Avid readers of the GA4GH GDPR Forum will have likely noticed that past briefs have mentioned GDPR interpretations by the European Data Protection Board (‘the Board’) and the Article 29 Working Party (WP29). This Brief aims to clarify their roles in interpreting the GDPR, against the backdrop of their development as well as their most important tasks and powers, particularly about the Board’s mandate to contribute to the consistent application of the GDPR throughout the EU.
Overview of the European Data Protection Board
The Board is an independent body that has been established to promote the effective and consistent interpretation and application of the GDPR across the EU. The Board is the successor organization to the WP29 since the coming-into-force of the GDPR. The Board has larger powers than its predecessor, especially with regard to dispute resolution and consensus building related to the consistency mechanism introduced by the GDPR where it has co-decision-making powers with national supervisory authorities (SAs), even though its role remains principally an advisory one. The Board may exceptionally work with the European Data Protection Supervisor (EDPS), which is a SA for EU institutions with certain advisory functions.
The Board is composed of the representatives from EU Member States' SAs as well as the EDPS. Non-voting members include the European Commission (EC), EFTA EEA states, and the EFTA Surveillance Authority.
Guidance from the European Data Protection Board
The Board can issue guidance related to the interpretation of the GDPR. In a non-closed list, the GDPR lists 25 areas, including advising the EC, and related to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of data subjects, as well as related to international transfers and particularly to codes of conduct, to list the most relevant advisory tasks for data processing for genomic research.
As was the case with its predecessor, the Board solicits public feedback before issuing guidance, which consists of issuing draft guidance and then giving stakeholders six weeks to comment. (List of open and closed public consultations.)
Opinions from the European Data Protection Board
Within the frame of the consistency mechanism, the Board can issue opinions on draft decisions of SAs and on matters of general application, e.g., where a draft code of conduct implicates data processing activities in multiple EU Member States. Before a SA approves such a code, it must ask the Board to provide an opinion. The opinion does not bind the EC in its subsequent decision to approve the general validity of a code within the EU. Nevertheless, only a code that has first received an opinion of the Board stating that the code complies with the GDPR’s rigorous standards can be submitted to the EC. The Board may also issue opinions on other matters, such as determinations from SAs regarding when a data protection impact assessment is required. Any SA or the EC may further seize the Board to issue an opinion regarding matters that affect more than one Member State.
Further to this, the Board can issue decisions that bind SAs pursuant to the dispute resolution procedure and the urgency procedure.
Binding Nature of the Guidelines and Opinions
The interpretive guidance in the guidelines and opinions of the Board are not binding for SAs (cf. binding decisions) and for courts. They are better thought of as interpretive aids rather than a bona fide source of law. However, they may have a binding effect on the Board itself, especially where the Board issues a binding decision that is informed by the Board’s own guidelines and opinions. This is why it has particular relevance that the Board has endorsed some WP29 guidelines such as those on consent and transparency. The endorsement of guidelines of the WP29, particularly related to issues that are subject to technological development and their changing legal assessment, risks overlooking the state-of-the-art and becoming ‘frozen in time’ instead of being replaced.
Exceptionally, even non-binding guidelines may come to represent a leading, authoritative interpretation on data protection law when cited with approval by the Court of Justice of the European Union. Although not frequent, we have seen the Court cite the Board in approval of their interpretation.
Acronyms Used
- EC – European Commission
- EDPS – European Data Protection Supervisor
- EEA – European Economic Area
- EFTA – European Free Trade Association
- EU – European Union
- GDPR – General Data Protection Regulation
- SA – Supervisory Authority
- WP29 – Article 29 Working Party
Michael Beauvais is an academic associate at McGill University’s Centre of Genomics and Policy. Fruzsina Molnar-Gabor is research group leader at the Heidelberg Academy of Sciences and Humanities and lecturer at the Legal Faculty of Heidelberg University.
