1. Keeping a logbook: Q&A on records
Owe Langfeldt
Massimo Attoresi
DPO-EDPS Meeting
31/05/2018

2. From Art. 25 notifications to Art. 31 records
What?
How?
When?
Who?

3. What has to be in a record?
Minimum list in Art. 31 new 45;
Template in accountability on the ground toolkit (optional, update to come soon);
Two parts:
Article 31 strictly speaking;
Compliance check / risk screening.
Why those two parts?
Art. 31 is public, internal assessment not necessarily; however, they only make sense together;
Part 2 is “why do we do this?”

4. How to create/convert them?
Converting Art. 25 notifications to Art. 31 records
Translation table: Accountability on the ground, part I, annex 4;
Art. 31 part = 90% of the work is done, mostly changing labels;
Compliance part: you’ve thought about this already...
Publication
Art. 31 part = public
Compliance part = can remain internal
Tools
EDPS does not have a ready-made IT tool; use your own or share your tools.

5. When to do it? When to finish? Records are living documents
New 45 to become applicable before end of 2018;
Formally no transition period;
Do it quickly, keeping in mind that a large part of the work is already done.
Records are living documents
Update as you go along and make changes to processing operations;
Good idea: review cycle!
Footnote: Quo vadis true prior checks? Deadline 01/07/18

6. Who’s in charge? Individual records Register Controller in charge;
DPO can provide guidance & quality control;
Once more, accountability...
Register
all records kept in a central register;
allows comparison and knowledge-sharing;
DPO prime candidate for custodian of the register;
But controller remains responsible for content!

7. Thank you for your attention!
For more information:
@EU_EDPS

8. Additional Background Slides

9. PC phase-out Ex-post PC notifications 30/11/17 True PC notifications
01/07/18, but please asap
Cases in follow-up
If pending on your side upon applicability of new 45, do threshold assessment
Closed cases triggering DPIA criteria
No need for DPIA immediately (unless changes)

10. Shift in supervision architecture
Prior Consultation
DPIA
Records of processing
Prior Check Opinion
Article 27 Notifications
Art. 25 Notifications

11. Documentation overview