Please note that the art policy. 29 WP is to publish on its website the correspondence it receives, as well as its response to that correspondence. If you do not want your correspondence or the answer of the art. 29 WP be published in whole or in part for reasons of business secrecy, personal data protection or other legitimate reasons, please indicate in advance the reason or reasons and parts of the correspondence for which this applies. It is shortly before 7pm on a Friday night and my team is doing their best to deal with the stress and frantic despair of our customers. Jokes about how they love Max Schrems are shared via email. In the meantime, we work assiduously through endless diagrams of data flow and try each […] Article 83 of the RGPD provides for two levels of management: a lower level – a maximum of EUR 10 million, or 2% of global turnover – for registration, data security, data protection analysis, data protection by design and default, and data processing agreements; and a higher level – up to 20 million euros, or 4% of global turnover – for violations of data protection principles, the legal basis of processing, information of the persons concerned, the prohibition of the processing of sensitive data, the denial of the rights of the persons concerned and the transfer of data to third countries. WP29 adopted the final versions of three documents, adopted in December 2016, that formalize the guidelines for DSB, data portability and lead authority. The material (notices, working papers, letters, etc.) of the Article 29 working group (Article 29 WP), available on this site, reflects only the views of Article 29 WP, which has an advisory status and acts independently. They do not reflect the position of the European Commission. The EU Working Group on Article 29 today issued a statement on the recent Schrems decision, which invalidated the adequacy of the EU-US Safe Harbor framework, which stresses that the companies concerned should start finding legal and technical solutions in a timely manner to comply with EU data protection standards.
The declaration set a deadline for companies until January 2016 to comply with the judgment and, on that date, EU data protection authorities would commit to “taking all necessary and appropriate measures, including coordinated enforcement measures.” In response, we publish here a high-level analysis of possible options for companies – including standard EU contractual clauses, intragroup agreements and other ad hoc contracts, binding business rules, Safe Harbour 2.0 and approval – and the pros and cons of selecting each. The Article 29 Data Protection Working Group shared the results of the discussions [direct link downloads .pdf] between European industry representatives, civil society, scientists and relevant associations, which took place at the second Fablab workshop on good practices and guidelines on valid consent, notifications of data breach and profiling. On 9 March, the COUNCIL of the EU adopted a partial general direction on a key chapter of the EU Data Protection Regulation, which has implications for the regulation of health data. The Council`s position has been welcomed by a number of health industry commentators as it favours a more flexible approach to the use of health data and is consistent with the content of the revised draft regulation tabled by the Commission last December. Territoriality will remain one of the most annoying problems with data regulation in 2018. One aspect of this debate is whether a U.S. judge can impose the disclosure of personal data in Europe without resorting to international contractual mechanisms. This issue is currently being considered by the U.S.
Supreme Court in United States v. Microsoft. In this case, the question is whether a U.S. state