With little if any litigation to report and a wealth of unanswered interpretative questions, the Article 29 Working Party opinions and guidance documents have been a lodestar for data protection lawyers and practitioners worldwide.
Ask any privacy professional a question: How should my company structure an agreement with a vendor? What kind of consent do I need for this activity? Is employee notice correctly phrased? And – that old faithful of privacy questions – is this personal data? And in their excited response they will no doubt cite the WP29 opinions on anonymization techniques; on the concepts of controllers and processors; on the notion of legitimate interests of the data controller; and perhaps even that perennial favorite of data protection geeks, which ages like a fine bottle of Bordeaux from 1998, Working Paper 12 on Transfers of Personal Data to Third Countries: Applying Articles 25 and 26 of the EU Data Protection Directive.
Shockingly, a couple of months ago, at the height of the frenzied preparations for the May 25, 2018, landing of GDPR, in full force with its 4 percent sanctions and intricate one-stop-shop mechanism that makes astrophysics equations look like simplified nursery rhymes, the entire WP29 opus, comprising more than 200 opinions, guidance documents and reports, disappeared from the web. In what might seem like a diabolical prank, the European Commission website reorganized the WP29 page, leaving only a handful of recent documents accessible to the community of privacy professionals even as they seek to address an avalanche of data protection problems seeking solutions.
After receiving numerous member requests, the IAPP dug-in to unearth the buried treasure, which was discovered intact (phew!), in the Internet archive. Pending the WP29 – soon to become the European Data Protection Board – getting a new website online, we present to you, in reverse chronological order, links to the WP29 body of work.
To be sure, the IAPP cannot solve all problems; and a lingering issue is that every article, report, document, and, in general, webpage that links to the WP29 opinions – for example, a law firm’s blog post analyzing a recent case or a regulator’s guidance document with citations to an opinion – is now pointing to a broken link.
Perhaps the powers that be at the European institutions can fix this by reinstating the old URLs. But in the meantime, fear not. Here are the links to all Article 29 Working Party papers to help you prepare for GDPR implementation in your organization.
photo credit: European Parliament European colours flying in the wind via photopin (license)