Privacy & Information Security Law Blog

On April 5, 2017, the Article 29 Working Party (“Working Party”) adopted the final versions of its guidelines (the “Guidelines”) on the right to data portability, Data Protection Officers (“DPOs”) and Lead Supervisory Authority (“SA”), which were first published for comment in December 2016. The final publication of these revised guidelines follows the public consultation which ended in February 2017.

The amendments and additions made to the first version of the Guidelines on DPOs include the following points:

• pursuant to the Guidelines, a DPO, whether mandatory or voluntary, is designated for all the processing activities carried out by the data controller or the data processor;
• to ensure the DPO’s accessibility, the Working Party recommends that the DPO be located within the EU, whether or not the controller or the processor is established in the EU;
• the Working Party recalls that the DPO must take the role of “facilitator” and act as a contact point to provide the competent SA with the documents and information it needs for the performance of its tasks, as well as for the exercise of its investigative, corrective, authorization and advisory powers; and
• although the DPO is bound by secrecy or confidentiality concerning the performance of its tasks, the DPO is still allowed to contact and seek advice from the SA.

The Working Party amended and further specified certain points of the Guidelines on the Lead SA, including the following:

• Where one or more data controllers established in the EU jointly determine the purposes and means of the processing (i.e., joint controllers), the controllers must, in a transparent manner, determine their respective responsibilities with respect to compliance with the EU General Data Protection Regulation (“GDPR”) and, in order to benefit from the one-stop-shop, should designate which establishment will have the power to implement decisions about the processing with respect to all joint controllers—and act as the main establishment.
• When the data controllership decision has been made and a main establishment has been designated, the lead SA can still rebut the controller’s analysis based on an objective analysis of the relevant facts and request further information regarding the data controllership structure.
• The one-stop-shop system can also benefit data processors that are subject to the GDPR and have establishments in more than one EU Member State. Similar to data controllers, the processor’s main establishment will be the location of its central administration in the EU or, in case there is no central administration in the EU, the establishment in the EU where the main processing activities take place. However, where both the data controller and processor are involved, the competent lead SA should be the one to act as lead SA for the controller. Therefore, in practice, a data processor may have to deal with different lead SAs.

The Working Party amended and further specified certain points of the Guidelines on the right to data portability, including the following:

• Data controllers answering data portability requests from data subjects are not responsible for the processing handled by the data subject or by another company receiving personal data. In this respect, the data controller is not responsible for the receiving data controller’s compliance with data protection law.
• Data processors processing personal data subject to a data portability request must assist the data controller in responding to such requests.
• Receiving data controllers are not obliged to accept and process personal data transmitted following a data portability request.
• Data that is observed from the activities of the data subjects (e.g., activity logs, history of website usage or search activities) is in scope of the data portability right.
• The Working Party recommends data controllers explore two complimentary ways to make portable data available to data subjects or other data controllers: (1) a direct transmission of the overall dataset of portable data, and (2) an automated tool allowing extraction of relevant data. The choice between these two paths must be made on a case by case basis.
• Where there is no available common use format in a certain industry or context, data controllers should provide personal data using commonly used open formats, along with the related metadata.
• When it comes to ensuring the security of personal data transmitted, data controllers should implement appropriate procedures to deal with potential data breaches, assess the risks linked to data portability and take appropriate risk mitigation measures (e.g., use additional authentication methods).