Brussels, 5 July 2018 - The European data protection authorities, assembled in the European Data Protection Board (EDPB), met on the 4th and 5th of July for the EDPB’s second plenary meeting. During this meeting, the European Data Protection Authorities addressed a wide range of topics.
Cooperation and constistency procedures – state of play
The EDPB discussed the consistency and the cooperation mechanisms, sharing experiences on the functioning of the One-Stop Shop mechanism, the performance of the Internal Market Information System (IMI), which serves as IT platform for exchanges on cross-border issues, the challenges the authorities are facing and the type of questions received since 25 May. Most data protection authorities reported a substantial increase of complaints received. The first cases were initiated in IMI on the 25th of May. Currently, around 30 cross-border complaints in IMI are under investigation. The EDPB Chair Andrea Jelinek said: “Despite the sharp increase in the number of cases in the last month, the Members of the EDPB report that the workload is manageable at the moment, in large part thanks to a thorough preparation of the WP29 in the past two years. The GDPR does not offer a quick fix in case of a complaint but we are confident the procedures detailing the way in which the authorities work together under the consistency mechanism are robust and efficient.”
ICANN
The EDPB adopted a letter addressed to the Internet Corporation for Assigned Names and Numbers (ICANN), providing guidance to enable ICANN to develop a GDPR-compliant model for access to personal data processed in the context of WHOIS.
The letter addresses the issues of purpose specification, collection of “full WHOIS data”, registration of legal persons, logging of access to non-public WHOIS data, data retention and codes of conduct and accreditation.
The EDPB’s predecessor, WP29, has been offering guidance to ICANN on how to bring WHOIS in compliance with European data protection law since 2003.
The EDPB expects ICANN to develop and implement a WHOIS model which will enable legitimate uses by relevant stakeholders, such as law enforcement, of personal data concerning registrants in compliance with the GDPR, without leading to an unlimited publication of those data.
PSD2 Directive
The EDPB adopted a letter addressed to Sophie in’t Veld MEP regarding the revised Payments Services Directive (PSD2 Directive). In its reply to Sophie in’t Veld the EDPB sheds further light on ‘silent party data’ by Third Party Providers, the procedures with regard to giving and withdrawing consent, the Regulatory Technical Standards, the cooperation between banks and the European Commission, EDPS and WP29 and what remains to be done to close any remaining data protection gaps.
Privacy Shield
The US Ombudsperson responsible for handling national security complaints under the Privacy Shield, Ambassador Judith Garber, was invited to the plenary meeting of the EDPB for an exchange with the Board Members. The EDPB was particularly interested in the concerns addressed to the US by the EDPB’s predecessor WP29, especially the appointment of a permanent Ombudsperson, formal appointments to the Privacy and Civil Liberties Oversight Board (PCLOB), and the lack of additional information on the Ombudsperson mechanism and further declassification of the procedural rules, in particular on how the Ombudsperson interacts with the intelligence services.
The EDPB pointed out that the meeting with the Ombudsperson was interesting and collegial but did not provide a conclusive answer to these concerns and that these issues will remain on top of the agenda during the Second Annual Review (scheduled for October 2018). In addition, it calls for supplementary evidence to be given by the US authorities in order to address these concerns. Finally, the EDPB notes that the same concerns will be addressed by the European Court of Justice in cases that are already pending, and to which the EDPB offers to contribute its view, if invited by the CJEU.