text: OJ L 295/39, 21/11/2018 2 OJ L 8/1, 12/01/2001 OJ L 119/1, 04/05/2016 4 Processing for law-enforcement purposes by competent authorities in the Member States is subject to the national implementation of Direction 2016/680 instead; OJ L 119/89, 04/05/2016. 5 E.g. Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679,

text: , available at: http://ec.europa.eu/newsroom/document.cfm?doc_id=44137

text: https://edps.europa.eu/data-protection/our-work/our-work-by-type/guidelines_en 7 Some of the larger EUIs have DPCs as local contact points in each Directorate-General (or similar). 8

text: Article 3(1)

text: (8) of the Regulation. 9 For these specific situations and many more (administrative inquiries, disciplinary proceedings, leave management and flexitime, medical data etc.), the EDPS has developed more detailed guidance, please see here: https://edps.europa.eu/data-protection/our-work/our-work-by-type/guidelines_en. The EDPS will update those documents to adapt them to the new rules.

text: There may be cases in which the business owner relies on input from other parties; for example, the head of a business unit for which the IT department develops an application: there may be questions for which the business owner has to seek input from IT, but still, the business owner is responsible for the system as a whole.

text: See Consultation concerning certain clauses that a contractor wants to include in service contracts to align with the conditions set forth by

text: Regulation (EU) 2016/679

text: , https://edps.europa.eu/data-protection/ourwork/publications/consultations/consultation-concerning-updating-service_en. Template clauses to use in such contracts have been distributed to the DPOs. 12 EDPS Guidance on Articles 14-16 of the new Regulation 45/2001: Transparency rights and obligations, available at: https://edps.europa.eu/data-protection/our-work/publications/other-documents/articles-14-16-newregulation-452001_en.

amnesord:
Regulation 2018/1725
Necessity & Proportionality
Privacy by Design
Accountability

publisher: Europeiska datatillsynsmannen

sprak: en

serie: riktlinjer

text: Accountability on the ground: Guidance on documenting processing operations for EU institutions, bodies and agencies Summary

type: rubrik

text: v1.3 July 2019

type: stycke

text: 1 | P a g e

text: 1 Accountability on the ground

text: When processing information about people (‘personal data’), we in the EU institutions, bodies and agencies (EUIs) have to comply with certain rules to protect the privacy of those whose data we process. This is true whether this is about our own staff, beneficiaries, contractors or any other person.

text: Regulation (EU) 2018/1725

text: (‘the Regulation’) lays down the rules for the EUIs. In a nutshell, those rules tell you to: (1) have a good reason for processing people’s data; (2) tell them about it; (3) be accountable for both what you do and why you do it. The main players are you in the EUIs who are accountable for the processing of personal data (‘controllers’). You are accountable for what you do and why you do it the way you do it. This implies being compliant, but also being able to demonstrate it. The best way to do that is to follow a structured approach to designing and documenting processing operations. This also means that you have to think about this already when you design new processes (‘privacy by design’). The European Data Protection Supervisor (EDPS) toolkit Accountability on the ground: Guidance on documenting processing operations for EU institutions, bodies and agencies provides such guidance, summarised in this brochure. This process for designing and documenting processing operations is not an end in itself, but a means to an end: being transparent, compliant and accountable. The Regulation builds on earlier rules enacted in 2001 (

text: Regulation (EC) No. 45/2001

text: - ‘the old Regulation’) and mirrors the General Data Protection

text: Regulation (EU) 2016/679

text: (GDPR) that applies to most organisations processing personal data (‘controllers’) in the Member States – be they public administrations, businesses, charitable associations or other organisations. Compared to the previous rules, the new Regulation aligns your documentation obligations more closely to the risks caused by processing personal data. This means for example that the documentation requirements for your EUI’s newsletter subscription will be lower than for a system using ‘intelligent CCTV’ covering publicly accessible space. These rules also take into account the status of data protection as a fundamental right under Article 8 of the EU Charter of Fundamental Rights. The EUIs have to lead by example on fundamental rights, including data protection. The EDPS, the supervisory authority checking how EUIs process personal data, provides extensive guidance on many aspects of compliance with these rules. This toolkit addresses the specific situation of EUIs under the EDPS’ supervision, but it is in line with the principles of the GDPR and the guidance given by the

text: Article 29

text: Working Party (WP29) and the European Data Protection Board (EDPB). We will update it to stay consistent with the EDPB’s interpretation of the GDPR where necessary. It may thus also be of interest

text: 2 | P a g e

text: for controllers, data protection officers (DPOs) and other interested parties outside the EUIs. As the rules for the EUIs are equivalent to those in the GDPR, they should be interpreted the same way as well. For this reason, we occasionally refer to the GDPR as well. If you want to know more, talk to your EUI’s DPO and have a look at the toolkit – whenever you see square brackets in this brochure, the references in there tell you where in the toolkit to find more information. For further guidance on other topics, such as when and how to inform people that you’re processing their data or on data protection aspects of specific business processes (recruitment, staff evaluation, administrative inquiries and disciplinary proceedings, etc.) please check the EDPS website.

text: 2 Target audience, scope, and relationship to other documents

text: The target audience of this toolkit are controllers and staff responsible on their behalf, DPOs, data protection coordinators (DPCs) , and everyone else involved in the development and management of personal data processing activities in the EUIs. In the EUIs, the controller is, legally speaking, the ‘Union institution, body, office or agency or the Directorate-General or any other organisational entity which, alone or jointly with others, determines the purposes and means of the processing of personal data’.

text: In this toolkit, ‘you’ refers to the ‘person responsible on behalf of the controller’ or ‘controller in practice’ (business owner) of an existing processing operation or the project owner for activities in development.

text: This toolkit provides guidance on how to comply with the Regulation concerning the necessary data protection documentation and risk assessments for ‘risky’ processing operations. It covers the following aspects and provides templates for most of them:  how to document your processing activities;  when to do data protection impact assessments (DPIAs);  how to do DPIAs;  when to send DPIAs to the EDPS for prior consultation;  who does what in the above processes;  transition rules from the old data protection regulation for EU institutions.

text: This toolkit does not cover:  the role of DPOs in general;  how, in detail, to deal with specific processing operations, such as transfers of personal data outside the EU or specific processes, such as staff selection & recruitment. This toolkit gives you guidance on thinking about managing data protection and privacy risks for a business process in your organisation and how to document this. For specific suggested

text: 3 | P a g e

text: controls to implement e.g. in selection procedures, please refer to the guidelines per processing operation.

text: 3 The accountability process

text: Accountability means that the controller is in charge of ensuring compliance and being able to demonstrate that compliance. In practice, top management is accountable for compliance with the rules, but responsibility is usually assumed at a lower level (business owner). The business owner / person responsible on behalf of the controller for a process will be the main driver, assisted by the DPO and DPCs (Part I - Section 2, Part II - Section 2).

text: For most processing operations in your organisation, keeping records and doing a compliance check will be enough. Only some processing operations will require a DPIA. Out of those, only some will also require prior consultation.

text: Demonstrating your compliance means documenting how you process personal data and why you chose to do it the way you do it. Your documentation obligations depend on the risks posed by the nature of the processing of personal data – a newsletter subscription service will require far less documentation than a database profiling travellers for risk screening purposes. How you design a process also affects this – staff appraisal based on a simple evaluation interview with the reporting officer will require less documentation than a system automatically generating comparative metrics from a case management system and using these as input for the staff appraisal procedure.

text: Compliance check and records of processing (for all processing operations)

text: Depending on the process at hand, you may not have to go through all the steps below:  Generate basic documentation (called ‘records’) for all processes; use this opportunity to also do a compliance check;  check if the process is likely to result in high risks to the people whose data you process and consult your DPO if it appears to do so;  If you need to do a DPIA, you analyse those risks in more detail and develop specific safeguards/controls to manage them;  If the results of the DPIA still indicate high residual data protection risks, you have to consult the EDPS. The first two steps are covered in Part I of the toolkit, the last two in Part II.

text: 4 | P a g e

text: 4 What are records? [Part I - Section 3]

text: You have to keep some basic documentation for all your processing operations, called records. The Regulation gives you a list of items to include in the records [Part I - Section 3.1]. When you create a record, you should also check whether your processing is compliant with the rules [Part I - Section 3.2]. See [Part I - Annex 1] for a template you may use for this. For creating these records, you can base yourself on the already existing notifications in your EUI [Part I - Section 5]. Once you have created these records, make sure you keep them up-to-date [Part I - Section 3.3]. These records feed into a central register kept by your EUI and managed by the DPO [Part I - Section 3.4]. The DPO is best-placed to be the guardian of this register, but you as business owner remain responsible for the content of the records you generated. Certain information in this register has to be public [Part I - Section 3.5]. This is the data protection documentation required for most processing operations.

text: 5 When to carry out a Data Protection Impact Assessment? [Part I - Section 4]

text: However, some ‘risky’ processing operations require further attention. This covers for example processing large amounts of sensitive personal data, such as health data, data relating to disciplinary matters or using profiling techniques, just to give a few examples. There are two questions that you should ask to yourself in order to know if your have to do a DPIA.  Is it listed on the list issued by the EDPS under Article 39(4) of the Regulation?  Does the threshold assessment confirm the need for a DPIA?

text: 5 | P a g e

text: If the answer to any of these three question is ‘yes’, you should do a DPIA. The EDPS provides a template for you to use for this threshold assessment and has adopted a list under Article 39(4) of the Regulation with the criteria to be used and an indicative list of some ‘usual suspects’ of ‘risky’[Part II - Annex 5].

text: 6 How to carry out Data Protection Impact Assessments? [Part II - Section 3]

text: Under the Regulation, you have to conduct DPIAs for processing operations likely to result in ‘high risks’ to the people whose data you process. The EDPS does not impose a specific methodology for doing so, but provides templates you may use for doing DPIAs [Part II - Annex 3]. If you do not want to use these templates, you can use any methodology that complies with the requirements of the Regulation [see a nonexhaustive list in Part II - Annex 4.1]. In a DPIA, you analyse your planned processing operations in more detail to see where the privacy risks are and how you can mitigate them. This is more than information security risk management. Once you have done this for the first time, you will have a DPIA report explaining your processing operation, the risks identified and the controls (to be) implemented. DPIAs are an ongoing process, not a one-time exercise – review them when your processing operations change significantly and in any case in regular intervals to keep them up to date [Part II - Section 3.8]. It is a good practice to publish your DPIA reports, at least in summary form. Publication allows displaying the work that has gone into making processing operations compliant and can foster trust with your stakeholders and the public at large [Part II - Section 3.9].

text: 7 When to do a prior consultation [Part II - Section 4]

text: In a DPIA report, you have in the end three possible outcomes: (1) You are confident that the controls chosen in the DPIA are sufficient to reduce risks to an acceptable level. In this case, implement them and go on with the project; (2) You conclude that the controls analysed cannot reduce the risks to an acceptable level. If this happens, you should abandon the project or re-design it, as it has proven impossible to implement in a compliant way; (3) You are not sure whether the controls you analysed and chose are sufficient for reducing the risks to an acceptable level. In this third case, you then have to proceed to ‘prior consultation’ of the EDPS (Article 40 of the Regulation). The European Commission may also adopt implementing acts listing kinds of processing operations that always require prior consultation. You will need to provide your DPIA and some other information to the EDPS [Part II - Section 4]. The EDPS will reply within 8 weeks; for extremely complicated cases, we can extend that deadline by another 4 weeks. In case we need further information from you, such requests suspend this deadline. In the reply, the EDPS will provide recommendations for improving compliance where appropriate.

text: 8 How to get ready? [Part I - Section 5; Part II - Section 5]

text: Your EUI already has a certain amount of data protection documentation, so there is no need to start from zero. For generating records, you can start from the notifications you sent to

text: 6 | P a g e

text: your DPO under the old

text: Regulation (EC) No 45/2001

text: [Part I - Section 5]. If your notifications are up-to-date, then converting them into records should not be a lot of work. Concerning the more risky processing operations requiring DPIAs, many of them will have been subject to ‘prior checking’ under the old Regulation [Part II - Section 5].

text: There are also other changes coming your way with the new Regulation. For example, you will have to keep a closer eye on your contractors and will most likely need to update your data protection notices.

text: 9 What can your DPO do for you?

text: In every EUI, there is at least one Data Protection Officer (DPO), acting as a reference point for all matters related to data protection. In some larger EUIs, you also have Data Protection Coordinators/Contacts (DPCs) per Directorate-General. They can provide you with input on how to generate records and carry out DPIAs. If you have any questions on data protection, please contact them. However, always remember that compliance is the controller’s obligation. DPOs also act as the main contact point between the EUIs and the EDPS – whenever you want to ask the EDPS something, please channel this through your DPO. In many cases, they will already know the answer.

text: 10 What can the EDPS do for you?

text: The EDPS is the supervisory authority for the processing of personal data by the EUIs. As such, we monitor and check compliance with the data protection rules - whether in response to complaints, in inspections, in reply to consultations sent by EUIs, or on our own initiative. We provide guidelines on how to be compliant, based on our experience, as well as training to help you become a leader on data protection and implement best practices. Apart from this supervisory role, the EDPS also acts as an advisor to the EU legislator on new rules dealing with the processing of personal data, such as proposals for legal acts establishing new EU databases. We also provide the secretariat for the European Data Protection Board, the forum in which the European data protection authorities cooperate on cross-border issues.

text: 7 | P a g e

type: vagledning

utgivare: edps


text: THE EUROPEAN DATA PROTECTION SUPERVISOR, Having regard to

text: Regulation (EU) 2018/1725

text: on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , and in particular

text: Articles 39(4)

text: and (5) thereof, Having consulted the European Data Protection Board, Whereas: (1) The EU institutions, bodies, offices and agencies process large amounts of personal data about natural persons both inside and outside the institutions. This processing, even when done lawfully, may cause risks to the rights and freedoms of such persons. Data protection rules serve to ensure that personal data are processed responsibly in a way that minimises these risks. Documentation obligations scale with these risks – ‘riskier’ processing operations demand a more detailed analysis. (2) Data Protection Impact Assessments (DPIAs) are a new concept in

text: Regulation (EU) 2018/1725

text: (‘the Regulation’). They are a structured process for managing data protection risks of certain processing operations causing ‘high risks’ to data subject and are not necessary for all kinds of processing operations. (3) In accordance with Article 39(1) of the Regulation, ‘where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data’. (4) Under Article 39(4) of the Regulation, the EDPS ‘shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment’. (5) Under Article 39(5) of the Regulation, the EDPS ‘may also establish and make public a list of the kind of processing operations for which no data protection impact assessment is required’. (6) Under Article 39(6) of the Regulation, the EDPS shall, prior to their adoption, submit draft lists under

text: Article 39(4)

text: and (5) to the European Data Protection Board (EDPB) for examination under point (e) of

text: Article 70(1) of Regulation (EU) 2016/679

text: where ‘they refer to processing operations by a controller acting jointly with one or more controllers other than Union institutions and bodies.’

text: OJ L 295, 21.11.2018, p. 39-98. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 - B-1000 Brussels E-mail: edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 32 2-283 19 00 - Fax: 32 2-283 19 50

text: HAS ADOPTED THIS DECISION:

text: Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is "likely to result in a high risk" for the purposes of Regulation 2016/679, wp248rev.01, adopted 4 April 2017, as last revised and adopted on 4 October 2017. 3 EDPB Endorsement 1/2018. 4 Accountability on the ground: Provisional guidance on documenting processing operations for EU institutions, bodies and agencies, initial version published 6 February 2018. 5 Recommendation 01/2019 on the draft list of the European Data Protection Supervisor regarding the processing operations subject to the requirement of a data protection impact assessment (

text: Article 39.4 of Regulation (EU) 2018/1725

text: I Header

text: Name of processing operation [name] Controller contact point [function and contact details] Record of processing operations [record reference] DPO consultation [date of feedback] Approval [name and date]

text: II Criteria for processing ‘likely to result in high risk’

text: Criterion Applicable? Yes [if so, describe how] / No [if borderline: why not?]

text: Systematic and extensive evaluation of personal aspects or scoring, including profiling and predicting. [Y (how?) / N] Examples: a bank screening transactions in accordance with applicable law to detect possibly fraudulent transactions; profiling staff based on their transactions in a case management system with automatic reassignment of tasks. Counterexamples: standard appraisal interviews, voluntary 360° evaluations for helping staff to develop training plans. 2. Automated-decision making with legal or similar significant effect: processing that aims at taking decisions on data subjects [Y (how?) / N] Example: automated staff appraisal (‘if you’re in the lowest 10% of the team for the number of cases dealt with, you’ll receive a “unsatisfactory” in your appraisal, no discussion’). Counterexample: a news site showing articles in an order based on past visits of the user. 3. Systematic monitoring: processing used to observe, monitor or control data subjects, especially in publicly accessible [Y (how?) / N] spaces. This may cover video-surveillance but also other monitoring, e.g. of staff internet use. Examples: covert CCTV, smart CCTV in publicly accessible spaces, data loss prevention tools breaking SSL encryption, tracking movements via location data. Counterexample: open CCTV of garage entry not covering public space.

text: Sensitive data or data of a highly personal nature: data revealing ethnic or racial origin, political opinions, religious or [Y (how?) / N] philosophical beliefs, trade-union membership, genetic data, biometric data for uniquely identifying a natural person, data concerning health or sex life or sexual orientation, criminal convictions or offences and related security measures or data of highly personal nature. Examples: pre-recruitment medical exams and criminal records checks, administrative investigations & disciplinary proceedings, any use of 1:n biometric identification. Counterexample: photos are not sensitive as such (only when coupled with facial recognition / biometrics or used to infer other sensitive data). 5. Data processed on a large scale, whether based on number of people concerned and/or amount of data processed about each [Y (how?) / N] of them and/or permanence and/or geographical coverage: Example: European databases on disease surveillance. Counterexample: invalidity procedures under Article 78 of the Staff Regulations in a medium-sized EUI .

text: Datasets matched or combined from different data processing operations performed for different purposes and/or by [Y (how?) / N] different data controllers in a way that would exceed the reasonable expectations of the data subject. Examples: cross-checking access control data and self-declared working hours following a suspicion of fraudulent declarations in an administrative inquiry (following the applicable rules). Counterexample: further use of data processed for a grant application when auditing the grant process.

text: Data concerning vulnerable data subjects: situations where an imbalance in the relationship between the position of the data [Y (how?) / N] subject and the controller can be identified. Examples: children, asylum seekers. Counterexamples: delegates in a Council Working Party (for attendance lists), members of expert groups (for travel cost reimbursement).

text: Innovative use or applying technological or organisational solutions that can involve novel forms of data collection and [Y (how?) / N] usage. Indeed, the personal and social consequences of the deployment of a new technology may be unknown. Examples: machine learning, connected cars, social media screening of job applicants. Counterexample: 1:1 biometric access control using fingerprints.

text: Preventing data subjects from exercising a right or using a service or a contract. [Y (how?) / N] Examples: exclusion databases, credit screening. Counterexample: determination of rights upon entry into service (e.g. expatriation or dependent child allowances).

text: III Conclusion

text: Number of ‘Yes’ ticked above [n] Assessment: In general, if you tick two or more of the criteria in the list, you should carry out a DPIA. If you consider that in [explain] the specific case at hand, risks are not ‘high’ even though you have two or more ‘yes’, explain and justify why you think the processing is in fact not ‘high risk’.

text: Some procedures resulting in adding information to the personal file may require DPIAs, but not the repository of personal files as such. 7 E.g. badges to be swiped at entry points.

identifier: EDPS riktlinjer (2019)

amnesord:
Regulation 2018/1725
Accountability

title: Data Protection Impact Assessment List

text: (7) As there should be no difference in treatment between situations in which Union institutions or bodies are joint or sole controllers and situations in which they are joint controllers with one or more controllers other than Union institutions and bodies, the EDPS has decided to establish a single list for Article 39(4). However, the Article 39(5) list covers only situations in which Union institutions or bodies are joint or sole controllers without the involvement of controllers other than Union institutions and bodies, because the processing operations listed there relate to Union institutions' or bodies' processing for their internal management. (8) In accordance with recital 5 of the Regulation, ‘whenever the provisions of this Regulation follow the same principles as the provisions of

text: Regulation (EU) 2016/679

text: , those two sets of provisions should […] be interpreted homogeneously, in particular because the scheme of this Regulation should be understood as equivalent to the scheme of

text: Regulation (EU) 2016/679

text: ’. (9) Already before the applicability of

text: Regulation (EU) 2016/679

text: , the

text: Article 29

text: Working Party has provided guidelines on Article 35 of that Regulation , which follows the same principles as Article 39 of the Regulation. These guidelines included a set of the criteria to be used in determining ‘high risk’. During its first plenary meeting the EDPB endorsed the GDPR-related WP29 Guidelines. (10) These guidelines confirmed that such lists could not be exhaustive, but would list the criteria for assessing whether there are likely to be high risks for data subjects. Any specific processing operations mentioned are only illustrative examples. If a specific processing operation is not listed in Annex 2 that does not mean that no DPIA is necessary. Conversely, if a processing operation is not listed in Annex 3 that does not mean that a DPIA is necessary. (11) In February 2018, the EDPS has published provisional guidance on documentation obligations under the – at that time not yet adopted – Regulation. This included first indications of which kinds of processing operations would require a DPIA, following the guidance published by the

text: Article 29

text: Working Party and later endorsed by the EDPB. The present list builds on the guidance given to controllers in that document. (12) The draft list has been submitted to the EDPB on 18 March 2019; an updated version has been submitted on 21 June 2019. The EDPB issued its reply on 10 July 2019 . The final list as adopted takes into account all EDPB recommendations. (13) The European Commission may adopt implementing Acts for Article 40(4) of the Regulation, establishing a list of cases in which the controllers shall consult with, and obtain prior authorisation from the EDPS. For the EDPS to have a solid basis for deciding on such consultation and authorisation, the controller should carry out a DPIA in those cases as well.

text: Article 1

text: Subject matter and objectives

text: 1. This Decision further explains in which controllers subject to

text: Regulation (EU) 2018/1725

text: have to conduct data protection impact assessment (DPIA) under Article 39 of that Regulation.

text: 2. This Decision is without prejudice to the rules on data protection impact assessments and prior consultation in Articles 39 and 40 of that Regulation.

text: Article 2

text: Scope and definitions

text: 1. This Decision applies to all controllers subject to

text: Regulation (EU) 2018/1725

text: . 2. For the purposes of this Decision, the definitions in

text: Article 3 of Regulation (EU) 2018/1725

text: shall apply.

text: Article 3

text: 1. When assessing whether their planned processing operations trigger the obligation to conduct a DPIA under

text: Article 39 of Regulation (EU) 2018/1725

text: , the controller shall use the template in Annex 1 to this Decision to conduct a threshold assessment. 2. Where two or more of the criteria in the template in Annex 1 are applicable, the controller shall in general carry out a DPIA.

text: 3. If a controller decides not to carry out a DPIA, although more than one criterion in the template in Annex 1 is applicable, the controller shall document and justify that decision.

text: 4. If planned processing operations only trigger one criterion in the template in Annex 1, the controller may still decide to carry out a DPIA.

text: 5. Annex 2 to this Decision lists some common processing operations likely to require a DPIA. In those cases, the controller does not have to conduct a threshold assessment, but shall directly conduct a DPIA.

text: Article 4

text: Where the European Commission adopts implementing acts for

text: Article 40(4) of Regulation (EU) 2018/1725

text: obliging controllers to consult with, and obtain prior authorisation from, the EDPS, controllers shall also carry out DPIAs for processing operations listed in such implementing acts.

text: Article 5

text: Annex 3 to this Decision lists some common processing operations prima facie unlikely to require a DPIA.

text: Article 6

text: Non-exhaustive character of the lists

text: The lists of processing operations annexed to this Decision are non-exhaustive.

text: Article 7

text: Entry into force

text: This Decision shall enter into force the day following its publication.

text: For the European Data Protection Supervisor

text: [signed] Wojciech Rafał WIEWIÓROWSKI

text: Annex 1 List of criteria for assessing whether processing operations are likely to result in high risks

text: In general, if two or more of the criteria in the list apply, the controller should carry out a DPIA. If the controller considers that in the specific case at hand, risks are not ‘high’ even though there is more than one ‘yes’, the controller has to explain and justify why they think the processing is in fact not ‘high risk’. Each criterion is followed by some examples and counterexample on what would likely (not) trigger each criterion.

text: Annex 2

text: Non-exhaustive list of some common processing operations and prima-facie indications of

text: their risks

text: Positive list of processing operations prima facie requiring a DPIA (the numbers inside the

text: brackets refer to the criteria in the template threshold assessment in Annex 1 such processing operations will likely trigger):  Exclusion databases (2, 4, 9);  large-scale processing of special categories of personal data (such as disease surveillance, pharmacovigilance, central databases for law-enforcement cooperation) (1, 4, 5, 8);  internet traffic analysis breaking encryption (data loss prevention tools) (1, 3, 8);  e-recruitment tools automatically pre-selecting/excluding candidates without human intervention (1, 2, 8).

text: Annex 3

text: Non-exhaustive list of some common processing operations not requiring a DPIA

text: Indicative list of processing operations prima facie not requiring a DPIA when carried out by Union institutions, bodies, offices and agencies acting as sole or joint controllers:

text:  Management of personal files under Article 26 of the Staff Regulations as such ;  Standard staff evaluation procedures under the Staff Regulations (annual appraisal);  Standard 360° evaluations for helping staff members develop training plans;  Standard staff selection procedures;  Establishment of rights upon entry into service;  Management of leave, flexitime and telework;  Standard access control systems (non-biometric) ;  Standard CCTV on a limited scale (no facial recognition, coverage limited to entry/exit points, only on-premises, not in public space).


text: Fig. 1 Timeline foreseen in the Withdrawal Agreement

text: Fig. 2 Timeline in case of a no-deal Brexit

text: On the 7 May 2019, the UK government confirmed that it will hold European Parliament elections and therefore the UK will not leave the EU on 1 June 2019.

text: EDPS, The transfer of personal data to third countries and international organisations by EU institutions and bodies, Position Paper, p. 20-22. 3 See the following communication of the European Commission http://europa.eu/rapid/press-release_MEMO- 05-3_en.htm.

text: Article 29

text: Data Protection Working Party, Working Document setting up a table with the elements and principles to be found in Binding Corporate Rules,

text: WP 256

text: rev. 1, 28 November 2017, available on the EDPB website.

text: See also EDPB, Guidelines 2/2018 on derogations of

text: Article 49

text: under Regulation 2016/679, regarding the similar provisions of the General Data Protection Regulation (GDPR).

text: * Binding corporate rules and standard contractual clauses (adopted by the EC) under the old Directive 95/46 are still valid, but will need to be updated over time in line with the GDPR. In any case, before using old EC standard contractual clauses you should make sure to adapt them to

text: Regulation (EU) 2018/1725

text: [EU DPR].

title: International data transfers after Brexit

text: 16 July 2019

text: 1. Background information

text: According to the current state of play, the UK including Northern Ireland will leave the EU on 1 November 2019 at 00.00 am CET and will become a third country .

text: In case the EU and the UK sign the withdrawal agreement (Title VII), as negotiated by the end of 2018, before 1 November 2019, the data flows to the UK will not be immediately affected. The withdrawal agreement provides for the application of EU data protection law until 31 December 2020, and this period may be extended for another two years. The General Data Protection Regulation (GDPR), the law enforcement

text: Directive (EU) 2016/680

text: , the ePrivacy Directive and any other provisions governing the protection of personal data are considered as Union data protection law.

text: However, a no-deal Brexit scenario would have repercussions for the protection of personal data. This is because the EU primary and secondary law, including the data protection law, will cease to apply in the UK. Personal data transfers to the UK will be subject to specific conditions with which Union institutions and bodies (EUIs) need to comply. Some institutions and bodies are already familiar with the available data transfer mechanisms, as they are already transferring data to third countries outside the EEA.

text: The EDPS builds upon the guidance provided on this matter by the European Commission and by the European Data Protection Board.

text: 1 | P a g e

text: 2. Data transfers from Union institutions and bodies to the UK in case of no-deal Brexit

text: In case of a no-deal Brexit the flow of data from EUIs to the UK and Northern Ireland will be subject to the requirements for international data transfers as laid down in Chapter V of

text: Regulation (EU) 2018/1725

text: (EU DPR). For example, if an EUI outsources mission trips management or IT services to a processor in the UK, legal safeguards will be required for the personal data transferred to the UK.

text: 2.1. International data transfers mechanisms

text: The EU DPR provides that a data transfer to a third country, such as the UK, shall not undermine the level of protection guaranteed by this Regulation (

text: Article 46

text: ). This level of protection shall be maintained for onward transfers, i.e. transfers from the third country, such as the UK, to another third country or international organisation. For this purpose, the EU DPR lays down a series of mechanisms which the controllers and processors may choose to enable the transfer to a third country. It is up to them to assess which of the available mechanisms best reflects their situation.

text: 2.1.1 Adequacy decisions

text: A transfer of personal data to a third country can take place when the European Commission has recognized this third country as offering an adequate level of protection (

text: Article 47

text: ). The effect of such an adequacy decision is that personal data can flow from the EUIs to that third country as if the transfer takes place within the EU/EEA. However, no such recognition of the UK legal framework will be in place before the UK leaves the EU and relevant negotiations will require time. Therefore, EUIs shall consider adopting other transfer mechanisms from the ones provided in Chapter V.

text: 2.1.2 Appropriate safeguards

text: There are a series of data transfer mechanisms adducing appropriate safeguards.

text: Article 48

text: EU DPR lists all ‘appropriate safeguards’. A common feature of all is the condition that they must provide for enforceable and effective data subjects rights.

text: a. Instruments exclusively available to public authorities

text: EUIs as public authorities may consider to use the mechanisms which the EU DPR considers more apt to their situation (

text: Article 48(2)

text: (a) and (3)(b)). One option is to use a legally binding and enforceable instrument, such as an administrative agreement, a bilateral or multilateral international agreement. The agreement must be binding and enforceable for the signatories. The second option is to use administrative arrangements, such as Memoranda of Understanding. Although not legally binding themselves, they shall however provide for enforceable and effective data subject rights. The non-binding administrative arrangements are subject to an authorisation by the EDPS.

text: 2 | P a g e

text: b. Standard Data Protection Clauses

text: In case EUIs are interacting with private entities (for instance, outsourcing mission trips management, IT services or training) , they may consider signing standard data protection clauses adopted by the European Commission. These contracts offer the additional adequate safeguards with respect to data protection that are needed in case of a transfer of personal data to any third country. Three sets of standard data protection clauses are currently available (remaining valid under the GDPR until amended, replaced or repealed by a Commission decision):

text:  EU controller to third country (non EU/EEA) controller (e.g. UK): 2 Sets are available: o

text: o

text:  EU controller to third country (non EU/EEA) processor (e.g. UK): o

text: It is important to note that the standard data protection clauses may not be modified and must be signed as provided. However, these contracts may be included in a wider contract and additional clauses might be added provided that they do not contradict, directly or indirectly, the standard data protection clauses adopted by the European Commission . Any further modifications to the standard data protection clauses will imply that this will be considered as ad-hoc contractual clauses which will require a prior authorisation by the EDPS (analysed under e). Finally, the EU DPR provides for the possibility of standard data protection clauses adopted by the EDPS and approved by the Commission. So far such clauses have not been adopted.

text: c. Binding Corporate Rules

text: Binding Corporate Rules are personal data protection policies adhered to by a group of undertakings (ie. multinationals) in order to provide appropriate safeguards for transfers of personal data within the group, including outside of the EU/EEA. In case the processor of a specific activity is not an EUI, he may already make use of BCRs for processors (these binding corporate rules apply to data received from a controller established in the EU, which is not a member of the group, and then processed by the concerned group members as processors and/or sub-processors) . BCRs authorised under the former Directive

text: remain valid under the GDPR (

text: Article 46(5)

text: ) and are considered as a transfer mechanism adducing adequate safeguards according to the EU DPR (Art. 48(2)(d)). However, they need to be updated in order to be fully in line with the GDPR provisions. Future Binding Corporate Rules must be approved by the competent national supervisory authority, following an opinion of the EDPB (Article

text: and

text: GDPR), prior to any transfer.

text: d. Codes of conduct and certification mechanisms

text: 3 | P a g e

text: In the event that the processor is not an EUI, codes of conduct or certification mechanisms, as provided in GDPR, can be used in order to offer appropriate safeguards for transfers to a third country. These tools are new under GDPR and therefore the work of the EDPB, which is currently working on guidelines in order to further clarify the content and the use these tools, should be closely followed.

text: e. Ad hoc contractual clauses

text: In case EUIs are interacting with private entities, they can also make use of ad-hoc contractual clauses they negotiate with UK counterparts in order to provide appropriate safeguards taking into account their particular situation. Prior to any transfer, these tailored contractual clauses must be authorised by the EDPS (Art. 48(3)(a) EU DPR).

text: 2.1.3 Derogations

text: In the absence of an adequacy decision, EUIs should first consider providing adequate safeguards, framing the transfer of personal data with one of the mechanisms mentioned under 2.1.2.

text: Derogations provided in

text: Article 50

text: EU DPR are exemptions from the general principle that personal data may only be transferred to third countries if an adequate level of protection is provided for in the third country or if appropriate safeguards have been adduced and the data subjects enjoy enforceable and effective rights. Furthermore, transfers based on a derogation are not required to have any kind of prior authorisation from the EDPS, leading to increased risks for the rights and freedoms of the data subjects concerned. Therefore, derogations must be interpreted restrictively and mainly relate to processing activities that are occasional and non-repetitive.

text: Derogations are exhaustively mentioned in

text: Article 50(1)

text: EU DPR and include data transfers:  where an individual has explicitly consented to the proposed transfer after having been provided with all necessary information about the risks associated with the transfer;  where the data transfer is necessary for the performance of a contract to which a data subject is a part or for the implementation of pre-contractual measures;  where the data transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person;  where the data transfer is necessary for important reasons of public interest;  where the data transfer is necessary for the establishment, exercise or defence of legal claims;  where the data transfer is necessary for the protection of the vital interests of the data subject or of other persons and the data subject is physically or legally incapable of giving consent and

text: 4 | P a g e

text:  where a transfer is made from a public register.

text: 3. Data transferred before the withdrawal date

text: The European Commission in the Position Paper on the Use of Data and Protection of Information Obtained or Processed before the withdrawal date concludes that UK based controllers and processors may continue to process personal data transferred before the withdrawal date only if these data enjoy the protection of EU data protection law. Such protection will be guaranteed, in case that a Withdrawal Agreement is put in place. The developments on this sensitive issue should be closely followed and the EDPS may provide further guidance if is deemed necessary.

text: 4. Steps to take in order to be prepared

text: In order to be prepared for the case of no-deal Brexit, EUIs should take the following steps: i. map their processing activities; ii. check the available data transfers mechanism that best suits their situation; iii. implement the chosen data transfer mechanism before 1 June or 1 November 2019; iv. update their internal documentation; v. update their data protection notice accordingly.

text: 5 | P a g e

text: 4.1. In brief: steps to take in order to be prepared for a no-deal Brexit

text: 6 | P a g e