European Data Protection Board - Fifth Plenary session: EU-Japan draft adequacy decision, DPIA lists and guidelines on accreditation
On December 4th and 5th, the European Data Protection Authorities, assembled in the European Data Protection Board, met for their fifth plenary session. During the plenary a wide range of topics were discussed.
The Board Members adopted an opinion on the EU-Japan draft adequacy decision, which the Board received from the European Commission in September 2018. The EDPB made its assessment on the basis of the documentation made available by the European Commission. The EDPB’s key objective was to assess whether the Commission has ensured sufficient guarantees are in place for an adequate level of data protection for individuals in the Japanese framework.
It is important to recognise that the EDPB does not expect the Japanese legal framework to replicate European data protection law. The EDPB welcomes the efforts made by the European Commission and the Japanese PPC to increase convergence between the Japanese legal framework and the European one. The improvements brought in by the Supplementary Rules to bridge some of the differences between the two frameworks are very important and well received.
However, following a careful analysis of the Commission’s draft adequacy decision as well as of the Japanese data protection framework, the EDPB notices that a number of concerns remain, such as the protection of personal data, transferred from the EU to Japan, throughout their whole life cycle. The EDPB recommends the European Commission to also address the requests for clarification made by the EDPB, to provide further evidence and explanations regarding the issues raised and to closely monitor the effective application. The EDPB considers that the EU-Japan adequacy decision is of paramount importance. As the first adequacy decision since the entering into application of the General Data Protection Regulation (GDPR), it will set a precedent.
DPIA lists
The EDPB adopted opinions on the Data Protection Impact Assessment (DPIA) lists, submitted to the Board by Denmark, Croatia, Luxembourg and Slovenia. These lists form an important tool for the consistent application of the GDPR across the EEA.
DPIA is a process to help identify and mitigate data protection risks that could affect the rights and freedoms of individuals. While in general the data controller needs to assess if a DPIA is required before engaging in the processing activity, national supervisory authorities shall establish and make a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment.
These four opinions follow the 22 opinions adopted during the September plenary, and will further contribute to establishing common criteria for DPIA lists across the EEA. The EDPB Chair, Andrea Jelinek said: “This process has been an excellent opportunity for the EDPB to test the possibilities and challenges of consistency in practice. The GDPR does not require full harmonisation or an 'EU list', but requires more consistency, which we have achieved in all of these opinions by agreeing on a common view.”
Guidelines on accreditation
The EDPB has adopted a revised version of the WP29 guidelines on accreditation, including a new annex. The aim of the guidelines is to provide guidance on how to interpret and implement the provisions of Article 43 of the GDPR. In particular, they aim to help Member States, supervisory authorities and national accreditation bodies establish a consistent and harmonised baseline for the accreditation of certification bodies that issue certification in accordance with the GDPR. The guidelines have now been completed by an annex providing guidance on the additional requirements for the accreditation of certification bodies to be established by the supervisory authorities. This annex will be subject to public consultation.
More information:
Data Protection Ombudsman Reijo Aarnio, tel. +358 40 520 7068, reijo.aarnio(at)om.fi