European Data Protection Board - Seventh Plenary session: EDPB 2019/2020 Work program, opinion on the draft AA in the field of financial markets supervision, Brexit
On February 12th, the EEA Data Protection Authorities and the European Data Protection Supervisor, assembled in the European Data Protection Board, met for their seventh plenary session. During the plenary a wide range of topics were discussed.
EDPB 2019/2020 Work program
The Board adopted its two-year work program for 2019-2020, according to Article 29 of the EDPB Rules of Procedure. The EDPB work program is based on the needs identified by the members as priority for individuals, stakeholders, as well as the EU legislator- planned activities.
Draft administrative arrangement in the field of financial markets supervision
The EDPB adopted its first opinion on an administrative arrangement (AA), based on article 46.3.b of the GDPR, for transfers of personal data between EEA financial supervisory authorities, including the European Securities and Markets Authority (ESMA) and their non-EU counterparts. This arrangement will be submitted to the competent supervisory authorities (SAs) for authorisation at national level. The competent supervisory authorities will monitor the AA and its practical application to ensure that there are in practice effective and enforceable data subject rights and appropriate means of redress and supervision.
Brexit
The EDPB adopted an information note addressed to commercial entities and public authorities on data transfers under the GDPR in the event of a no-deal Brexit.
Data flows from the EEA to UK
In the absence of an agreement between the EU and the UK (no-deal Brexit), the UK will become a third country from 00.00 am CET on 30 March 2019. As a consequence, the transfer of personal data from the EEA to the UK will have to be based on one of the following instruments: Standard or ad hoc Data Protection Clauses, Binding Corporate Rules, Codes of Conduct and Certification Mechanisms and the specific transfer instruments available to public authorities. In the absence of Standard Data Protection Clauses or other alternative appropriate safeguards, derogations can be used under certain conditions.
Data flows from UK to the EEA
As regards data transfers from the UK to the EEA, according to the UK Government, the current practice, which permits personal data to flow freely from the UK to the EEA, will continue in the event of a no-deal Brexit.
Guidelines on codes of conduct
The EDPB adopted guidelines on codes of conduct. The aim of these guidelines is to provide practical guidance and interpretative assistance in relation to the application of Articles 40 and 41 GDPR. The guidelines intend to help clarify the procedures and the rules involved in the submission, approval and publication of codes of conduct at both the national and the European level. These guidelines should further act as a clear framework for all competent supervisory authorities, the Board and the Commission to evaluate codes of conduct in a consistent manner and to streamline the procedures involved in the assessment process. The guidelines will be subject to public consultation.
More information:
Data Protection Ombudsman Reijo Aarnio, tel. +358 40 520 7068, reijo.aarnio(at)om.fi
Draft administrative arrangement in the field of financial markets supervision (pdf)
Information Note on data transfers under the GDPR in the event of a no-deal Brexit (pdf)