EDPB Plenary 2/Minutes

File:EDPB 2 Plenary.pdf

Adoption of the agenda and information given by the Chair

[10:00 – 10:45]

Minutes of the preparatory and first EDPB meeting - adoption

The minutes were amended as set out in the FINAL version and adopted unanimously with the amendments sent by the delegations and raised by the COM during the meeting.

Draft Agenda (Adopted before)

The Agenda was amended by removing the words “EDPB Enforcement Strategy” from item 3.7.2 and declaring the items 1.4, 2.1, 2.2, 2.3 and 3.7.2 confidential according to Art. 33 RoP.

Request of the US Mission to the EU

The members of the EDPB discussed the meeting of the Chair and Vice Chairs with the US envoy on 6 July 2018 which was organised upon request of the US side to explore the impact of the GDPR in several areas of interest for the USA. The members of the EDPB agreed that the Chair, together with the Vice Chairs, will represent the EDPB and communicate the outcome to the other members of the EDPB.

Facebook / Cambridge Analytica – state of play (Rapporteurs: [REDACTED])

The Chair informed about the hearing with the LIBE Committee on 25 June 2018. It was agreed that relevant information will be shared with the other members of the EDPB, if and when available. The UK SA informed about the ongoing nvestigations and announced the publication of two related reports in the week after the plenary. Both the EDPS and the COM informed that they were also invited to present their opinion on online manipulation and personal data.

Current Focus of the EDPB

[10:45 – 12:30] === Art. 64 GDPR Opinions on DPIA lists – discussion, request for mandate and confirmation of the Rapporteurs: [REDACTED] The general procedure for Art. 64 GDPR opinions on the DPIA lists was discussed. The EDPB agreed that additional research should be made on Art. 64.3 and 4 GDPR and a proposal of mandate for the Cooperation subgroup will be discussed on 5 July 2018. It was agreed that the Technology subgroup will work, together with the EDPB Secretariat, on the draft opinions to be submitted to the next lenary. The following SAs volunteered as rapporteurs: IE, UK, DE, SE, AT, EE and FR as lead-rapporteur. The members of the EDPB were invited to provide their DPIA lists by 10 July 2018 to allow for a timely assessment ahead of the next Technology subgroup meeting and the plenary meeting in September 2018. The assessment will mainly focus on the compatibility of the draft lists with the WP29 Guidelines and their consistency.

One-Stop-Shop/Art. 60 GDPR: current cases – discussion (Rapporteur: [REDACTED]) - CONFIDENTIAL -

The members of the EDPB presented their experience with the new procedures, reported on the amount of cases as well as common observations. The members of the EDPB observed a strong increase in cases, including data breach notifications.

The Chair invited the members of the EDPB to share statistics about cases related to cross-border processing activities to have a global overview.

The EDPB agreed to prepare a story telling to be used by DPAs to explain the timeframe for the handling of cross-border complaints and that the need to respect procedural rights may have an impact on the duration of proceedings.

The members of the EDPB also discussed the application of Art. 64.2 GDPR. [REDACTED]

Privacy Shield - CONFIDENTIAL

The Federal CH SA was invited to enter the room for this agenda point.

Internal report on the progress by 25 May – discussion (Rapporteurs: [REDACTED] )

The rapporteur explained the content of the draft report, highlighting 3 elements:

• [REDACTED]
• There is 1 case pending on the Privacy Shield before the General Court and one case on the SCCs (“Schrems II”) before the CJEU.
• [REDACTED]

Meeting with Ms. Judith Garber (acting Ombudsperson) on 5 July 2018 – discussion (Rapporteurs: [REDACTED])

As regards the presence of Judith Garber, the acting Ombudsperson, on 5 July 2018, the members of the EDPB agreed on the questions prepared by the [REDACTED] by questions from other members of the EDPB.

Table on the powers of national SAs to bring action before national courts – discussion (Rapporteurs: DE DPA, FR DPA)

A table on the powers of national SAs which are capable of bringing an action before the national courts as regards transfers made on the basis of an adequacy decision was prepared by the BTLE and the ITS subgroup. The table shows that several SAs, as well as the EDPS, would have the power to bring an action before a court, as regards transfers made on the basis of an adequacy decision, among which some could act without having received a specific complaint.

==== Statement/Press Release of the EDPB – discussion (Rapporteurs: The EDPB agreed on the Chair’s suggestion to have the issue of the Privacy Shield as part of a general press release of the plenary meeting.

Future Structure of the subgroups: Coordinators’ meeting on 15 June 2018 – discussion (Rapporteur: [REDACTED])

The Chair proposed to develop a paper for the revised structure of the subgroups and the possible improvement of the organisation of EDPB’s work, taking into account all the delegation's contributions. In this respect, all members were invited again to send further proposals and ideas to the Chair team by 31 July 2018. The Chair team will then develop a compiled proposal and circulate it among the members of the EDPB for comments at the next FOP meeting and then to be discussed during the September plenary meeting.

The EDPB unanimously gave a mandate accordingly.

Subgroups

[16:30 – 17:15]

Technology subgroup

Letter to ICANN - adoption (Rapporteur: [REDACTED])

The EDPB unanimously adopted the ICANN letter with minor changes as well as the cover letter to stakeholders.

Letter to Facebook on facial recognition – adoption (Rapporteur: [REDACTED])

The Facebook letter was discussed by the EDPB but not yet adopted. The item will be discussed again in the Technology subgroup.

Financial Matters subgroup

PSD2: Letter to Sophie in’t Veld – adoption (Rapporteur: [REDACTED])

The EDPB unanimously adopted the letter.

OECD CRS: Questionnaire on the implementation – adoption (Rapporteur: [REDACTED])

The questionnaire was adopted with a change in question 11 as following: “Are there special provisions in the national implementation law concerning the data subject rights? Could you name the particular data subject rights and if possible send a link to the text of the national implementation law or name a source where to find it?”

The SAs are asked to send the questionnaire to the national competent tax authorities with a request for reply by 28 September 2018. The complete questionnaires should be forwarded by the SAs to the EDPB Secretariat.

FATCA: Compatibility with GDPR – written state of play* (Rapporteur: [REDACTED])

As this point was subject to a written state of play no discussion took place.

Key Provision subgroup

Guidelines on the territorial scope of the GDPR – written state of play* (Rapporteurs: [REDACTED])

As this point was subject to a written state of play no discussion took place. The updated draft document as it stands remains a work-in-progress text, subject to further update and modifications on the basis of the discussions held at subgroup level and the contribution received by members. The current draft of the guideline now includes further wording on the legal reasoning related to the application criteria of the GDPR territorial scope, as well as more advanced and conclusive examples.

Position paper on reliance on Article 6.1(b) in the context of ‘free’ online services – written state of play* (Rapporteurs: [REDACTED])

As this point was subject to a written state of play no discussion took place. Following extensive inputs from a first draft of the paper was circulated and considered at the Key Provisions subgroup meeting on 7 June 2018.

ITS subgroup

ESMA – written state of play* (Rapporteur: [REDACTED])

As this point was subject to a written state of play no discussion took place. [REDACTED]

Excursus: Data protection cooperation between the UK and the EU post Brexit (Rapporteur: [REDACTED]) There was a discussion on the practical implications of Brexit for EDPB members and the ICO’s involvement with the EDPB post-Brexit. The Chair declared that the EDPB should come back to this at the September Plenary.

Cooperation subgroup

Cooperation among the SAs – request for mandate (Rapporteur: HU DPA)

With regard to the choice of a knowledge tool, the EDPB decided unanimously that the Cooperation subgroup should coordinate actions with the IT Users group. The IT Users group should invite representatives of the cooperation subgroup to attend its next meeting.

Network for SAs DPOs: The EDPB gave a mandate to the subgroup to further explore the possible options and opportunities in this regard, such as how to deal with complaints lodged against the SAs own processing operations, scope of cooperation, including face-to-face meetings, virtual space, etc.

[REDACTED]

Social Media Working Group

Paper identifying the scope of the group – discussion and confirmation of Coordinators: [REDACTED]

The EDPB was presented with the various contributions of the members of the EDPB with respect to the scope and the work of the social media subgroup. During the discussion the majority of the members of the EDPB supported the option to have a flexible and not restrictive approach of the term social media.

The Social Media subgroup was established as a subgroup and received a mandate to elaborate a work program on the basis of a broad understanding of social media but with a focus on functionalities which are not covered by other subgroups. The subgroup should meet four times per year. The [REDACTED] were confirmed as coordinators.

Enforcement subgroup

Questionnaires – discussion (Rapporteur: [REDACTED])

The rapporteur emphasized that the number of answers received are not enough to go further with the work initiated.

The EDPB decided that the questionnaire should be sent again to the members of the EDPB for completion. The Enforcement subgroup may contact the EDPB Secretariat to work towards uniformity in issuing questionnaires, and - if necessary, prioritisation in topics.

Judgement in Wirtschaftsakademie (C-210/16): EDPB enforcement strategy – discussion (Rapporteur: [REDACTED])

As a common understanding of the impact of this judgement is important it should be discussed during the next Social Media subgroup meeting, whereas other subgroups might also take this judgement into consideration.

Guidelines on de-listing – written state of play* (Rapporteur: [REDACTED])

As this point was subject to a written state of play no discussion took place. During its last meeting in May, the members of the enforcement subgroup have adopted a working plan/roadmap presented by the co-rapporteurs ([REDACTED]).

The aim of this working plan/roadmap was to briefly outline the scope of the future tool on the delisting to be produced in line with the given mandate by the plenary. The work of the subgroup will focus solely on processing by search engines. This work will also address the consequences of the delisting.

Information given by the EDPB Secretariat

[10:00 – 10:45]

EDPB on Social Media – discussion

The EDPB discussed the use of social media by the EDPB and decided to use Linkedin and Twitter as communication tools of the activities of the EDPB in a way that EDPB does not itself enable the tracking of users.

New cookie policy on EDPB’s website – adoption

The EDPB decided to stop the use of cookies and similar technologies for analytics, i.e. statistics, on its website until an opt-in mechanism can be implemented and the information banner is adequately modified.

Functional mailboxes of the EDPB Secretariat - deletion of EDPB subgroup – state of play

For the communication with the SAs and when the SAs request information or support from the EDPB Secretariat only the mailbox of the [REDACTED] should be used as of now. When an Email should refer to a specific subgroup, the members of the EDPB are asked to use a name related tag to identify the relevant subgroup as well as what action is needed. The functional mailbox [REDACTED] will not be used anymore.

Observers: requests – discussion (Rapporteurs: [REDACTED]

1. Following the EDPB decision on 25 May 2018, the Chair invited former observers of the WP29 to send their official request to be granted the status of an observer. [REDACTED] [REDACTED]

[REDACTED]

[REDACTED]

[REDACTED]

2. The EDPB gave a mandate to the EDPB Secretariat to suggest amendments to the RoP relevant to the amendment of the EEA Agreement.

Meeting with Ms. Judith Garber (acting Ombudsperson)

[11:00 – 12:20] The acting US Ombudsperson responsible for handling national security complaints under the Privacy Shield, Ambassador Judith Garber, was invited to the plenary meeting of the EDPB for an exchange with the EDPB. The members of the EDPB were particularly interested in the appointment of a permanent Ombudsperson, the formal confirmation of members to the Privacy and Civil Liberties Oversight Board (PCLOB) by the US Senat

Privacy Shield: statement/press release of the EDPB – adoption (Rapporteurs: [REDACTED])

The EDPB adopted the press release as uploaded on its website.

Miscellaneous

The COM informed the EDPB of the developments on the Brexit negotiations and that the UK will be a third country after the UK exits the EU. [REDACTED]

The EDPS informed the EDPB of its proposal for a short-term secondments programme for the EDPB. A pilot can start in 2019 and a first edition will be established in 2020. The EDPS suggested convening a meeting with the Human Resources and Budget Heads of the national SAs on 24 September 2018.

The EDPS announced the launch of the registration for the International Conference on 22 - 26 October 2018. The Chair announced a joint side-event on 25 October 2018.

The members of the EDPB discussed the application of Regulation 1182/71/EEC as regards the deadlines set out in the GDPR. The EDPB Secretariat should provide further information during the next plenary in September 2018, if possible.

The next plenary meeting will take place in Brussels on 25-26 September 2018.

Annex: Attendance list

SAs:

AT, BE, BG, CZ, DE, DK, EDPS, EE, EL, ES, FI, FR, GR, HR, HU, IE, IT, LT, LU, MT, NL, PL, PT, RO, SE, SK, UK

Further attendees:

• European Commission
• Observers:

Ad hoc: [REDACTED] for the Privacy Shield Regular: IS, LI, NO, AL, MD

• EDPB Secretariat
• For pt. 5 of the Agenda: Judith Garber, acting Ombudsperson, Ambassador Department of State; [REDACTED]

License

© European Data Protection Board, 2018-2024.	This item was provided by the European Data Protection Board via a request pursuant to Article 15(3) TFEU and Regulation (EC) No 1049/2001. You may re-use it free of charge for non-commercial and commercial purposes provided that the source is acknowledged and that you do not distort the original meaning or message of the document. The EDPB, nor its Secretariat assume liability stemming from the re-use.