DATA PROTECTION IN THE MONTH OF JUNE 2023
By Mugurel Olariu, RPD protectie date
During its last online plenary meeting on 20 June, the EDPB adopted several documents, among which we mention a model complaint form to facilitate the submission of complaints by individuals and the subsequent handling of complaints by data protection authorities (DPA) in cross-border cases, respectively version 2.0 of the Recommendations on the elements of the Binding Corporate Rules1. *1
● Model forms: EDPB President Anu Talus said: “The template is one of the commitments EDPB members made during their April 2022 summit in Vienna to boost enforcement cooperation between DPA. It will facilitate the cross-border exchange of information on complaints between DPA’s and help DPA’s save time and resolve cross-border cases more efficiently.”
The model takes into account existing differences between national laws and practices. DPA will use it on a voluntary basis and can adapt it to their respective national requirements.
The model can be used both for cases where the complaint is filed by the natural person personally, and for cases where the complaint is filed by someone else, namely a legal representative, an entity acting on behalf of the natural person or an entity acting on its own behalf initiative.
In addition, the EDPB has also developed a model acknowledgment of receipt which aims to provide the complainant with general information on the next steps after submitting the complaint and highlights the right to an effective judicial remedy against a legally binding decision of an DPA.
● The EDPB has adopted a final version of the Recommendations on the application for approval and on the elements and principles found in the Controller Binding Corporate Rules (BCR-C)*. These recommendations form an update of the existing BCR-C reference, containing criteria for BCR-C approval, and merge it with the standard application form for BCR-C.
The purpose of these recommendations is to:
– provide an updated standard application form for the approval of BCR-Cs;
– clarification of the necessary content of the BCR-Cs and additional explanations;
– making a distinction between what needs to be included in a BCR-C and what needs to be presented to the lead BCR data protection authority in the BCR application.
The recommendations are based on the agreements reached by data protection authorities during the approval procedures of concrete BCR applications since the entry into force of the GDPR. The recommendations provide additional guidance and aim to ensure a level playing field for all BCR applicants. The recommendations also bring the existing guidelines in line with the requirements of the Schrems II judgment of the CJEU.
From the moment of publication, the reference is applicable to all BCR-C holders. In practice, all BCR-C holders as well as new and ongoing BCR-C applicants will be required to bring their BCR-C in accordance with the requirements set out in the guidance, either during the application process or as part of of the 2024 annual update, depending on their specific situation.
As far as we are concerned, we mention the fact that ANSPDCP adopted Decision no. 64/2023 by which the Accreditation Requirements of a code of conduct monitoring body were approved under art. 41 of Regulation (EU) 2016/679.
As a result of this decision, as we also announced during the CGES-2023 event, we are in the consultation stage of version 7 of the draft Code of Conduct, which we provided by e-mail to the five initiating professional associations – ROMBET, ROMSLOT, ROMANIAN BOOKMAKERS, AOPJNR and EXPROGAMES for the consultation of their members, with a view to finalization. After receiving any proposals and observations, we will submit the necessary documentation to the National Supervisory Authority for its approval.
––––––––––––––––––
*1 https://edpb.europa.eu/news/news/2023/edpb-adopts-template-complaint-form-and-final-version-recommendations-application_ro
