At its 58^th plenary on 14 December 2021, the EDPB adopted its response to the Commission’s evaluation of the Law Enforcement Directive, to which individual Supervisory Authorities (SAs) have also contributed.

The EDPB says that the past four years have been characterised primarily by national processes in transposing the Directive. Therefore, because of its recent implementation, there is limited experience and empirical data on some parts of the Directive. Therefore, the EDPB is of the opinion that it is too early to draw conclusions on its effectiveness or to consider its revision.

The EDPB strongly urges those Member States still in the phase of implementation to invest all means possible to ensure that the transposition is fully compliant with the Directive without any further delays.

In its response, the EDPB reaffirms its commitment to continue providing guidance on interpretation of the Directive. In addition, the EDPB says that it remains committed to providing independent assessments of future draft adequacy decisions as regards the requirements of the Directive, especially enforceable rights, effective redress and safeguards concerning onward transfers.

The EDPB also adopted the final version of its Guidelines on examples of data breach notifications, which complement the Article 29 Working Party guidance on data breach notification by introducing more practice orientated guidance and recommendations. They aim to help data controllers in deciding how to handle data breaches and what factors to consider during risk assessment. Following public consultation, the Guidelines were updated to reflect comments received.

Finally, the EDPB also adopted a reply to a letter from MEP Ujhelyi on hacking spyware Pegasus and agreed on the Support Pool of Experts project plan. To read the EDPB’s press release in full and for links to the relevant documents, click here.