European Data Protection Board holds Twelfth Plenary session

On 9 and 10 July 2019 the EDPB met for its twelfth plenary session at which various topics were discussed, including:

  • Guidelines on Video Surveillance: The EDPB adopted Guidelines on Video Surveillance, which clarify how the GDPR applies to the processing of personal data when using video devices. The Guidelines cover both traditional video devices and smart video devices. For the latter, the Guidelines focus on the rules on the processing of special categories of data. In addition, the Guidelines cover the lawfulness of processing, the applicability of the household exemption and the disclosure of footage to third parties. The Guidelines are open to public consultation. The deadline for responses is 9 September 2019;
  • EDPB-EDPS joint reply to the LIBE Committee on the implications of the US CLOUD Act: the EDPB adopted a joint EDPB-EDPS reply to the European Parliament Committee on Civil Liberties, Justice and Home Affairs’ (LIBE) request for a legal assessment regarding the impact of the US CLOUD Act on the EU legal data protection framework and the mandate for negotiating an EU-US agreement on cross-border access to electronic evidence for judicial cooperation in criminal matters. The CLOUD Act allows US law enforcement authorities to require the disclosure of data by service providers in the US, regardless of where the data is stored; and
  • Article 64 GDPR Opinion on the competence of a supervisory authority where an organisation moves or removes its main or single establishment: the EDPB adopted an Opinion on the competence of a Supervisory Authority when the circumstances relating to an organisation’s main or single establishment change. This can occur when the main establishment is relocated within the EEA, a main establishment is moved to the EEA from a third country, or when there no longer is a main or single establishment in the EEA. In such circumstances, the EDPB is of the opinion that the competence of the lead supervisory authority (LSA) can switch to another Supervisory Authority. In this case, the co-operation procedure set out in Article 60 GDPR will continue to apply and the new LSA will be obliged to cooperate with the former LSA and with the other interested Supervisory Authorities to reach consensus. The switch can take place as long as no final decision has been reached by the competent Supervisory Authority.

To read the EDPB’s press release in full, click here. To access the documents adopted by the EDPB, click here.