The EDPB has announced the publication of the following documents, which it adopted during its 39^th and 40^th plenary sessions in October 2020:

• Guidelines on the concept of relevant and reasoned objection: the consultation closed on 24 November 2020 and the Guidelines are now finalised. Essentially, the guidelines “contribute to a unified interpretation of the concept, which will help streamline future Art. 65 GDPR procedures”, the EDPB said;
• Guidelines on Data Protection by Design & Default: These guidelines focus on the obligation of data protection by design and by default (DPbDD), as set out in Article 25 of the GDPR. DPbDD means that controllers have to implement appropriate technical and organisational measures, as well as necessary safeguards, to implement data protection principles and protect the rights and freedoms of data subjects. In addition, controllers should be able to demonstrate that the implemented measures are effective. These guidelines aim to help controllers achieve this;
• EDPB document on the Coordinated Enforcement Framework: during the 40^th plenary session, the EDPB decided to set up a Coordinated Enforcement Framework (CEF), which will provide a structure to co-ordinate the regular annual activities of EDPB Supervisory Authorities (SAs). The objective of the CEF is to facilitate joint action in a flexible and co-ordinated manner, ranging from joint awareness-raising and information gathering to enforcement and joint investigations; and
• EDPB letter in response to the Europäische Akademie für Informationsfreiheit und Datenschutz concerning the data protection implications of Article 17 of the Directive on Copyright in the Digital Single Market: in the letter, the EDPB states that any processing of personal data for the purpose of upload filters must be proportionate and necessary and that, as far possible, no personal data should be processed when Article 17 is implemented. Where the processing of personal data is necessary, such as for the redress mechanism, such data should only concern data necessary for this specific purpose, while applying all the other principles of the GDPR.

To access the EDPB’s press release and for links to the documents, click here.