The EDPB published its 2022 activity report “Streamlining Enforcement Through Cooperation” (the Activity Report) on 17 April 2023, which provides an overview of the work it carried out in 2022. The report reflects on, amongst other things:
EDPB facilitation of enforcement cooperation
One of the key EDPB activity areas flagged as a highlight was enforcement cooperation, with the Activity Report calling out various taskforces operating with a cross-border dimension, such as the coordinated investigation into cloud service use in the public sector; the Vienna Statement on Enforcement Cooperation and the Article 60 GDPR Guidelines. As we have previously reported, the Vienna Statement summarised the EDPB members’ commitments to enhancing cooperation in strategic areas and diversifying their range of cooperation methods. The Guidelines on the interactions between supervisory authorities under Article 60 GDPR address issues such as the exchange of information between supervisory authorities and the ability of concerned supervisory authorities (CSAs) to contribute their views prior to the lead supervisory authority (the LSA) drafting a decision.
Article 65 decisions
The EDPB issued five binding decisions addressing a range of issues, including the right of access, right to object to direct marketing, and legal basis for processing, transparency, fairness. The report also highlights a raft of consistency opinions issued under Article 64 GDPR.
Guidelines
The Activity Report calls out the 10 sets of Guidelines developed and finalised by the EDPB in addition to the Article 60 guidelines, specifically addressing data subject access rights, deceptive design patterns in social media, the calculation of administrative fines, the use of facial recognition in law enforcement, practical implementation of amicable settlements, certification and codes of conduct as a tool for transfers, identifying LSAs, personal data breach and notification.
Legislative consultation
The Activity Report identifies various statements published (such as on the new Trans-Atlantic Data Privacy Framework) and EDPB-EDPS joint opinions (such as on the European Health Data Space) issued in relation to EU legislative developments, perhaps taken as justification for the EDPB Chair’s forward statement that the EPDB “does not just ensure that data protection law is applied consistently across the EEA, but it helps to shape Europe’s digital future.”
Supervisory authority activity in 2022
The Activity Report examines key national cases in which supervisory authorities have exercised enforcement actions. It also discusses cross-border cooperation between supervisory authorities across multiple areas such as (i) identification of the LSA and CSAs; (ii) registration of cases with a cross-border component via a central database; (iii) the ‘one-stop-shop’ mechanism through which the LSA and CSAs reach a coordinated decision; and (iv) the mutual assistance procedure.
The press release is available here and the Activity Report here.
