Keeping a logbook: Q&A on records Owe Langfeldt Massimo Attoresi DPO-EDPS Meeting 31/05/2018

From Art. 25 notifications to Art. 31 records What? How? When? Who?

What has to be in a record? Minimum list in Art. 31 new 45; Template in accountability on the ground toolkit (optional, update to come soon); Two parts: Article 31 strictly speaking; Compliance check / risk screening. Why those two parts? Art. 31 is public, internal assessment not necessarily; however, they only make sense together; Part 2 is “why do we do this?”

How to create/convert them? Converting Art. 25 notifications to Art. 31 records Translation table: Accountability on the ground, part I, annex 4; Art. 31 part = 90% of the work is done, mostly changing labels; Compliance part: you’ve thought about this already... Publication Art. 31 part = public Compliance part = can remain internal Tools EDPS does not have a ready-made IT tool; use your own or share your tools.

When to do it? When to finish? Records are living documents New 45 to become applicable before end of 2018; Formally no transition period; Do it quickly, keeping in mind that a large part of the work is already done. Records are living documents Update as you go along and make changes to processing operations; Good idea: review cycle! Footnote: Quo vadis true prior checks? Deadline 01/07/18

Who’s in charge? Individual records Register Controller in charge; DPO can provide guidance & quality control; Once more, accountability... Register all records kept in a central register; allows comparison and knowledge-sharing; DPO prime candidate for custodian of the register; But controller remains responsible for content!

Thank you for your attention! For more information: www.edps.europa.eu edps@edps.europa.eu @EU_EDPS

Additional Background Slides

PC phase-out Ex-post PC notifications 30/11/17 True PC notifications 01/07/18, but please asap Cases in follow-up If pending on your side upon applicability of new 45, do threshold assessment Closed cases triggering DPIA criteria No need for DPIA immediately (unless changes)

Shift in supervision architecture Prior Consultation DPIA Records of processing Prior Check Opinion Article 27 Notifications Art. 25 Notifications

Documentation overview