Greetings from Milano,

This week I was fortunate to find myself in this Italian beacon of elegance and sophistication. Milan is so much more than the puritanically work-obsessed city it is often portrayed as. Milan is a city where creativity is big business, looking good is compulsory, and after-work gatherings are an art form. Not only is Milan a treasure trove of art and design, there is art deco and rationalist architecture abound. I do like this city, home to much more than I can squeeze into this editorial. I will however share that I finally got to view the breathtaking "Last Supper," by Leonardo da Vinci, at the Santa Maria delle Grazie, which fortunately was right opposite the Palazzo delle Stelline, where the 4th Annual ASSO DPO Congress was being held. Let me extend a hearty thank you to ASSO DPO president and IAPP member Matteo Columbo, and his team for facilitating the guided viewing of this 15th century masterpiece.

Fittingly, with the advent of the EU General Data Protection Regulation now 14 days away, the ASSO DPO conference was focused on the practical themes of privacy engineering and programming. Sessions included a focus on how to connect DPOs from across Europe to share common cause, as well as addressing the interplay between data controllers and processors in a post-GDPR world. As the representative of the IAPP, I participated in a roundtable discussion with several European member state privacy associations, highlighting our IAPP mission in connecting the privacy profession and how we support the community through our platforms both in Europe and, importantly, from a global perspective. We are the International after all, accounting for more than 40,000 members in more than 100 countries and, for the record, we currently stand at 11,100 members in Europe, our fastest-growing geographical community.

The conference highlight for me was the keynote made by Giovanni Buttarelli, the European data protection supervisor. Buttarelli opened his address with a smile and a question: "Are you ready for GDPR?" He confirmed that the European Data Protection Board is ready to start its work immediately when the GDPR enters into force 25 May: “The rules are set, the working methods still need some refinement, but we are ready." He also cautioned that the EDPB, unlike its predecessor the Article 29 Working Party,  will be much more than a consultative committee, having evolved into a fully fledged decision-making legal body with authority in Europe. A strong emphasis was placed on transparency and accountability for the entity: “We want to be more accessible and more modern, more flexible but also more selective, as we will have to take more decisions collectively.” Buttarelli also reflected that everyone has understood that European standards of privacy and data protection have the potential to inform privacy policy internationally, underlining the future strategy of trade agreements such as those between the EU and Japan and Korea. Global data flows will be affected by the regulation and reflected in those trading realities.

On an advisory note, Buttarelli also spoke to the principle of accountability under the GDPR for businesses. He stated that the regulatory community will be looking to data controllers (and processors) to take timely decisions and seek diversification for the answers and solutions unique to their organizations and ecosystems. WP29 Guidelines are not enough — they are a set of standard practices — but not necessarily "the whole answer," he said. Notably, his message was clear that the role of the data protection officer provides an essential function, serving as a catalyst for the meaningful changes that need to be implemented within the GDPR framework.