While many in the U.S. were taking the day off in celebration of Independence Day, officials in Europe have been busy addressing a number of privacy issues this week. For one, the newly minted European Data Protection Board provided an update after it held its second plenary meeting July 4 and 5 about a slate of pressing data protection topics.
Top of mind for the EDPB is the state of play of its consistency and cooperation mechanisms now that the EU General Data Protection Regulation is in effect. According to a press release from the group of EU data protection authorities, officials discussed their experiences so far with the one-stop-shop mechanism, the performance of the Internal Market Information System — an IT platform that facilitates exchanges on cross-border issues — as well as compliance questions the EDPB has received since the GDPR's enactment.
Notably, most DPAs in the EDPB have reported an increase in complaints since May 25 and report that approximately 30 cross-border complaints, initiated under the IMIS, are currently under investigation.
Andrea Jelinek, chairwoman of the EDPB, said, "Despite the sharp increase in the number of cases in the last month, the Members of the EDPB report that the workload is manageable at the moment, in large part thanks to a thorough preparation of the [the Article 29 Working Party] in the past two years. The GDPR does not offer a quick fix in case of a complaint but we are confident the procedures detailing the way in which the authorities work together under the consistency mechanism are robust and efficient."
The IAPP recently reached out to the DPAs of all 28 member states and catalogued the number of GDPR complaints they have received since May 25. Though not all DPAs responded, the IAPP was able to compile data on a number of complaints, including those received by the U.K. Information Commissioner's Office.
In parallel with the European Parliament, which voted July 5 to suspend the EU-U.S. Privacy Shield framework if the U.S. is not fully compliant by Sept. 1, the EDPB also addressed the transatlantic agreement. Top concerns for the EDPB are the appointment of a permanent ombudsperson and the formal appointments of officials to the U.S. Privacy and Civil Liberties Oversight Board. The EDPB also pointed out a lack of additional information about how the ombudsperson interacts with U.S. intelligence agencies.
During the plenary, the group also met with Ambassador Judith Garber, the acting U.S. ombudsperson responsible for processing national security complaints under Shield. Though the meeting with Garber was "interesting and collegial," the discussion "did not provide a conclusive answer to these concerns and that these issues will remain on top of the agenda during the Second Annual Review (scheduled for October 2018)," the press release stated. The EDPB noted that similar concerns will be addressed by the Court of Justice of the European Union in pending cases "to which the EDPB offers to contribute its view, if invited by the CJEU."
The EDPB also addressed the privacy issues surrounding the Internet Corporation for Assigned Names and Numbers with regard to the WHOIS data. Accordingly, the EDPB adopted a letter addressed to ICANN "providing guidance to enable ICANN to develop a GDPR-compliant model for access to personal data processed in the context of WHOIS." The letter touches upon purpose specification, collection of WHOIS data, registration of legal persons, data retention, codes of conduct, and accreditation, among others. The DPAs expect ICANN to implement a model that will balance legitimate use — particularly for law enforcement access — while also complying with the GDPR.
Finally, the EDPB adopted a letter addressed to Dutch MEP Sophie in't Veld on the revised Payment Services Directive. According to the press release, "the EDPB sheds further light on 'silent party data' by Third Party Providers, the procedures with regard to giving and withdrawing consent, the Regulatory Technical Standards, the cooperation between banks and the European Commission, EDPS and WP29 and what remains to be done to close any remaining data protection gaps."
photo credit: justusbluemer Europäische Flagge via photopin(license)