The European Data Protection Authorities, assembled in the European Data Protection Board (“EDPB” or “Board”), met at their third plenary meeting held on the 26th of September. At its meeting, the Board agreed on common criteria for Data Protection Impact Assessments (“DPIA”), adopted new draft guidelines on the territorial scope of the EU’s General Data Protection Regulation (“GDPR”), and discussed the impact of the EU-Japan draft adequacy decision.
Under the GDPR, businesses must conduct a DPIA when data processing is likely to result in a “high risk” to the rights and freedoms of natural persons. Exactly what “high risk” entails, however, has been a difficult question to answer. After implementation of GDPR in May 2018, the supervisory authorities of the EU Member States submitted draft lists to the Board identifying data processing activities requiring DPIAs. The EDPB issued opinions on each of these lists aiming to create a non-exhaustive, harmonized approach and promoting consistency on processing throughout the EU. The EDPB’s opinions address, in particular, large-scale processing of biometric, genetic, and location data; data collected from third parties; employee monitoring; exceptions to information to be provided to the data subject; processing for scientific or historical purposes; and processing using new/innovative technology.
The Board also adopted at its third plenary meeting new draft guidelines to help provide a common interpretation of the territorial scope of the GDPR and provide further clarification on the application of the GDPR, in particular where the data controller or processor is established outside of the EU. The draft guidelines are eagerly awaited as GDPR’s broad scope—bringing under its ambit not only companies established in the EU, but also non-EU businesses offering goods and services to individuals in the EU—impacts in particular cross-border activities and leaves many questions on specific issues in the blur. So far, the draft guidelines have not been published, but we will report on the draft guidelines as soon as they will be open for public consultation.
Finally, the EDPB discussed the EU-Japan draft adequacy decision, on which we reported in our September 17, 2018 issue, and on which the Board has been asked to provide an opinion. The Board announced its intent to take into account the wide-ranging impact of the draft adequacy decision, as well as the need to protect personal data when reviewing the EU-Japan draft adequacy decision – which makes EDPB’s review another eagerly awaited opinion.
