Monika W ó jtowicz, LL.M. European Privacy Seal Certification of evaluators and the application procedure from the perspective of an EuroPriSe evaluator

1 EuroPriSe Expert Admission Procedure - Objectives-  Admission procedure ensures:  quality, consistency and comparability of evaluation results  independence and reliability of experts © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Proof of qualification: legal and/or technical  Self-declaration  Training and work specimens  Workshop & training evaluation  Proof of reliability and independence  Self-declaration  Admittance by certification body  Agreement EuroPriSe Expert Admission Procedure - Requirements- © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Self-declaration from applying experts with respect to proficiency  General professional experience  Three years with higher education or five years without higher education  Sufficient professional experience in auditing, assessing or evaluation related to privacy and data protection, either on legal or on technical aspects  Legal experts additionally: higher education (e.g. bachelor, master, diploma) in law EuroPriSe Expert Admission Procedure - Proof of qualification - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Self-declaration from applying experts with respect to independence, reliability and liability insurance coverage  Reliability  A potential expert is not reliable if he or she has been convicted of major crimes including fraud and forgery of documents as well as breaking regulations on data protection or if he or she lives in unsatisfactory financial circumstances (such as current insolvency proceedings) or has been dismissed as an expert by an accreditation body before.  Independence  An expert lacks independence respective the seal-applicant if he or she is not independent with respect to the evaluation assessments (e.g. due to involvement in the development process of the evaluated object or because of directives from employers or clients) or if the total revenue derived from the client totals to 80% or more of the overall revenue of the expert or his or her employer.  A declaration of independence is required for each individual evaluation. EuroPriSe Expert Admission Procedure - Proof of reliability and independence - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 To get accustomed to the evaluation scheme and the report templates  To get a feeling on the complexity of the scheme (time, effort)  To get familiar with EuroPriSe procedures and criteria  To receive a tutorial for real-case evaluations including a training evaluation on an exercise IT product or IT-based service EuroPriSe Expert Admission Procedure - Expert-Workshop objectives - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 EuroPriSe Criteria  EuroPriSe Commentary for Experts  lists the criteria and relevant questions  Commentary on interpretation of criteria (European Court rulings, WP29)  provides additional hints for EuroPriSe Experts (in particular on how to write an evaluation report)  EuroPriSe Manual  Information on how to conduct an evaluation and on evaluation reports  Templates  Confidential Report  Public Report EuroPriSe Expert Admission Procedure - Workshop – procedures, criteria and documents - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Group training on:  How to find out the Target of Evaluation (ToE)  How to start an evaluation  Discussion of the first evaluation results  Presentation of sample cases of evaluation and ToE-examples Subsequent to the Workshop: Compilation of training evaluation at home EuroPriSe Expert Admission Procedure - Workshop – training evaluation - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Step 1: Definition of a Target of Evaluation and analysis of its environment  all types of data  data flow  ToE components  architecture  intended environment of operation and the area of application, (relevant for the regulatory analysis)  single processes  all interfaces  Step 2: Selection of the applicable criteria  Due to regulatory analysis  Legal experts - sets 1, 2 and 4, Technical experts - sets 1, 3 and 4 of the criteria catalog  Step 3: Evaluation with respect to selected criteria  Decide and explain whether and why criteria requirements are met  Step 4: Compilation of a comprehensive report  Content: Steps 1-3 and final evaluation results EuroPriSe Expert Admission Procedure - Homework – steps to take - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Set 1. Fundamentals, e.g. purpose, avoidance, transparency  Set 2. Legitimacy of Data Processing e.g. legal basis  Legal Basis for the Processing of Personal / Sensitive / Traffic and Location Data  Special Requirements to Different Processing Phases  Compliance with Data Protection Principles and Data Protection Duties  Special Types of Processing Operations  Formalities  Set 3. Technical-Organisational Measures  general e.g. unauthorised access  Specific, e.g. encryption  Set 4. Data Subjects’ Rights EuroPriSe Admission Procedure - Homework – criteria sets - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 pages  Time effort about 16 h  Time limit for the conduction of training report: 4 weeks EuroPriSe Expert Admission Procedure - Homework – requirements - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

The EuroPriSe Expert Register listing all admitted experts is available at: EuroPriSe Expert Admission - Expert Register - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Admission is granted for three years  Prolongation:  successfull conduction of EuroPriSe evaluation or  participation in a EuroPriSe Expert enhancement workshop EuroPriSe Expert Admission - Validity - © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

 Repetition and self-assessement of required data protection knowledge  Feedback from the certification body on the training evaluation report  First practical experience on EuroPriSe cerification scheme  Planning reliability - feeling about the complexity of the scheme (time, effort) before the first real evaluation EuroPriSe Expert Admission Procedure - Benefit for experts- © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP

TÜV Informationstechnik GmbH Member of TÜV NORD GROUP Monika Wójtowicz, LL.M. IT-Security Head of Data Protection Evaluation Center (Legal) Langemarckstr Essen Telefon: – 535 Telefax: – 544 URL: Thank you very much for your attention! © TÜV Informationstechnik GmbH – Member of TÜV NORD GROUP