Brussels, 03 December - During its latest plenary, the European Data Protection Board (EDPB) published guidelines on Art.48 GDPR about data transfers to third country authorities and  approved a new European Data Protection Seal.

EDPB helps organisations assess data transfer requests by third country authorities

In a highly interconnected world, organisations receive requests from public authorities in other countries to share personal data. The sharing of data can, for instance, be of help to collect evidence in the case of crime, to check financial transactions or approve new medications.

When a European organisation receives a request for a transfer of data from a ‘third country’ (i.e. non-European countries) authority, it must comply with the General Data Protection Regulation (GDPR). In its guidelines, the EDPB zooms in on Art. 48 GDPR and clarifies how organisations can best assess under which conditions they can lawfully respond to such requests. In this way, the guidelines help organisations to make a decision on whether they can lawfully transfer personal data to third country authorities when asked to do so.

Judgements or decisions from third countries authorities cannot automatically be recognised or enforced in Europe. If an organisation replies to a request for personal data from a third country authority, this data flow constitutes a transfer and the GDPR applies. An international agreement may provide for both a legal basis and a ground for transfer. In case there is no international agreement, or if the agreement does not provide for an appropriate legal basis or safeguards, other legal bases or other grounds for transfer could be considered, in exceptional circumstances and on a case by case basis.*

The guidelines are subject to public consultation until 27 January 2025.

Approval of EU Data Protection Seal

During the plenary meeting, the Board also adopted an opinion approving the Brand Compliance certification criteria concerning processing activities by controllers or processors. In September 2023, the Board already adopted an opinion on the approval of the Brand Compliance national certification criteria, making them officially recognised certification criteria in the Netherlands for data processing by organisations. The approval of the new opinion means that these criteria will now be applicable across Europe and as a European Data Protection Seal.

GDPR certification helps organisations demonstrate their compliance with data protection law. This transparency helps people trust the product, service, process or system for which organisations process their personal data.

Note to editors:

* The transfer must comply with Art.6 GDPR and the provisions of Chapter V.

An international agreement may provide for both a legal basis under Art. 6(1) (c) or 6(1) (e) GDPR and a ground for transfer under Art. 46(2) (a) GDPR.

Eliška is a legal expert and digital rights advocate known for her work in internet governance and online freedom of expression. Together we discuss freedom of expression, democracy, privacy and digital rights in the context of a "super election year".

Join us as we speak with leading experts who witnessed the evolution of data protection globally first-hand. The second episode features Peter Hustinx and focuses on the work that led to the Council of Europe’s Convention 108. 

The EDPS and the Data Protection Officers (DPO) network of the EU institutions, bodies, offices and agencies (EUIs) met for the second time this year on 27 November 2024, at the Court of Justice of the European Union, in Luxembourg. This is the 55th meeting held since its creation.

Read blogpost by Leonardo Cervera Navas. 

In this episode, we welcome Ségolène Martin. Mrs Martin is a cofounder of Kantify, a pioneer in AI-driven health solutions. Dive deep with us to explore how Artificial Intelligence - so called Sapian- to improve drug discovery in healthcare. 

Our special Talk is out! Today we welcome Ms Katherine Race Brin who was interviewed by Supervisor. Watch with us on our anniversary website.

On 18th - 19th November 2024, the EDPS co-hosted the 74th Meeting of the International Working Group on Data Protection in Technology.  Read about the event in the Supervisor's blogpost. 

Watch with us another episode with one of the most influential privacy activist and lawyer who became known for campaigns against privacy violations, advocating for stronger enforcement of data protection and privacy law against big tech companies

This year, we focused on the rapidly growing AI technologies and described how emerging trends could impact the rights and freedoms of individuals . In the report you will find critical overview of six trends. 

Have a listen to our new episode of the Newsletter Digest on Artificial Intelligence with the Secretary-General of the EDPS, Leonardo Cervera Navas. Now you can also watch the episode here.

Brussels, 05 November - During its latest plenary, the European Data Protection Board (EDPB) adopted a report on the first review1 of EU-U.S. Data Privacy Framework (DPF), as well as a statement on the recommendations of the high-level group (HLG)2 on access to data for effective law enforcement.

The EDPB welcomes the efforts by the U.S. authorities and the European Commission to implement the DPF, and takes note of several developments that took place since the adoption of the adequacy decision in July 2023.

Regarding commercial aspects, i.e. the application and enforcement of requirements applying to companies self-certified under this framework, the EDPB notes that the U.S Department of Commerce took all relevant steps to implement the certification process. This includes developing a new website, updating procedures, engaging with companies, and conducting awareness-raising activities.

In addition, the redress mechanism for EU individuals has been implemented and there is comprehensive complaint-handling guidance published on both sides of the Atlantic. However, the low number of complaints received so far under the DPF highlights the importance of having U.S. authorities initiate monitoring activities concerning compliance of DPF-certified companies with the substantive DPF Principles.

The EDPB encourages the development of guidance by U.S. authorities, clarifying the requirements that DPF-certified companies would need to comply with when they transfer personal data that they have received from EU exporters. Guidance by U.S. authorities on human resources data would also be welcome. The EDPB expresses its availability to provide feedback on these guidance documents.

Concerning the access by U.S. public  authorities  to  personal  data transferred from the EU to certified organisations, the EDPB focused; on the  effective  implementation  of  the  safeguards introduced by the Executive Order 14086 in the U.S. legal framework, such as the necessity and proportionality principles  and  the  new  redress  mechanism. The Board considers that the elements of the redress mechanism are in place; at the same time, it renews the call to the European Commission to monitor the practical functioning of the different safeguards, e.g. the implementation of the principles of necessity and proportionality. The EDPB also recommends that the Commission monitors future developments related to the U.S. Foreign Intelligence Surveillance Act, in particular given the extended reach of Section 702 after its re-authorisation by the U.S. Congress earlier this year.

EDPB Deputy Chair Zdravko Vukić said: “We are pleased that progress has been made since the adoption of the adequacy decision thanks to the fruitful cooperation between U.S. authorities, the EU Commission and the EDPB. At the same time, there is still space for improvement and we should continue working together to maintain a high level of data protection and safeguard the rights and freedoms of EU individuals.”

Finally, the Board recommends that the next review of the EU-U.S. adequacy decision should take place within three years or less.

 The statement on the recommendations of the HLG on access to data for effective law enforcement underlines that fundamental rights must be safeguarded when law enforcement agencies access the personal data of individuals. While the EDPB supports the aim of effective law enforcement, it points out that some of the HLG’s recommendations could cause serious intrusiveness vis-à-vis fundamental rights, in particular the respect for privacy and family life.

 While the EDPB positively notes the recommendation may lead to the establishment of a level-playing field on data retention, it considers that a broad and general obligation to retain data in electronic form by all service providers would create a significant interference with the rights of individuals. Therefore, the EDPB questions whether this would meet the requirements of necessity and proportionality of the Charter of Fundamental Rights of the EU and the CJEU jurisprudence. 

In its statement, the EDPB also emphasizes that the recommendations concerning encryption should not prevent its use or weaken the effectivity of the protection it provides. For example, the introduction of a client-side process allowing remote access to data before it is encrypted and sent on a communication channel, or after it is decrypted at the recipient, would in practice weaken encryption. Preserving the protection and effectivity of encryption is important to avoid that the respect for private life and confidentiality is negatively impacted and to ensure that the freedom of expression and economic growth, which depend on trustworthy technologies, are safeguarded. 

Note to editors

1 In line with art. 3 of EU-U.S. adequacy decision, the EU Commission is required to review the adequacy decision one year after its adoption. The review meeting was held in Washington D.C. on 18-19 July 2024 and the EU Commission was accompanied by five representatives of the EDPB.

2 The HLG was launched by the European Commission in June 2023 and it is co-chaired by the EU Commission and the rotating Presidency of the Council. It was launched with the aim to explore challenges for law enforcement practitioners in connection to access to data and propose solutions and recommendations.

In June 2024, the  HLG  published  42  recommendations  for  the further development of EU policies and legislation, structured as “capacity  building  measures”,  “cooperation  with  industry  and standardisation” and “legislative measures”. The  recommendations  cover  in  particular  encryption, cooperation  with  the  industry  as  well  as  between  law  enforcement agencies, and the need for harmonised rules on data retention.
 

The EDPB is holding a stakeholder event on “AI models” with participants representing European sector associations, organisations, NGOs, individual companies, law firms and academics. 

During today’s event, the EDPB will collect input for of the preparation of a consistency opinion on AI models, requested by the Irish Data Protection Authority under Art. 64 (2) GDPR.

EDPB Chair Anu Talus said: “During the stakeholder event we will tackle a number of targeted questions, which will feed our reflection in the context of the preparation of our Opinion on AI models. Stakeholder input is especially valuable for these fast-moving technologies with an exceptional societal impact.”

The EDPB's opinion on “AI models” is due by the end of 2024.

On 28 January 2025 in Brussels, to mark Data Protection Day, European Data Protection Supervisor (EDPS) together with Council of Europe (CoE) and Computers, Privacy and Data Protection, organises a one-day hybrid event focused on exploring the current and future landscape of data protection. 

The full programme and registration are available at https://cpdp-dataprotectionday.eu/

With a strong background in planetary science and a passion for the search for life beyond Earth, our guest has been instrumental in advancing research on extreme environments, often considered analogs for other planets. Watch it with us.