22-24 November 2023
A workshop of the EU Member States’ personal data protection supervisory authorities on the evaluation of certification criteria/certification schemes took place in Luxembourg within the Compliance, E-government and Health Expert Subgroup of the European Data Protection Board (EDPB), in the framework of the consistency mechanism under the General Data Protection Regulation (GDPR).
This workshop is a follow-up to a similar workshop held in Madrid in March. The first workshop assessed various aspects of the evaluation of certification schemes that have been the most controversial in practice, thus aiming to ensure a uniform evaluation mechanism across the European Economic Area (EEA). In Luxembourg, issues related to the transfer of personal data to third countries were addressed.
Please note that certification under the GDPR is relevant in two cases, i.e. it can be one of:
- accountability (recital 100 of the preamble to the GDPR and Article 5(2)) as a means of demonstrating compliance with the GDPR by the controller or processor. In this case, certification is governed by Article 42 of the GDPR, or
- tools (safeguards) for the transfer of personal data to third countries to ensure that the level of protection applied to personal data transferred outside the EEA is not reduced. In this case, certification is governed by Article 46(2)(f) GDPR.
The workshop covered issues related to both certification schemes under Article 42 of the GDPR (where the scheme aims to certify processing operations involving the transfer of personal data to third countries, in which case the compliance of the entity providing the personal data with the requirements set out in Chapter V of the GDPR is assessed) and under Article 46 of the GDPR (where the certification scheme is essentially aimed at demonstrating the adequacy of the protection of personal data in the third country of the entity receiving personal data in line with the GDPR).
The workshop in Luxembourg was attended by Ms Margarita Valčiukė, Counsellor of the Legal Department of the DPAI, and Ms Lina Klimavičienė, Senior Specialist. Ms Valčiukė was the coordinator of two of the workshop topics. The seminar participants examined particular aspects of the application of these issues in practice in working groups, one of which was moderated by a representative of the DPAI.