decision
The Board Members adopted an opinion on the EU-Japan draft adequacy decision, which the Board received from the European Commission in September 2018. The EDPB made its assessment on the basis of the documentation made available by the European Commission. The EDPB’s key objective was to assess whether the Commission has ensured sufficient guarantees are in place for an adequate level of data protection for individuals in the Japanese framework. It is important to recognise that the EDPB does not expect the Japanese legal framework to replicate European data protection law. The EDPB welcomes the efforts made by the European Commission and the Japanese PPC to increase convergence between the Japanese legal framework and the European one. The improvements brought in by the Supplementary Rules to bridge some of the differences between the two frameworks are very important and well received. However, following a careful analysis of the Commission’s draft adequacy decision as well as of the Japanese data protection framework, the EDPB notices that a number of concerns remain, such as the protection of personal data, transferred from the EU to Japan, throughout their whole life cycle. The EDPB recommends the European Commission to also address the requests for clarification made by the EDPB, to provide further evidence and explanations regarding the issues raised and to closely monitor the effective application.

The EDPB considers that the EU-Japan adequacy decision is of paramount importance. As the first adequacy decision since the entering into application of the General Data Protection Regulation (GDPR), it will set a precedent.

DPIA lists
The EDPB adopted opinions on the Data Protection Impact Assessment (DPIA) lists, submitted to the Board by Denmark, Croatia, Luxembourg and Slovenia. These lists form an important tool for the consistent application of the GDPR across the EEA. DPIA is a process to help identify and mitigate data protection risks that could affect the rights and freedoms of individuals. While in general the data controller needs to assess if a DPIA is required before engaging in the processing activity, national supervisory authorities shall establish and make a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment. These four opinions follow the 22 opinions adopted during the September plenary, and will further contribute to establishing common criteria for DPIA lists across the EEA. The EDPB Chair, Andrea Jelinek said: “This process has been an excellent opportunity for the EDPB to test the possibilities and challenges of consistency in practice. The GDPR does not require full harmonisation or an 'EU list', but requires more consistency, which we have achieved in all of these opinions by agreeing on a common view.”

Guidelines on accreditation
The EDPB has adopted a revised version of the WP29 guidelines on accreditation, including a new annex. The draft guidelines were originally adopted by the WP29 and submitted for public consultation. The EDPB finalised the analysis and reached a conclusion on the final version. The aim of the guidelines is to provide guidance on how to interpret and implement the provisions of Article 43 of the GDPR. In particular, they aim to help Member States, supervisory authorities and national accreditation bodies establish a consistent and harmonised baseline for the accreditation of certification bodies that issue certification in accordance with the GDPR. The guidelines have now been completed by an annex providing guidance on the additional requirements for the accreditation of certification bodies to be established by the supervisory authorities. This annex will be subject to public consultation.

04 December 2018

On December 4 and 5, the European Data Protection Board's fifth plenary is taking place in Brussels. For further information, please consult the agenda.

Agenda of Fifth Plenary

Generic press release image
19 November 2018

Briselē, 19. novembrī.
Eiropas Datu aizsardzības iestādes 16. novembrī tikās ceturtajā plenārsēdē Eiropas Datu aizsardzības kolēģijā (EDPB). Plenārsēdē tika apspriests plašs tematu klāsts.
 
ES un Japānas lēmuma projekts par aizsardzības līmeņa pietiekamību  
Tika diskutēts par situāciju EDPB darbā pie ES un Japānas lēmuma projekta par aizsardzības līmeņa pietiekamību, ko EDPB saņēma no komisāres Veras Jourovas 2018. gada septembrī. Kolēģija atkārtoti uzsvēra datu sūtīšanas no ES aizsardzības nozīmi nepārtrauktības un augstā līmeņa garantēšanā.

EDPB sniegs norādes par klīnisko pārbaužu mijiedarbību ar Vispārīgo datu aizsardzības regulu (VDAR) un Regulu par klīniskajām pārbaudēm (jautājumi un atbildes)
Pēc apspriešanās ar Eiropas Komisiju, Kolēģija vienojās par pilnvaru piešķiršanu norāžu sniegšanai attiecībā uz Komisijas izstrādātajiem jautājumiem un atbildēm par mijiedarbību starp VDAR un Regulu par klīniskajām pārbaudēm.
 
Vadlīnijas par teritoriālo darbības jomu
Septembra plenārsēdē Eiropas Datu aizsardzības kolēģija pieņēma jaunu vadlīniju projektu, kas palīdzēs nodrošināt Vispārīgās datu aizsardzības regulas teritoriālās darbības jomas vienotu interpretāciju un sniegt sīkākus skaidrojumus par regulas piemērošanu dažādās situācijās, jo īpaši gadījumos, kad datu pārzinis vai datu apstrādātājs veic uzņēmējdarbību ārpus ES, kā arī par pārstāvja iecelšanu. Tā kā standarta noslēguma juridiskās pārbaudes pirms publicēšanas atklāja, ka daži jautājumi ir jāapspriež sīkāk, EDPB nolēma pamatnostādnes apspriest atkārtoti novembra plenārsēdē. Šie jautājumi tagad ir atrisināti pilnībā, un vadlīnijās drīz tiks publicētas publiskai apspriešanai.

16 November 2018

On November 16, the European Data Protection Board's fourth plenary is taking place in Brussels. For further information, please consult the agenda.

Agenda of fourth plenary

26 September 2018

Preses relīze

Eiropas Datu aizsardzības kolēģija - Trešā plenārsēde: ES-Japānas lēmuma projekts par aizsardzības līmeņa pietiekamību, novērtējuma par ietekmi uz datu aizsardzību saraksti, teritoriālā darbības joma un elektroniski pierādījumi
Briselē, 26. septembrī. Eiropas Datu aizsardzības iestādes 25. un 26. septembrī sanāca kopā Eiropas Datu aizsardzības kolēģijā uz trešo plenārsēdi. Plenārsēdē tika apspriests plašs tematu klāsts.

ES-Japānas lēmums par aizsardzības līmeņa pietiekamību  
Kolēģijas locekļi apsprieda ES-Japānas lēmuma projektu par aizsardzības līmeņa pietiekamību, kuru kolēģijai iesniedza komisāre Vera Jurova (Věra Jourová) un par ko lūgts sniegt atzinumu. Kolēģija tagad rūpīgi izskatīs lēmuma projektu. Kolēģija ir apņēmusies ņemt vērā lēmuma projekta par aizsardzības līmeņa pietiekamību plašo ietekmi, kā arī nepieciešamību aizsargāt personas datus ES.

Novērtējuma par ietekmi uz datu aizsardzību saraksti
Eiropas Datu aizsardzības kolēģija panāca vienošanos un pieņēma 22 atzinumus, kuros iestrādāti kopīgi kritēriji novērtējuma par ietekmi uz datu aizsardzību sarakstiem. Šie saraksti ir svarīgs rīks, ar ko nodrošina Vispārīgās datu aizsardzības regulas (VDAR) konsekventu piemērošanu ES. Novērtējums par ietekmi uz datu aizsardzību ir process, kura mērķis ir palīdzēt identificēt un mazināt datu aizsardzības riskus, kas varētu ietekmēt indivīdu tiesības un brīvības. Lai palīdzētu precizēt, kādai datu apstrādei varētu būt vajadzīgs novērtējums par ietekmi uz datu aizsardzību, VDAR paredz, ka valstu uzraudzības iestādes izveido un publicē sarakstus ar tiem apstrādes darbību veidiem, kuri var radīt augstu risku. Kolēģija saņēma 22 valstu sarakstus ar kopā 260 dažādiem apstrādes veidiem. Eiropas Datu aizsardzības kolēģijas priekšsēdētāja Andrea Jelineka teica, ka: “Eiropas Datu aizsardzības kolēģijas locekļi un sekretariāts paveica milzīgu darbu, pārbaudot visus šos sarakstus un nosakot kopīgus kritērijus par to, kam ir vai nav nepieciešams novērtējums par ietekmi uz datu aizsardzību. Eiropas Datu aizsardzības kolēģijai šī bija lieliska iespēja praksē pārbaudīt, ciktāl ir vai nav iespējama konsekvence. VDAR neparedz prasību par pilnīgu saskaņošanu vai “ES sarakstu”, taču tā paredz prasību par lielāku konsekvenci, ko esam panākuši šajos 22 atzinumos, vienojoties par kopīgu viedokli.”
22 atzinumi par novērtējuma par ietekmi uz datu aizsardzību sarakstiem ir sniegti atbilstoši VDAR 35. panta 4. un 6. punkta prasībām un ir atbilstoši vadlīnijām, ko izstrādājusi 29.panta darba grupa.

Pamatnostādnes par teritoriālo darbības jomu
Eiropas Datu aizsardzības kolēģija pieņēma jaunu vadlīniju projektu, kas palīdzēs nodrošināt VDAR teritoriālās darbības jomas vienotu interpretāciju un sniegt skaidrojumus par regulas piemērošanu dažādās situācijās, jo īpaši gadījumos, kad datu pārzinis vai datu apstrādātājs veic uzņēmējdarbību ārpus ES, ieskaitot pārstāvja apzīmējumu. Vadlīnijas tiks nodotas sabiedriskajai apspriešanai.

Elektroniski pierādījumi
Eiropas Datu aizsardzības kolēģija pieņēma atzinumu par jauno regulu par elektroniskiem pierādījumiem, ko Eiropas Komisija ierosināja 2018. gada aprīlī. Kolēģija uzsvēra, ka ierosinātajiem jaunajiem noteikumiem, kas paredz elektronisku pierādījumu vākšanu, būtu pietiekami jāaizsargā indivīdu datu aizsardzības tiesības, un tiem vajadzētu būt atbilstošiem ES tiesību aktiem datu aizsardzības jomā.

Plenary generic picture
25 September 2018

On September 25 and 26, the European Data Protection Board's third plenary is taking place in Brussels. For further information, please consult the agenda.

Agenda of Third Plenary

23 August 2018

The General Data Protection Regulation five months on

Initiatives in the EU and international perspectives

25 October 2018

Rue de la Loi 170

2:30 pm

Side event by EDPS and EDPB

Registration closed

Welcome from Giovanni Buttarelli, European Data Protection Supervisor

Introduction by Andrea Jelinek, Chair European Data Protection Board

Part 1    Initiatives in the EU - a new quality of cooperation

  • Helen Dixon, Irish Data Protection Commissioner

  • Cristina Angela Gulisano, Director Danish Data Protection Agency

  • Isabelle Vereecken, Head of the EDPB Secretariat

  • Questions by moderator to 3 panelists

At 3:15 PM:

  • Keynote: Catherine De Bolle, Executive Director of Europol, The broader framework for EU data protection: a law enforcement perspective – TBC

  • Comments by the audience and questions to EDPB Members

    BREAK

    At 4:00 PM:

  • Keynote: Koen Lenaerts, President European Court of Justice - Accountability in a digitalized world: the Court’s role in enhancing data protection in the European Union

Part 2   International perspectives and cross-border cooperation

  • Bruno Gencarelli, Head of the International Data Flows and Protection Unit, European Commission

  • Professor Masao Horibe, Chairman Personal Information Protection Commission Japan 

  • Professor Danilo Doneda Instituto Brasiliense de Direito Público 

  • Felipe Harboe, Senator of the Republic of Chile

  • Ludmila Georgieva, Co-Chair HWP Cyber Issues, Co-Chair DAPIX (Data Protection), Perm Rep Austria

  • Joan Antokol, Managing partner, Park Legal LLC
  • Florence Raynal, Deputy Director, Head of the Department of European and International Affairs, CNIL
  • Questions by the moderator to the 5 panelists

  • Comments by the audience and questions to the panel

  • Wrap-up

     

Generic image
20 July 2018

Brussels, 19 July – An important innovation of the General Data Protection Regulation (GDPR) is the new way in which the supervisory authorities of the Member States closely cooperate to ensure a consistent application as well as a consistent protection of individuals throughout the EU.

During its second plenary meeting on 4 and 5 July the EDPB discussed the consistency and the cooperation systems, sharing first experiences on the functioning of the One-Stop Shop mechanism, the performance of the Internal Market Information System (IMI), the challenges the authorities are facing and the type of questions received since 25 May. Most data protection authorities reported a substantial increase in complaints received. The first cross-border cases were initiated in IMI on 25 May. Currently, around 100 cross-border cases in IMI are under investigation.

The EDPB Chair Andrea Jelinek said: “Despite the sharp increase in the number of cases in the last month, the Members of the EDPB report that the workload is manageable for the moment, in large part thanks to a thorough preparation in the past two years by the Article 29 Data Protection Working Party. However, we should only expect the first results of the new procedures to deal with cross-border cases in a few months from now. To handle complaints lead supervisory authorities will have to carry out investigations, observe procedural rules, and coordinate and share information with other supervisory authorities. The GDPR sets specific deadlines for each phase of the procedure. All of this takes time. During this time, complainants are entitled to be kept informed on the state of play of a case. The GDPR does not offer a quick fix in case of a complaint but we are confident the procedures detailing the way in which the authorities work together are robust and efficient.”

Generic press release pictures
05 July 2018

Briselē, 2018.gada 5.jūlijā. Eiropas Datu aizsardzības kolēģijā (EDAK) sapulcējušās Eiropas datu aizsardzības iestādes 4. un 5.jūlijā tikās EDAK otrajā plenārsēdē. Šajā sanāksmē Eiropas datu aizsardzības iestādes izskatīja plašu tematu klāstu.
 
Sadarbība un konsekvences nodrošināšanas procedūras – pašreizējais stāvoklis
EDAK apsprieda konsekvences nodrošināšanas un sadarbības mehānismus, apmainoties ar pieredzi par vienas pieturas aģentūras mehānisma darbību un Iekšējā tirgus informācijas sistēmas (IT platforma informācijas apmaiņai par pārrobežu jautājumiem; IMI) veikumu, par problēmām, ar ko saskaras iestādes, kā arī par jautājumu veidiem, kas saņemti no 25.maija. Vairums datu aizsardzības iestāžu ziņoja par saņemto sūdzību būtisku pieaugumu. IMI sistēmā pirmās lietas tika uzsāktas 25.maijā un pašlaik IMI ietvaros tiek izmeklētas aptuveni 30 pārrobežu sūdzības. EDAK priekšsēdētāja Andrea Jelinek informēja, ka: „Neskatoties uz lieto skaita straujo pieaugumu pagājušajā mēnesī, EDAK dalībnieki ziņo, ka pašreizējais darba apjoms ir padarāms, pateicoties rūpīgajam gatavošanās darbam, ko pēdējos divos gados bija veikusi 29.panta darba grupa (WP29). Vispārīgā datu aizsardzības regula (VDAR) nepiedāvā ātru risinājumu sūdzības gadījumā, taču esam pārliecināti, ka procedūras, kurās sīki izklāstīts veids, kādā iestādes sadarbojas konsekvences nodrošināšanas mehānisma ietvaros, ir stabilas un efektīvas.”
 
ICANN
EDAK priekšsēdētājas vārdā tika sagatavota vēstule, kas ir adresēta Interneta korporācijai, ar piešķirto nosaukumu un numuru (ICANN), ar ko tiek sniegti norādījumi, kas ļautu ICANN izstrādāt GDPR atbilstīgu modeli piekļuvei personas datiem, ko apstrādā WHOIS interneta protokola kontekstā.
Vēstulē izskatīti jautājumi saistībā ar nolūka specifikāciju, „pilnu WHOIS datu” vākšanu, juridisko personu reģistrāciju, reģistra ierakstiem par piekļuvi nepubliskiem WHOIS datiem, datu glabāšanu, rīcības kodeksiem un akreditāciju.
EDAK priekštece – 29. panta darba grupa – kopš 2003.gada jau ir sniegusi norādes ICANN par to, kā panākt WHOIS protokola atbilstību Eiropas datu aizsardzības tiesībām.
EDAK sagaida, ka ICANN izstrādās un īstenos WHOIS modeli, kas ieinteresētajām personām nodrošinās likumīgu lietojumu, piemēram, reģistrētāju personas datu tiesībaizsardzību saskaņā ar VDAR, izvairoties no minēto datu neierobežotas publiskošanas.
 
Otrā maksājumu pakalpojumu direktīva (PSD2)
EDAK priekšsēdētājas vārdā EDAK sagatavoja Eiropas Parlamenta deputātei Sophie in’t Veld adresētu vēstuli par pārskatīto maksājumu pakalpojumu direktīvu (PSD2). EDAK Sophie in’t Veld adresētajā atbildē sniegta informācija par „klusējošās puses datiem”, kurus vāc pakalpojumu sniedzēji, kas ir trešās personas, par procedūrām saistībā ar piekrišanas sniegšanu un atsaukšanu, par regulatīvajiem tehniskajiem standartiem, par sadarbību starp bankām un Eiropas Komisiju, Eiropas Datu aizsardzības uzraudzītāju (EDAU) un 29. panta darba grupu, kā arī par to, kas vēl darāms, lai novērstu visus atlikušos datu aizsardzības trūkumus.
 
Privātuma vairogs
Lai mainītos ar viedokļiem kolēģijas locekļu starpā, uz EDAK plenārsēdi bija uzaicināta vēstniece Džūdita Gārbere (Judith Garber) – ASV ombuds, kas atbild par valsts drošību skarošu sūdzību izskatīšanu privātuma vairoga ietvaros. Eiropas Datu aizsardzības kolēģiju īpaši interesēja bažas raisošie jautājumi, kurus EDAK priekštece – 29. panta darba grupa – bija adresējusi ASV, it īpaši pastāvīga ombuda iecelšana, Privātuma un pilsonisko brīvību pārraudzības padomes (PCLOB) locekļu oficiāla iecelšana, kā arī papildu informācijas trūkums par ombuda mehānismu un turpmāka procedūras noteikumu deklasifikācija, jo īpaši attiecībā uz to, kā ombuds sadarbojas ar izlūkošanas dienestiem.
 
EDAK uzsvēra, ka tikšanās ar ombudu bijusi interesanta un koleģiāla, taču tās laikā netika sniegta skaidra atbilde uz šiem jautājumiem, un šie temati paliks dienas kārtības augšgalā arī otrajā ikgadējā pārskatīšanā (kas paredzēta 2018. gada oktobrī). Turklāt EDAK aicināja ASV iestādes sniegt papildu pierādījumus, lai risinātu šos jautājumus. Visbeidzot, EDAK norāda, ka Eiropas Savienības Tiesa izskatīs šos pašus jautājumus lietās, kuras jau atrodas tiesvedībā un attiecībā uz kurām EDAK piedāvā izteikt savu viedokli, ja Tiesa izteiks šādu aicinājumu.

Generic image for fintech
05 July 2018

The EDPB adopted a letter on behalf of the EDPB Chair addressed to Sophie in’t Veld MEP regarding the revised Payments Services Directive (PSD2 Directive). In its reply to Sophie in’t Veld the EDPB sheds further light on ‘silent party data’ by Third Party Providers, the procedures with regard to giving and withdrawing consent, the Regulatory Technical Standards, the cooperation between banks and the European Commission, EDPS and WP29 and what remains to be done to close any remaining data protection gaps.

ICANN generic letter image
05 July 2018

The EDPB adopted a letter on behalf of the EDPB Chair addressed to the Internet Corporation for Assigned Names and Numbers (ICANN), providing guidance to enable ICANN to develop a GDPR-compliant model for access to personal data processed in the context of WHOIS.

The letter addresses the issues of purpose specification, collection of “full WHOIS data”, registration of legal persons, logging of access to non-public WHOIS data, data retention and codes of conduct and accreditation.

The EDPB’s predecessor, WP29, has been offering guidance to ICANN on how to bring WHOIS in compliance with European data protection law since 2003.

The EDPB expects ICANN to develop and implement a WHOIS model which will enable legitimate uses by relevant stakeholders, such as law enforcement, of personal data concerning registrants in compliance with the GDPR, without leading to an unlimited publication of those data.

Generic image of plenary
04 July 2018

On 4 and 5 July the second plenary of the European Data Protection Board is taking place in Brussels. Please consult the agenda for more information.

Generic IMI Picture
27 June 2018

It has been just a month ago that the General Data Protection Regulation (GDPR) entered into application, the long awaited revamp of the EU’s data protection rules. Under the GDPR, the supervisory authorities of the Member States closely cooperate to ensure a consistent application of the GDPR throughout the European Union, as well as consistent protection of individuals. They assist each other and coordinate decision-making in these cross-border data protection cases. Via the so-called consistency mechanism the European Data Protection Board issues opinions and takes binding decisions to arbitrate different positions on cross border cases between national data protection authorities.

IMI (Internal Market Information System) was chosen as the IT platform to support cooperation and consistency procedures under the GDPR. IMI helps public authorities across the EU to cooperate and exchange information. The GDPR is the 13th legal area supported by the system.

IMI has been developed by the European Commission’s DG GROW and was adapted to cater for the needs of the GDPR, in close cooperation with the Secretariat of the European Data Protection Board and the national supervisory authorities.

On 25 May, the first case was initiated in IMI, and shortly afterwards the supervisory authorities started to cooperate via the system. Currently, more than 30 cross-border cases are under investigation.

14 IMI modules, 19 forms and more than 10.000 data fields were put in place to address the needs of data protection authorities and the GDPR procedures. 

Generic picture derogation guidelines
30 May 2018

During its first plenary meeting, the EDPB adopted the final version of the Guidelines on derogations applicable to international transfers (art 49). The Article 29 Working Party conducted a public consultation on a draft of these guidelines. The EDPB took into consideration the replies received and integrated the appropriate changes into the adopted version. 

Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679

Generic picture certification guidelines
30 May 2018

During its first plenary meeting, the EDPB adopted a draft version of the Guidelines on certification. A public consultation is available for 6 weeks. If you are interested to contribute, please go to the “Public Consultations” section of our website or click the link bellow:

Public consultation: Guidelines 1/2018 on certification and identifying certification criteria in accordance with Articles 42 and 43 of the Regulation 2016/679

Generic picture
28 May 2018

During its first plenary meeting of 25 May, the EDPB adopted a statement on the revision of the ePrivacy Regulation and its impact on the protection of individuals with regard to the privacy and confidentiality of their communications.

This statement includes a call for a swift adoption of the new ePrivacy Regulation and some suggestions on some specific issues relating to proposed amendments by the co-legislators.

EDPB Statement on ePrivacy

Generic picture Icann
27 May 2018

The European Data Protection Board endorsed the statement of the WP29 on ICANN/WHOIS during its first plenary meeting on 25 May.

 

WP29 statement regarding WHOIS

 

“WP29 recognizes the important functions fulfilled by the WHOIS service. 
 
WP29 has been offering guidance to ICANN on how to bring WHOIS in compliance with European data protection law since 2003 (see WP29 opinion of 2003 available here). ICANN’s GDPR compliance process appears to have been formally initiated in the course of 2017, which may be part of the reason why stakeholders are concerned over the entry into application of the GDPR on 25 May 2018.
 
The GDPR does not allow national supervisory authorities nor the European Data Protection Board (the WP29 will become the EDPB on 25 May 2018) to create an “enforcement moratorium” for individual data controllers. Data protection is a fundamental right of individuals, who may submit complaints to their national data protection authority whenever they consider that their rights under the GDPR have been violated. 
 
Data protection authorities may, however, take into consideration the measures which have already been taken or which are underway when determining the appropriate regulatory response upon receiving such complaints.


As expressed also in earlier correspondence with ICANN (including this letter of December 2017 and this letter of April 2018),  WP29 expects ICANN to develop and implement a WHOIS model which will enable legitimate uses by relevant stakeholders, such as law enforcement, of personal data concerning registrants in compliance with the GDPR, without leading to an unlimited publication of those data.

 

The WP29 recognizes the recent efforts undertaken by ICANN to ensure the compliance of the WHOIS system. The WP29 will continue to monitor ICANN’s progress closely and its members may engage further with ICANN to ensure that the legal requirements under EU data protection law are properly addressed.

Generic picture Plenary
25 May 2018

On 25 May 2018, the greatly anticipated General Data Protection Regulation (GDPR) entered into application and its pre-decessor Directive 95/46/EC was repealed. On that date, the Article 29 Working Party, the body bringing together the independent data protection authorities, ceased to exist and was replaced by a new body: the European Data Protection Board or EDPB.

The Board is composed of the heads of national supervisory authorities and the European Data Protection Supervisor (EDPS). The Board also includes a representative of the European Commission who, however, does not have a right to vote.

The Board’s primary role is to safeguard the consistent application of the GDPR, but it has additional competences. It advises the European Commission on, for example, the level of data protection offered by third countries. In addition, the Board promotes cooperation between the national supervisory authorities and plays a role in conciliation procedures for disputes between national supervisory authorities. In exercising its powers, the Board issues guidelines, recommendations and statements of best practice on myriad topics.

During its first plenary meeting on 25 May the Board elected its Chair and two Vice-Chairs. The EDPB Chair will lead the Board for the coming five years and will exert an important influence on data protection in Europe and beyond. The Chair’s role will be crucial for the success and effectiveness of the GDPR.

Generic picture Press release
25 May 2018

Transparency and awareness are two core principles of the Board. Therefore, following the first plenary meeting of the Board, the newly elected EDPB Chair will hold a press conference on 25 May at 12.30 in the Brussels Press Club (Rue Froissart 95, Brussels). The press conference will be broadcast in EbS: http://ec.europa.eu/avservices/ebs/live.cfm?page=2 

Generic picture Secretariat
25 May 2018

The European Data Protection Board needs to rely on an effective Secretariat to be able to effectively accomplish all the tasks it is required to carry out under the GDPR. The EDPB Secretariat is composed of legal experts, communication and IT officers and administrative staff.

This brand-new team has worked hard to make the launch of the EDPB possible.  They will, without a doubt, have busy months ahead to organise the meetings of the Board and answer questions on the Board’s tasks and responsibilities.   

 

Generic picture Press release
25 May 2018

Brussels, 25 May - Today the European Data Protection Board (EDPB) held its first plenary meeting. This new, independent EU decision-making-body with legal personality is created by the General Data Protection Regulation (GDPR), which enters into application as of today. The EDPB, which succeeds the Article 29 Working Party, brings together the EDPS (European Data Protection Supervisor) and the Member State supervisory authorities to ensure a consistent application of the GDPR throughout the European Union, as well as consistent protection of individuals.  In addition, the EDPB oversees the implementation of the Data Protection Law Enforcement Directive.

Andrea Jelinek, Chair of the EDPB: “This much awaited legislation gives individuals greater control over their personal data and provides a single set of rules applicable to everyone processing the personal data of individuals in the EU. In a world where data is treated as a currency, the rights of individuals were often overlooked or even flouted. We should not lose sight of the fact that personal data are inherent to human beings. I am convinced that the GDPR gives individuals and supervisory authorities the means to effectively protect and enforce this fundamental right.

“The new data protection requirements have often been narrowed down to focus on the risk of incurring high fines, but the GDPR is much more than that. It is about putting the rights of individuals first and upgrading the EU data protection rules so that they are efficient and ready for the future. At the same time, companies doing business in Europe will benefit from the GDPR as it provides legal certainty and makes it easier to operate across the internal market. In addition, being compliant with the GDPR will contribute to the good reputation of companies. In our data-driven economy a reputation can be destroyed within a few days if people loose trust in whether a company handles their data carefully.”

Andrea Jelinek concluded by underlining the importance of cooperation to make the GDPR a success: “It is crucial that as the EDPB we unite our forces to ensure a high and consistent level of data protection for individuals, wherever in the EU they are based. We will also promote awareness of data protection rights to the public. The EDPB is a newly created body of the EU that is equipped with a new governance and coordination model and the power to adopt binding decisions. This will allow us to play our role efficiently in giving guidance on key concepts of the GDPR.”

The GDPR is a new European law that tightens control over how people and organisations use and share individuals’ personal data. It also applies to organisations outside Europe targeting EU individuals or monitoring their behaviour. The GDPR replaces the EU Data Protection Directive which dates back to 1995, when the internet was still in its early stages. It replaces a patchwork of national laws with a single EU Regulation designed to make organisations more accountable, give individuals more control over their data and aims to improve legal certainty for businesses, so as to boost innovation and the future development of the digital single market.

Generic picture MoU
25 May 2018

EDAK pirmās plenārsēdes laikā parakstīja Saprašanās memorandu starp Eiropas Datu aizsardzības kolēģiju (EDAK) un Eiropas Datu aizsardzības uzraudzītāju (EDAU). Saprašanās memorandā ir noteikts, kā notiks EDAK un EDAU sadarbība.

Saprašanās memorands

generic picture guidelines
25 May 2018

During its first plenary meeting the European Data Protection Board endorsed the GDPR related WP29 Guidelines(Corrigendum: In document nr 8 reference to the WP 259 has been replaced by the correct WP 244).

Generic picture Cocktail
24 May 2018

A new regulation and a new EU Body need to be celebrated! To do so, a cocktail reception took place on the 24th of May. Within the beautiful venue of the Bibliotheque Solvay in Brussels, Commissioner Vera Jourova, Jan Philipp Albrecht MEP, European Data Protection Supervisor Giovanni Buttarelli and WP29 Chair Andrea Jelinek held speeches looking back at the coming into application of the GDPR and the challenges ahead. Many of those who played an active role in the negotiations of the GDPR were present and proud to see the achievement of such a long process.