Adopted on 12 February 2019 Version for public consultation

The European Data Protection Board

Having regard to Article 70(1)(n) and Articles 40 and 41 of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”),

Having regard to the EEA Agreement and in particular, to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA Joint Committee No 154/2018 of 6 July 2018, Having regard to Article 12 and Article 22 of its Rules of Procedure of 25 May 2018,