EDPB Plenary 3/Minutes

File:EDPB 3 Plenary.pdf

Adoption of the minutes and the agenda

Minutes of the 2nd EDPB meeting - adoption

The minutes were adopted unanimously.

Draft Agenda of the 3rd meeting - adoption

The agenda was amended by adding a point of information on the development of the Brexit. Items 2.1, 2.2, 2.3, 4.1, 4.2 and 4.5 of the agenda were declared confidential according to Art. 33 RoP.

The agenda, as amended, was adopted unanimously.

FOR DISCUSSION AND/OR ADOPTION - Current Focus of the EDPB

Art. 64 GDPR Opinions on DPIA lists – discussion and adoption of the opinions [REDACTED]

The lead rapporteur explained the methodology followed to assess the 22 lists that had been submitted to the EDPB for an opinion according to Art. 64 GDPR. Five items - with different options were submitted for a decision of the EDPB. These were related to the notion of large scale, genetic data, biometric data, the notion of further processing and location data. Following the agreement at the July plenary, the Technology Subgroup together with the EDPB Secretariat prepared 22 draft opinions with the different options to be decided upon by the EDPB.

The Commission pleaded for the highest possible harmonisation of the lists.

[REDACTED]

[REDACTED]

Complaints against Google - discussion (Rapporteurs [REDACTED])

[REDACTED]

[REDACTED]

New BREXIT - for information

UK SA gave the latest update on the negotiations for the Brexit. COM also debriefed on the ongoing negotiations, recalling that any Brexit related issue is to be discussed exclusively between the European Commission (acting on the basis of a mandate received from the 27 Member States) and the British government. [REDACTED]

[REDACTED]

The EDPB members will discuss at the next plenary meeting the necessity to attribute the assessment of this matter to a subgroup.

Reorganisation of the EDPB and the Subgroups - discussion and adoption (Rapporteur: [REDACTED] )

Based on EDPB members’ contributions the Chair team together with the EDPB Secretariat developed a compiled proposal paper which was presented to the members of the EDPB. Due to time constraints, only a part of the document was discussed by the members of the EDPB. The discussion on this paper will continue during the next plenary meeting.

Regarding the organisation of the plenary meetings, the EDPB decided:

• To provide simple state of plays only in writing.
• To make a clear visual distinction between issues that should be discussed and the issues only for information (e.g. “For information”, “For discussion”).
• To make more use of the written procedures for simple requests or for issues that merit a yes/nodecision without further discussion.

The EDPB also decided to have a separate section for Law Enforcement Directive issues, if there is an agenda point in this respect.

Finally, the EDPB decided on the fact that 2 full days will be necessary for the plenary meetings in 2019.

Regarding the subgroups, the EDPB decided that:

• The coordinators and the EDPB Secretariat have to ensure that the outcome of FOP SG and plenary meetings are shared with the relevant SG.
• The subgroups will have to share annual working on CIRCA.
• The subgroups will have to use the new template for info notes.
• To use more tele- or videoconferencing system for the meetings.
• The EDPB Secretariat has to share all subgroup minutes on CIRCA.
• To schedule subgroup meetings well in advance and to send all documents 1 week in advance. If that is not possible, provide the subgroup members with a reasonable additional period to react to the documents.

The EDPB members agreed with the proposal to have an annual working plan to be shared on CIRCA.

Regarding Art. 64 GDPR, the EDPB decided to adapt the note to be in line with the Art. 10.5 RoP (the opinions shall be prepared and drafted by the secretariat and, upon decision of the Chair, together with a rapporteur and expert subgroups members).

Regarding Art. 65 and 66 GDPR, the EDPB decided to have an ad-hoc subgroup.

Regarding the BTLE subgroup, the EDPB decided to keep the name of this subgroup and to keep in its mandate the preparation of the coordinated supervision under Art. 62 Regulation (EC) 45/2001

Regarding the Communication Officer Network, the EDPB agreed to establish a Communication Officer Network with periodic meetings or teleconferences.

Information and exchange of different strategies of DPAs – discussion (Rapporteurs: [REDACTED])

Due to time constraints the discussion on this agenda point was postponed to the next plenary meeting.

Japan’s Adequacy decision – state of play (Rapporteur: COM)

[REDACTED]

Election Package – state of play (Rapporteur: COM)

In the context of the State of the Union Address, the President of the Commission announced a set of measures to help make sure that the 2019 elections to the European Parliament are organised in a free, fair, and secure manner. Commissioner Jourova highlighted the crucial role of the SAs and called for their active involvement together with the national electoral regulators. Commissioner Jourova invited the EDPB members to inform the EU COM about any screening made in MS about the respect of data protection in the context of the elections.

FOR DISCUSSION AND/OR ADOPTION - Subgroups

Key Provisions SG

Guidelines on the application of the territorial scope of the GDPR – adoption (Rapporteurs: FR SA, DE SA and EDPS)

The lead rapporteur explained the changes made after the discussions at the last FOP subgroup meeting. He highlighted the fact that the text on the table is a compromise text and that it will be submitted to public consultation. As regards the liability of the Art. 27 GDPR - representative, the EDPB members decided to keep the text as presented by the lead rapporteur. The EDPB adopted the draft guidelines and decided to submit it to public consultation.

Enforcement SG

Discussion paper on the EDPB Enforcement Strategy – discussion and request for mandate (Rapporteurs: DE SA, ES SA, NL SA)

The EDPB gave the requested mandate.

Technology SG

Privacy by design and by default – request for mandate (Rapporteur: NO SA)

The EDPB gave the requested mandate. A related mandate on accountability will be requested by the eGovernment subgroup at the next plenary meeting.

NEW: Meeting with Commissioner Vera Jourova

Commissioner Jourova explained that her intervention focuses on 4 points:

• The election package

Commissioner Jourova wanted to stress the fact that this package is very important as there are a lot of elections coming up in EU Member States. Data cannot be abused.

She explained the strategy underpinning the package. She highlighted the need to prevent the misuse of voter’s data, the importance of cybersecurity and the misuse of disinformation. She said that the EU COM asked the Member States to establish national election cooperation networks to which SAs should be part. She invited the EDPB members to actively participate in this initiative. She asked whether the SAs could do a screening of the legal situation in their respective Member States and invited the EDPB members to inform the EU COM about the respective results on the respect of data protection in the context of the elections. She referred to the October JHA Council where the electoral package will be presented to the Justice Ministers.

• The Privacy Shield

Commissioner Jourova thanked the EDPB members for their support with regard to this topic. She mentioned the second annual review and recalled the value of contributions of SAs. She said that EU COM expects real progress on this topic from the US side. She mentioned that there is a change in the US society as they are generally more concerned about privacy. She mentioned that the COM is still waiting for results of the FTC investigation on Facebook/Cambridge Analytica.

• The Japanese adequacy decision

Commissioner Jourova explained that the EU COM has done its analysis and mentioned that the

Japanese adequacy decision is a very important file. A lot of analytic work has already been done by the EU COM, for which the EDPB checklist had been used. She asked the members of the EDPB on the timeline for preparing the opinion of the EDPB.

• Feedback on the GDPR

Commissioner Jourova explained that 20 Member States have adopted their implementing national laws. She said that EU COM is liaising with the Member States that have not yet adopted their national legislation [REDACTED]

[REDACTED]

BTLE SG

Statement on e-Evidence Proposals – adoption (Rapporteurs: [REDACTED]

The EDPB adopted the statement.

Future of Supervision – request for mandate (Rapporteurs: [REDACTED]

The EDPB gave the requested mandate.

Financial Matters SG

FATCA: Compatibility with GDPR – discussion and request for mandate (Rapporteur [REDACTED]

The Board discussed about the request for mandate included in the infonote and decided that an amended version of such request for mandate will be submitted to the written procedure for approval.

Cooperation SG

Interpretation of Article 64 (2), (3) last sentence and (4) – state of play and confirmation of the Rapporteurs (Rapporteur: [REDACTED]

The EDPB confirmed the rapporteurs.

In addition, one EDPB member suggested that the Cooperation subgroup should work on the question which documents should be translated during the cooperation procedures. The EDPB members asked this member to draft a request for mandate and to submit it for a decision on a later stage.

International cooperation for the protection of personal data - Article 50 GDPR – state of play and discussion (Rapporteur: [REDACTED]

Due to time constraints the discussion on this agenda point was postponed to the next plenary meeting.

Social Media SG

Terms of reference and work plan – request for mandate (Rapporteurs: BE SA, FR SA, IE SA)

The EDPB gave the requested mandate and adopted the work plan.

3.7.2 Letter of response to Consumers International, Privacy International, and Norwegian Consumer Council regarding the Deceived By Design report – adoption (Rapporteurs:

Due to time constraints the discussion on this agenda point was postponed to the next plenary meeting.

ITS SG

ESMA – discussion (Rapporteur: [REDACTED]

The members of the EDPB agreed on the general structure of the current administrative agreement, but are of the opinion that some clarifications and improvements are still necessary.

Secretariat

Update of the EDPB Rules of Procedure after the EEA agreement – adoption - [REDACTED]

Due to time constraints the discussion on this agenda point was postponed to the next plenary meeting.

Observers – discussion - [REDACTED]

Due to time constraints the discussion on this agenda point was postponed to the next plenary meeting.

Access to IMI for the EDPB Secretariat - discussion

The EDPB gave mandate to EDPB Secretariat to request

• EC DG GROW to grant read-only access to the cooperation procedures in IMI for the EDPB IMI Helpdesk for the purpose of users support;
• EC DG GROW to grant limited administrator rights to one member of the EDPB-IMI-Helpdesk which enables to provide statistics and some adjustments required by users.

Proposal of an OPT IN solution for use of cookies for statistics on the EDPB website – discussion

[REDACTED]

Possibility for the EDPB to send letters to individuals and private organisations

This agenda point was not discussed, but will be during one of the next plenary meetings.

Miscellaneous

• The members of the EDPB confirmed the necessity to have an extraordinary plenary meeting on 16 November 2018.
• The Chair informed the members of the EDPB about her invitation to a hearing at the US Senate Committee on Commerce, Science and Transportation in Washington, D.C. on 10 October 2018.

• [REDACTED] This point will be added to the agenda of one of the next plenary meetings.

• The EDPS invited members of the EDPB to participate in the 40^th International Conference of Data Protection and Privacy Commissioners which will be held in Brussels and Sofia and is organised by the EDPS and BG.

The next plenary meeting will take place in Brussels on 16 November 2018.

Annex: Attendance list

SAs of:

AT, BE, BG, CY, CZ, DE, DK, EDPS, EE, EL, ES, FI, FR, HR, HU, IE, IT, IS, LI, LT, LU, LV, MT, NL, NO, PL, PT, RO, SE, SI, SK, UK

Further attendees: - European Commission

• Observers:

Regular: AL, MD - AL and MD received an ad hoc invitation to attend the meeting, except for the points 2.1, 3.4.1 and 3.6.1.

• EDPB Secretariat