Positions of the EDPB on legislative proposals

Statement 1/2024 on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse
EDPB letter to the European Commission on adapting liability rules to the digital age and artificial intelligence (AI)
EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act)
EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery
EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act)
EDPB-EDPS Joint Opinion 2/2021 on standard contractual clauses for the transfer of personal data to third countries
EDPB-EDPS Joint Opinion 1/2021 on standard contractual clauses between controllers and processors
Opinion 15/2021 regarding the European Commission Draft Implementing Decision pursuant to Directive (EU) 2016/680 on the adequate protection of personal data in the United Kingdom
Opinion 14/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the United Kingdom
Statement 04/2021 on international agreements including transfers
Statement 03/2021 on the ePrivacy Regulation
Statement 02/2021 on new draft provisions of the second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention)
Recommendations 01/2021 on the adequacy referential under the Law Enforcement Directive
Statement on the protection of personal data processed in relation with the prevention of money laundering and terrorist financing - 15/12/2020
Statement on the ePrivacy Regulation and the future role of Supervisory Authorities and the EDPB - 19/11/2020
Statement on restrictions on data subject rights in connection to the state of emergency in Member States — 02/06/2020
EDPB Letter concerning the European Commission's draft Guidance on apps supporting the fight against the COVID-19 pandemic - 14/04/2020
Statement on the processing of personal data in the context of the COVID-19 outbreak - 19/03/2020
EU - U.S. Privacy Shield - Second Annual Joint Review report - 22/01/2019
Opinion 28/2018 regarding the European Commission Draft Implementing Decision on the adequate protection of personal data in Japan
Opinion 23/2018 on Commission proposals on European Production and Preservation Orders for electronic evidence in criminal matters
EDPB statement on ePrivacy - 25/05/2018
Adequacy Referential, WP 254 rev.01

Standardised Messenger Audit

27 June 2024

Support Pool of Expert projects

The Standardised Messenger Audit project aims at helping to inspect the messenger services used within businesses from a data protection perspective.

The EDPB launched the Standardised Messenger Audit project in the context of the Support Pool of Experts programme at the request of the German Federal Data Protection Authority (DPA).

Project completed by the external expert Prof. Mathieu Cunche in November 2023, who worked closely with the German Federal DPA, which provided significant input and feedback.

Objective

The project provides a test catalogue of mandatory, recommended, and optional requirements which a GDPR-compliant messenger frontend would have to meet. The catalogue may support data protection authorities in their work, but also companies that want to review and improve their product.

The Standardised Messenger Audit project includes two deliverables:

AI Auditing

27 June 2024

Support Pool of Expert projects

The AI Auditing project aims to map, develop and pilot tools that help evaluate the GDPR compliance of AI systems and applications are GDPR compliant.

The EDPB launched this project in the framework of the Support Pool of Experts programme, at the initiative of the Spanish Data Protection Authority (DPA).

Project completed by the external expert Dr. Gemma Galdon Clavell in February 2023.

Objective

This project helps all parties understand and assess data protection safeguards in the context of the AI Act. In particular, it may help DPAs to inspect AI systems by defining a methodology in the form of a check-list to perform an audit of an algorithm and proposing tools that would enhance transparency.

This project includes several deliverables:

Report on the use of SPE external experts

27 June 2024

Support Pool of Expert projects

Data Protection Officer training

27 June 2024

Support Pool of Expert projects

Under the Data Protection Officer (DPO) training project, data protection officers in Croatia were trained with the aim to raise the overall level of compliance of their organisations, especially in hospitals and educational institutions.

The EDPB launched the Data Protection Officer training project in the context of the Support Pool of Experts programme, at the request of the Croatian Data Protection Authority (DPA).

Project conducted by external expert Prof. Tihomir Katulić and completed in December 2023

The DPO training extensive programme was designed in Croatian with training material and Q&As for DPOs, it includes several deliverables:

AI Risks: Optical Character Recognition and Name Entity Recognition

27 June 2024

Support Pool of Expert projects

The AI risks project assesses the data protection risks of AI for Optical Character Recognition (OCR) and Name Entity Recognition (NER).

OCR is a technology used to convert images or scanned documents containing text into machine-readable text.
NER is used to identify named entities such as names, organizations and locations within a document and classify them into predefined categories.

The EDPB launched this project in the context of the Support Pool of Experts programme at the request of the EDPS.

Project completed by the external expert Isabel Barbera in September 2023.

Objective

This project helps data controllers who use AI for these purposes to perform an assessment of data protection risks and, data protection authorities to evaluate the validity and effectiveness of this assessment in the course of their investigations.
For both technologies, the external expert identified specific data protection and privacy risks posed by the procurement, the development and the use of the specific technology.

The AI Risks project includes several deliverables: