European Data Protection Board – Eighth Plenary session: Interplay ePrivacy Directive and GDPR, statement on ePrivacy Regulation, DPIA Lists ES & IS, Statement on Elections
Brussels, 13 March - On March 12th and 13th, the EEA Data Protection Authorities and the European Data Protection Supervisor, assembled in the European Data Protection Board, met for their eighth plenary session. During the plenary, a wide range of topics was discussed.
Interplay ePrivacy Directive and GDPR
The EDPB adopted its opinion on the interplay between the ePrivacy Directive and the General Data Protection Regulation. The opinion seeks to provide an answer to the question whether the fact that the processing of personal data triggers the material scope of both the GDPR and the ePrivacy Directive, limits the competencies, tasks and powers of data protection authorities under the GDPR. The EDPB opines that data protection authorities are competent to enforce the GDPR. The mere fact that a subset of the processing falls within the scope of the ePrivacy directive, does not limit the competence of data protection authorities under the GDPR.
An infringement of the GDPR may at the same time constitute an infringement of national ePrivacy rules. SAs may take this into consideration when applying the GDPR (e.g. when assessing compliance with the lawfulness or fairness principles).
Statement on the future ePrivacy Regulation
The EDPB adopted a statement calling upon EU legislators to intensify efforts towards the adoption of the ePrivacy Regulation, which is essential to complete the EU's framework for data protection and the confidentiality of electronic communications.
The future ePrivacy Regulation should under no circumstance lower the level of protection offered by the current ePrivacy Directive and should complement the GDPR by providing additional strong guarantees for all types of electronic communications.
Irish DPC ‘concerned’ about Facebook data breach