June 1, st Asia Pacific Privacy Authorities (APPA) Forum – PHAEDRA Workshop Nr. 3: The EU Data Protection Regulation and regional perspectives on improving cooperation between DPAs, PCs and PEAs Overview of the legal reports under workstream 2 Gertjan Boulet Wednesday, 18 June 2014, Westin Chosun Hotel Seoul, 106 Sogong-ro, Jung-gu, Seoul

Workstream 2: legislative review Report 2.1: “A Compass towards best Elements for Cooperation between Data Protection authorities” - 28 February 2014, updated 9 May 2014 Report 2.2: “Legal reflections for further improving cooperation between data protection authorities” - 9 May 2014 June 1, 20162

Report Jurisdiction profiles -(non)-EU countries -Identification and review of -general data protection laws -enabling legislation: establishing and empowering DPAs and creating a legal basis for cooperation -Key findings in questionnaires, annual reports, press releases, websites June 1, 20163

Questionnaire, question 2 “What are the chief constraints on you in achieving more co-operation and better co- ordination? Please rank in order of importance, with 1 as most serious and 6 as least serious.” June 1, Report Jurisdiction profiles

June 1, Report Jurisdiction profiles

Observations -In general: just one or two articles on cooperation are sufficient to foster international cooperation. -BUT: which information can be shared? Confidential information, professional secrecy. -Problem expressed by Danish DPA: “the divergence in opinions on what's important and less important is more important than specific legal constraints.” -Lack of a harmonized EU DP legal framework, different national laws & enforcement priorities - June 1, 20166

Report Networks between DPAs Binding networks -Cooperation in the Convention 108 and its additional protocol + modernisation -Cooperation under Directive 95/46/EC -Cooperation under proposal for a Data Protection Regulation (GDPR) -Intra-EU (Arts 54-68) -Outside EU (Art 45) June 1, 20167

APEC Asia-Pacific Privacy Authorities Central & Eastern European DPAs French-speaking Association of Personal Data Protection Authorities Ibero-American Data Protection Network OECD International Conference Of Data Protection And Privacy Commissioners

Report Agreements between DPAs -Memorandum of Cooperation, Cooperation Agreement, Collaboration Declaration, Declaration on Further Collaboration, Declaration of Intentions, Declaration on Joint Co-operation … -MoU between the DPA of Berlin and the Korea Information Security Agency (28 November 2002) June 1, 20169

Report Aims of cooperation Enforcement of privacy and data protection laws -coordination of policies in enforcement matters -coordination of enforcement methods -sanctions Mutual assistance between DPAs Raising awareness activities June 1,

Report 2.1 – Forms of cooperation For various aims of cooperation -Monitoring privacy and data protection laws in other countries -Sharing of standards and information -Trainings & staff exchanges -Projects between DPAs Enforcement cooperation -Mutual legal assistance -Parallel or joint investigations -Mutual recognition June 1,

Report Reflections on instruments for cooperation between DPAs -Type of instrument: international treaty, MoU,... -Scope: general or limited -Nature: binding or non-binding -Impact of level of harmonisation on the choice of the instrument ? June 1,

Report Reflections on independence of DPAs -Article 16 Treaty of the Functioning of the European Union (EU) -Article 8 EU Charter of Fundamental Rights -Article 28(1) Directive 95/46/EC -Article 1(3) Additional Protocol to Convention 108 -§19(c) revised OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data June 1,

Report Reflections on independence of DPAs European Commission versus - Germany, 9 March 2010: German DPAs subject to oversight by the state - Austria, 6 October 2012: Federal Chancellor has an unconditional right to information covering all aspects of the work of the DPA - Hungary, 8 April 2014: bringing to an end the term served by the Hungarian DPA before expiry of the full term June 1,

PHAEDRA project June 1,

June 1, Thank you!