The European Data Protection Board (EDPB) recently issued a report after their November 16, 2018 plenary session. The statement covered a range of topics being discussed by the Board, but no substantive publications. The EDPB is charged with ensuring that GDPR is applied consistently across the EU and that there is consistent enforcement by DPAs across the Union. The Board is also tasked with issuing guidelines on the interpretation the GDPR (formerly the charge of the Article 29 Working Party), and making binding decisions about cross-border disputes. The Board is made up of the head DPA or representatives from each member country.
An EU-Japan adequacy finding appears to be extremely close, and the Board announced they are at work on guidelines about the intersection between Clinical Trials Regulation and the GDPR for medical device and pharmaceutical companies. There have now been four “plenary meetings” of the EDPB. Some may consider no action on the part of the Board a good thing, but there are some significant concepts which eventually need clarification, including a formal process and procedure on appeals of DPA enforcement and fines, and modernization of the outdated Model Contractual Clauses, among other things. The essential message from the EDPB continues to be “stay tuned,” and seems likely that no real substantive publications will come through until early 2019.
The complete press release from the EDPB can be found here.