The European Data Protection Board (EDPB) met for its fifth plenary session on 4 and 5 December 2018.

The EDPB published a press release, highlighting the three main areas of discussion:

  1. EU-Japan draft adequacy decision. The EDPB adopted an opinion on the European Commission’s draft adequacy decision. In adopting its opinion, the EDPB focused on the sufficiency of guarantees for an adequate level of data protection, emphasising that the Japanese framework need not necessarily replicate that of the European Union (EU). The EDPB welcomed the increased convergence of both frameworks, but expressed a number of concerns, in particular with regard to the continuing protection of personal data transferred from the EU to Japan. The EDPB recommends the European Commission to also address the requests for clarification to provide further evidence and explanations regarding the issues raised and to closely monitor the effective application. As the first adequacy decision to be made since the General Data Protection Regulation (GDPR) entered into force, this will no doubt set a precedent for adequacy decisions going forward.
  2. DPIA lists. The EDPB adopted opinions on the Data Protection Impact Assessment (DPIA) lists, submitted by the supervisory authorities of Denmark, Croatia, Luxembourg and Slovenia. DPIA is a process to help identify and mitigate data protection risks that could affect the rights and freedoms of individuals. The lists set out the types of processing activities which require a DPIA. The EDPB has now adopted 26 opinions. The opinions will help to develop a common view and the consistent application of the GDPR in this area.
  3. Guidelines on accreditation of certification bodies. The aim of the guidelines is to provide guidance on how to interpret and implement the provisions of Article 43 of the GDPR. They seek to create a consistent view for the accreditation of bodies that issue certification in accordance with the GDPR. The Article 29 Working Party previously adopted draft guidelines and opened them up for public consultation. The EDPB has now adopted a final version of the guidelines. In doing so, the EDPB added an annex, which provides guidance on additional requirements for supervisory authorities to consider. The annex will be subject to public consultation.

For further insight into the other areas of discussion, see the session’s agenda.