Newsletter (81)

On 30 June, the European Data Protection Supervisor (EDPS), Wojciech Wiewiórowski, published his Strategy for 2020-2024, focusing on Digital Solidarity.

Wojciech Wiewiórowski, EDPS, said: “This is a new strategy for a new decade, to shape a safer, fairer and more sustainable digital Europe, particularly for the most vulnerable in our societies. My mandate will embody the spirit of collaboration and unity. We will continue to work with authorities and experts across different policy areas to address the digital asymmetries that have become more acute during the Covid-19 public health crisis”.  

At his presentation of the EDPS strategy in an online event to which over 150 people registered, the Chair of the European Data Protection Board (EDPB) Andrea Jelinek and EU Commissioner for Justice, Didier Reynders contributed their remarks.  

The three core pillars of the EDPS strategy outline the guiding actions and objectives for the organisation to the end of 2024.

• Foresight:

The EDPS will continue to monitor legal, social and technological advances around the world and engage with experts, specialists and data protection authorities to inform its work.

• Action

To strengthen the EDPS’ supervision, enforcement and advisory roles the EDPS will promote coherence in the activities of enforcement bodies in the EU and develop tools to assist the EU institutions, bodies and agencies to maintain the highest standards in data protection.

• Solidarity:

While promoting digital justice and privacy for all, the EDPS will also enforce responsible and sustainable data processing, to positively impact individuals and maximise societal benefits in a just and fair way.  

Visit our dedicated website to the Strategy, available in EN, FR and DE

Read Press Release

Read the Strategy

Read speech by Wojciech Wiewiórowski

Watch the event

The EDPS welcomes that the Court of Justice of the European Union, in its landmark Grand Chamber judgment of 16 July 2020, reaffirmed the importance of maintaining a high level of protection of personal data transferred from the European Union to third countries. The EDPS will continue to strive, as a member of the European Data Protection Board (EDPB), to achieve the necessary coherent approach among the European supervisory authorities in the implementation of the EU framework for international transfers of personal data.

Read the statement.

On 16 June, the EDPS published their Opinion on the European Strategy for Data issued by the European Commission in February 2020. The aim of the Data Strategy, as set out in the Commission’s document, is to create a single European data space, to make it easier for businesses and public authorities to access high-quality data to boost growth and create value.

This opinion, therefore, presents the EDPS view on the Data Strategy as a whole, and on certain specific aspects: the notion of “public good”, Open Data, use of data for scientific research, data intermediaries, data altruism, international data sharing and others.

While the EDPS understands the growing importance of data for the economy and society, such as the development of a Digital Single Market and the EU’s digital sovereignty, it stresses that with "big data comes with big responsibilities" and appropriate data protection safeguards should be put in place. To this end, the EDPS supports the Commission’s commitment to develop the Data Strategy ensuring that European fundamental rights and values, including the right to the protection of personal data are respected, as well as being in full compliance with the GDPR.

Another point that the EDPS makes is that one of the objectives of the Data Strategy should be to prove the viability and sustainability of an alternative data economy model- open, fair and democratic.

The EDPS’ view is the European data space should serve as an example of transparency, effective accountability and a proper balance between the interests of the individuals and the shared interests of the society as a whole.

Lastly, in the context of COVID-19, the EDPS reiterates its position that data protection is not part of the problem but part of the solution.

Read Opinion

On 15 July 2020, the EDPS published a document entitled Orientations from the EDPS: Reactions of EU institutions as employers to the COVID-19 crisis to guide the European institutions and bodies (EUIs) as they have had to not only respond to the crisis within their policy roles, but also as employers.

Building on the experience of the past months, the document compiles the issues that were raised to or encountered by the EDPS, the advice given on questions related to teleworking tools, staff management, health data aspects and replying to data subject access requests. This is still relevant as telework is likely to remain a big part of the ‘new normal’ for the foreseeable.

Recommendations made by the EDPS relate to processing and minimising the collection of data, data retention and transfer, particularly when relying on external providers for certain products or services. In addition, the EDPS adds that keeping data secure requires the collaboration of IT departments, the Local Information Security Officer (LISO), the Data Protection Officers (DPOs) and all users. The EDPS also points out that the Covid-19 crisis does not suspend the rights that individuals’ have over their data.

The EDPS reiterated that data protection rules currently in force within the EUIs are flexible enough to allow various measures for the business continuity of EUIs operations. The EDPS is fully aware that some adaptations resulting from an emergency situation may require some time and stands ready to assist the EUIs.

The EDPS’ guidelines are addressed to controllers and DPOs in the EUIs. Controllers should consult their EUI’s DPO early in the process of developing organisational responses to this crisis. DPOs guide and advise controllers, but in the end, controllers are accountable for compliance with the Regulation, reinstated the EDPS.

Full EDPS guidelines here.

On 6 July, the EDPS published a Report on how EU institutions, bodies and agencies (EUIs) carry out Data Protection Impact Assessments (DPIAs) when processing information that presents a high risk to the rights and freedom of natural persons.

Wojciech Wiewiórowski, EDPS, said: “Data Protection Impact Assessments are one of the new and valuable accountability tools that EUIs use when they process sensitive personal data to measure the impact and risks to individuals. DPIAs also help to better understand how the data processing is changing in practice. Our Report, along with the replies received from our survey, allows the EDPS to provide further guidance on DPIAs in accordance with Article 39 of the Regulation applicable to EU institutions”. 

The nature of processing operations for which DPIAs are carried out varies widely, with the main reasons for conducting a DPIA being the processing of sensitive or highly personal data, personal data processed on a large scale or the innovative use or application of new technology.

The EDPS will carry out targeted surveys such as this one, more frequently in the future, as they are a useful way to monitor compliance with the Regulation.

In addition the EDPS has made available a video and factsheet as a guide and information tool on DPIAs.

EDPS Press Release

EDPS Report

DPIA video

DPIA Factsheet

On 24 June, the EDPS welcomed the European Commission’s General Data Protection Regulation (GDPR) review, assessing the application of the Regulation after two years of experience with it.  

The EDPS agrees with the Commission’s positive evaluation. The GDPR has strengthened the fundamental right to data protection, and contributed to raising awareness about the importance of data privacy, both within the EU and in other parts of the world. 

As mentioned by the Commission’s report, the consistent and efficient enforcement of the GDPR remains a priority. Resources available for the national data protection authorities (DPAs) are sometimes insufficient and there are some discrepancies caused by the different legal frameworks and national procedural laws.         

Wojciech Wiewiórowski, EDPS, said: “We now need a stronger expression of genuine European solidarity, burden sharing and a common approach to ensure the enforcement of our data protection rules. The outstanding success of the GDPR is the combination of many factors but the European data protection authorities’ ability to enforce EU rules is key, in particular if we want to address some harmful data practices by powerful global players. The EDPS stands ready to share its resources and expertise”. 

To accompany DPAs in their work, the EDPS shares the idea of setting up a Support Pool of Experts within the EDPB. This initiative could provide support to DPAs on complex and resource-demanding cases in a genuine expression of European solidarity and burden sharing. 

Read Press Release

The EDPS issued a decision on a complaint submitted against the European Parliament, concerning the access by a complainant’s to their evaluation results in an intelligible form.  

In the context of its inquiry, the EDPS obtained two versions of the evaluation results:

• the original version, with the assessment criteria and the complainant's respective scores;
• a heavily redacted version, without the assessment criteria and with only the complainant's scores visible.

The EDPS’ decision said that the complainant should also be given access to the specific assessment criteria, corresponding to the respective score obtained. Without them, the complainant would not be able to understand the results. 

The European Parliament argued that disclosing the assessment criteria would jeopardise the objectivity and secrecy of future selection procedures. Indeed, the same assessment criteria is likely to be used in other selection procedures.

To eliminate this risk, the EDPS recommended that the Parliament invite the complainant to their premises for an on-the-spot access to a slightly redacted version of the evaluations’ results, while presenting the information in an intelligible and transparent format.

The EDPS issued a decision on a complaint against the European Commission regarding the request to access the assessment criteria and reason for which a complainant had not been pre-selected in a recruitment procedure.

The selection procedure and pre-selection process by the Commission is done via a database in the context of a Call for expression of interest, launched by the European Parliament.

The EDPS initially found three breaches in accordance to Regulation (EU) 2018/1725.

Firstly, the Commission was in violation of Article 14 (3) as they did not meet the one-month deadline to reply to the complainant. Secondly, the Commission was also in violation of Article 14 (1) for not issuing a reply to the complainant in a comprehensive, intelligible and clear language. Finally, the Commission was in breach of Article 17, as it did not give the complainant access to the assessment criteria and reasons for not being pre-selected.

In its response, the Commission argued that the Call for expression of interest, the procedure and the database were annulled due to a judgment dated from 26 March 2019. The Commission therefore did not hold any further personal data of the complainant. Furthermore, being registered in the database or passing tests are not a guarantee of recruitment.

Subsequently, the EDPS made three points:  

• Regardless of whether the procedure was annulled, the complainant’s right of access is a continuous and permanent right. The processing of data had indeed occurred as the Commission had assessed the complainant’s application and information.
• For accountability purposes, the Commission should have kept a record of the documents and information on the complainant that had been processed during the pre-selection phase, including the reason for which they were not pre-selected. This should have been done by setting up a maximum retention period and the legitimate and necessary purposes for which the data was processed, such as complaints, access requests, audit/financial requirements.
• Although the Commission is not accountable for ensuring that all skilful candidates in the database are registered, it is, however, accountable for ensuring that the data protection rules and principles of the Regulation are duly applied, throughout the whole selection procedure, including the obligation to ensure that the candidates’ right of access is respected.