Progress on the data protection reform package
EDPS letter to the Council of Ministers regarding progress on the data protection reform package
Accountability is a common principle for organisations across many disciplines; the principle embodies that organisations live up to expectations for instance in the delivery of their products and their behaviour towards those they interact with. The General Data Protection Regulation (GDPR) integrates accountability as a principle which requires that organisations put in place appropriate technical and organisational measures and be able to demonstrate what they did and its effectiveness when requested.
Organisations, and not Data Protection Authorities, must demonstrate that they are compliant with the law. Such measures include: adequate documentation on what personal data are processed, how, to what purpose, how long; documented processes and procedures aiming at tackling data protection issues at an early state when building information systems or responding to a data breach; the presence of a Data Protection Officer that be integrated in the organisation planning and operations etc.
In 2015, in anticipation of the GDPR, the EDPS initiated a project to develop a framework for greater accountability in data processing to be applied to our own organisation, as an institution, a manager of financial resources and people - and a controller.
In addition, we have started to promote the accountability principle through visits to small, medium and large EU bodies to explain the new obligations resulting from the revised legal framework and the implications for EU institutions and the EDPS' work as their supervisory authority.
EDPS letter to the Council of Ministers regarding progress on the data protection reform package
When EU institutions and bodies process personal data, they must comply with the principle of accountability and the obligations set out in the EU Data Protection Regulation 45/2001. EDPS Factsheet 3 provides information on how the EDPS works with the EU insitutions to ensure they achieve compliance.
Additional EDPS Comments of on the Data Protection Reform Package
Policy on Consultations in the field of Supervision and Enforcement