Articles 14-16 of the new Regulation 45/2001: Transparency rights and obligations

Guidance Paper

Articles 14-16 of the new Regulation 45/2001: Transparency rights and obligations

EDPS Guidance on Articles 14 - 16 of the proposal for a Regulation on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC

15/01/2017 1 | P a g e

1. INTRODUCTION AND BACKGROUND

1. On 10 January 2017, the European Commission adopted a Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (“the Proposal”).

2. The Proposal is part of a new generation of data protection standards being promulgated by the European Union. The adoption of the General Data Protection Regulation (GDPR) and the Directive for the police and justice sectors represented the most ambitious endeavour of the EU legislator so far to secure the fundamental rights of the individual in the digital era. Now is the time for EU institutions to lead by example in the rules that they apply to themselves as data controllers and data processors.

3. Regulation 45/2001 played a vanguard role, inter alia in providing directly applicable obligations for controllers and rights for data subjects, all supervised by a clearly independent supervisory body. The EU now must ensure consistency with the GDPR through an emphasis on accountability and safeguards for individuals rather than procedures. Some divergence of rules applicable to EU institutions data processing is justifiable, in the same way as public sector exceptions have been included in the GDPR, but this must be kept to a minimum. Essential however, from the perspective of the individual, is that the common principles throughout the EU data protection framework be applied consistently irrespective of who happens to be the data controller. It is also essential that the whole framework applies at the same time, that is, by 25May 2018, deadline for GDPR to be fully applicable.

4. This Guidance Paper focusses as much as possible on Articles 14 to 16 of the Proposal , i.e. on providing transparent information, communication and modalities for the exercise of the rights of the data subject. It thus closes a gap, as the scope of the EDPS Guidelines on the Rights of Individuals with regard to the Processing of Personal Data (“GL DS rights”) did not encompass the information of data subjects under Articles 11 and 12 of Regulation 45/2001 (“Regulation 45/2001”). Nonetheless, the GL DS rights continue to provide some guidance, where the provisions of the Proposal reflect those of Regulation 45/2001. For a summary of main changes with relevance for the scope of this Guidance Paper, please see Annex 1.

5. For Data Protection Officers (DPOs) and members of staff responsible for a particular processing operation, the revision of existing data protection statements (and thus the underlying processing operations) is considered an ideal first step to prepare for the entry 3 | P a g e into force of the new legal basis, new data subject rights and (partially) tighter deadlines applying under the Proposal as of 25 May 2018 . For suggestions by other DPAs, please see Annex 2.

6. As stated in his Opinion 5/2017, the EDPS advocates aligning the future rules applicable to personal data processing by EU institutions with the provisions of the GDPR , unless narrowly interpreted specificities of the public sector justify otherwise. This Guidance Paper therefore complements the upcoming WP 29 Guidelines on Transparency.

7. Apart from substantive alignment with the GDPR, it is essential that the revised rules become fully applicable at the same time as the GDPR i.e. on 25 May 2018. The existing network of Data Protection Officers (“DPO”) provides for an efficient channel of information sharing and cooperation. Consequently, the EDPS is confident that compliance could be achieved following a relatively short transition period, e.g. three months ought to be sufficient to revise the data protection statements.

8. The principle of accountability which underpins both, the GDPR as well as the Proposal, goes beyond simple compliance with the rules and implies a culture change. To facilitate the transition, the EDPS launched an “accountability project” . In this context, the EDPS was in contact over the course of 2016 and 2017 with seven key EU institutions to help prepare in due time for the GDPR application and, based on the exchange of views during the DPO meeting in Tallinn in May 2017, separate guidance documents will be provided by the EDPS. 4 | P a g e

2. EXECUTIVE SUMMARY

New rules on data protection will apply throughout Europa as of 25 May 2018. EU institutions and bodies are no exception: the currently applicable rules (Regulation (EC) 45/2001) will be replaced by a new Regulation as of the same day.

As staff member responsible for processing personal data on behalf of your EU institution or body, you will need to implement these revised data protection rules as of 25 May 2018.

As always, the Data Protection Officer (and Data Protection Coordinator where applicable) of your employer are your first port of call when resolving any data protection challenge you face. But in the light of the accountability principle, it is not your Data Protection Officer or your Data Protection Coordinator who is responsible for correctly implementing the new rules. This responsibility lies with you as staff member responsible for processing personal data on behalf of the EU institution or body you work for.

This Guidance Paper is meant to help you help you get started to fulfill your new obligations.

It focusses on providing transparent information to those concerned by your data processing, on how to communicat about your use of personal data with those concerned and the modalities that apply to the exercise of their rights. For an overview of your new obligations regarding these aspects, please consult Annex 1 of this document.

The EDPS considers the revision of existing data protection statements an ideal first step to prepare for the entry into force of the new legal basis, new rights for those whose personal data you use and some tighter deadlines that apply under the new rules.

We hope you will find the guidance provided by this Guidance Paper useful. More guidance and training on other aspects of the new rules is available - please contact your Data Protection Officer for more information.

5 | P a g e

3. ARTICLE 14 - Transparent information, communication and modalities for the exercise of the rights of the data subject

2.1 General remarks

7. Fair processing relates to Articles 15 and 16 of the Proposal: There should be no hidden processing operations. Fairness relates closely to transparency, ensures predictability and enables user control. Recital 28 of the Proposal further outlines the following: “The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data. That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.” 2.2.1 “...concise, transparent, intelligible and easily accessible form”

8. According to Recital 15 of the Proposal, “The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible ... That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed.” (emphasis added)

9. Communication channel: Depending on the target audience (staff, general public, bidders etc.), the EDPS has suggested using the most adapted channel of communication and multiplying these communication channels where possible. E.g. in the EDPS Guidelines on Video-surveillance , the EDPS recommends a multi-layer approach combining on-the-spot 6 | P a g e notices and a detailed data protection notice posted on the Institution’s intranet and internet sites.

10. Easily accessible: In a complaint case (not published), the EDPS found that “The controller shall provide the data subject with the relevant information and this requirement has not been met if the data subject has not been informed of the location of the privacy statement or even of the existence of the same. Furthermore, the privacy statement cannot be considered to be readily accessible if it is not to be found in direct relation to other relevant information on the processing operation. The fact that the privacy statement was published on the webpage of the DPO is not enough in this respect” .

11. Format: The right of access is usually granted by providing paper or electronic copies of the data subject's personal data . Sometimes the format of the data to be transmitted must be adapted to the data subject (such as in the case of a blind person who needs electronic copies ). The Proposal in Article 14(1), last sentence also foresees that the information may be provided orally, when requested by the data subject (and provided that the identity of the data subject is proven by other means ). 2.2.2 “...using clear and plain language”

12. According to Recital 15 of the Proposal, “The principle of transparency requires that any information and communication relating to the processing of those personal data be ...easy to understand, and that clear and plain language be used. That principle concerns, in particular, information to the data subjects on the identity of the controller and the purposes of the processing and further information to ensure fair and transparent processing in respect of the natural persons concerned and their right to obtain confirmation and communication of personal data concerning them which are being processed.” (emphasis added)

13. Some general pieces of advice include the following :  adopt a simple style and straightforward language that your target audience will find easy to understand (considering that most members of your audience are people whose first language is not the one in which you are giving the information);  do not assume that everybody has the same level of understanding as you;  avoid confusing terminology or legalistic language;  ensure your data protection statements are consistent across multiple platforms and enable rapid updates to them all when needed. 7 | P a g e

14. Best practice examples include the Annexes to the Working Party 29 Opinion 2/2007 on information to passengers about the transfer of PNR data to US authorities or the European Ombudsman's policy on dealing with personal data in a complaint or an inquiry that have not been obtained from the data subject . 2.2.3 “...any information addressed specifically to a child”

15. See also Article 8 and Recital 21 of the Proposal. The EDPS is only aware of one case in which EU institutions provide information society services to children, which renders Article 8 of the Proposal applicable. Nevertheless, given the broad scope of the Proposal and the large variety of EU institutions and their processing operations, it cannot be excluded that such a provision becomes more relevant in the future . 2.4.1 “...without undue delay and in any event within one month of receipt...”

16. Recital 27 of the Proposal: “...The controller should be obliged to respond to requests from the data subject without undue delay and at the latest within one month...”.As regards CCTV footage, the EDPS Guidelines on Video-surveillance (p. 46/47) note that, whenever possible, access should be given within 15 calendar days. If this is not possible, 8 | P a g e another meaningful response (not merely an acknowledgement of receipt) should be given within 15 calendar days.

17. Extension by two further months: There are no hard and fast rules and no precedent cases (yet) as to when such extension might be “necessary”, in particular with a view to the “complexity” and “number of the requests”. However, the EDPS had previously acknowledged (in the context of access requests under Article 13 of Regulation 45/2001, emphasis added) that “...whilst the level of detail has to enable the data subject to evaluate the accuracy of the data and the lawfulness of the processing, the burden of the task for the controller has to be kept in mind .”

18. Article 17 of the European Code of Good Administrative Behaviour stipulates as reasonable time-limit for taking decisions “...in any case no later than two months from the date of receipt... If a request or a complaint to the institution cannot, because of the complexity of the matters which it raises, be decided upon within the above mentioned timelimit, the official shall inform the author as soon as possible. In such a case, a definitive decision should be communicated to the author in the shortest possible time.”

19. Although Article 14(3) of the Proposal does not contain an equivalent to the sentence in Article 14(5) of the Proposal according to which “controller shall bear the burden of demonstrating” the particular nature of the request, the principle of accountability implies that whichever reasoning led the controller to conclude that such extension might be “necessary”, in particular with a view to the “complexity” and “number of the requests”, must be properly documented. 2.4.2 Electronic means

20. As expressly noted by the EDPS Guidelines on staff recruitment (p. 7/8), but not limited to instances of staff recruitment, a request for access may be submitted in any written 24 25 format . For example, requests can be made by e-mail or by filling in an access request form, although the use of the latter cannot be made mandatory.

21. Lodging a complaint with the EDPS: Article 20(3) of the Regulation 45/2001 already stipulated that where a restriction provided for by Article 20(1) of Regulation 45/2001 is imposed, the data subject shall be informed of his or her right to have recourse to the EDPS. 9 | P a g e Existing formulations can thus be reused, if they have worked for you (and your data subjects).

22. Article 19 of the European Code of Good Administrative Behaviour stipulates on the indication of appeal possibilities that “A decision of the institution which may adversely affect the rights or interests of a private person shall contain an indication of the appeal possibilities available for challenging the decision. It shall in particular indicate the nature of the remedies, the bodies before which they can be exercised, and the time-limits for exercising them”.

23. “...manifestly unfounded”: For the requirement of a case-by-case analysis, see below §25.

24. “...excessive, in particular because of their repetitive character”: As mentioned above (§17), the EDPS had previously acknowledged (in the context of access requests under Article 13 of Regulation 45/2001, emphasis added) that “...whilst the level of detail has to enable the data subject to evaluate the accuracy of the data and the lawfulness of the processing, the burden of the task for the controller has to be kept in mind .”

25. A similar provision to Article 14(5), 2nd sentence can be found in Article 14(3) of the European Code of Good Administrative Behaviour (emphasis added): “No acknowledgement of receipt and no reply need be sent in cases where letters or complaints are abusive because of their excessive number or because of their repetitive or pointless character.” Insofar, the European Ombudsman has highlighted that “any decision reaching the conclusion that correspondence sent by a citizen is improper, for example, because it is repetitive, abusive and/or pointless, must be based on an individual and substantive assessment of a citizen's correspondence” . 10 | P a g e

26. “...additional information necessary to confirm the identity of the data subject”: Recital 25 Proposal: “If the personal data processed by a controller do not permit the controller to identify a natural person, the data controller should not be obliged to acquire additional information in order to identify the data subject for the sole purpose of complying with any provision of this Regulation. However, the controller should not refuse to take additional information provided by the data subject in order to support the exercise of his or her rights. Identification should include the digital identification of a data subject, for example through authentication mechanism such as the same credentials, used by the data subject to log-in to the on-line service offered by the data controller.”

27. Copy of an identification document: An EU institution consulted the EDPS on the scanning of ID cards to identify access requestor. Our main elements of guidance resulting from these reflections can be summarized as follows (§§28-30); please note that this reply was only informal advice provided at staff level (i.e. not an official and publically available EDPS Opinion).

28. Data minimisation: Requestors should be invited to provide a copy of an identification document for confirmation of their identity. For this purpose, normally only a limited number of personal data (identity document number, country of issue, first and last name, address, date and place of birth and document expiration date) needs to be visible on the copy of the identification document. In principle, all other data on the copy of the identification document (e.g. the photo, any personal characteristics,) can be blacked out on the copy (but does not have to be blackened out). This also resonates with the requirements stipulated in Recitals 57 and 64 GDPR:

29. Purpose limitation: The principle of purpose limitation suggests that the personal data thus obtained can only be used to verify the requestor’s identity; they cannot become part of the data inventory of the EU institution. The retention period for the copy of an identification document should be limited to the period required to establish the identity of the requestor, including for cases of doubt.

30. Information to data subjects: The EDPS informs data subjects under Article 11 of Regulation 45/2001 along the following lines on the EDPS website : 11 | P a g e

31. Recital 28 of the Proposal stipulates that: “...information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable.” Please consider that most aspects of data protection are difficult to picture and does not necessarily involve binary choices ("Y/N"). The use of icons in the absence of standardised icons (Article 14(8) of the Proposal) is thus probably not a good idea.

4. ARTICLE 15 - Information to be provided where personal data are collected from the data subject

2.9 General remarks

32. Recital 29 of the Proposal states that “The information in relation to the processing of personal data relating to the data subject should be given to him or her at the time of collection from the data subject, or, where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case. Where personal data can be legitimately disclosed to another recipient, the data subject should be informed when the personal data are first disclosed to the recipient. Where the controller 12 | P a g e intends to process the personal data for a purpose other than that for which they were collected, the controller should provide the data subject prior to that further processing with information on that other purpose and other necessary information. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided.”

33. Like its predecessor (Article 11 of Regulation 45/2001), this Article contains a “shopping list” of elements to be provided to the data subject upfront, at the time of collection. The objective is twofold: this information is a precondition for the data subject to verify the lawfulness of the processing as well as for the further exercise of other data subject rights .

34. Article 15 of the Proposal applies in cases where data are collected from the data subject with their active participation. For example , data collected in an application form, or recorded calls to an emergency line after an automated announcement about the recording before the call is passed to an operator.

35. Note the differences to Article 16 of the Proposal (same as for the predecessor provisions Articles 11 and 12 of Regulation 45/2001):  there is no need to inform about the categories of data: the person already knows which data he/she provided, e.g. in replies on a questionnaire;  no need to inform about the sources;  no exception like Article 16(5)(b) of the Proposal for "disproportionate effort" to inform data subject: if collecting directly from a data subject, providing the information at the same time cannot be construed to be disproportionate.

36. As for the predecessor provisions Articles 11 and 12 of Regulation 45/2001 , note that many processing operations will combine situations under Articles 15 and 16 of the Proposal. Example: in selection and recruitment procedures, personal data provided in application forms falls under Article 15 of the Proposal, while the notes of the selection panel fall under Article 16 of the Proposal. In such mixed cases, both Articles need to be complied with.

37. For further guidance on the concept of personal data, see the GL DS rights, pp. 12+13. Recital 6 of the Proposal excludes deceased persons; however, processing personal data of deceased persons might also have impact on living persons (e.g. information on hereditary diseases), in particular family members. 13 | P a g e

38. “(b) the contact details of the data protection officer”: A novelty compared to Regulation 45/2001, which the EDPS in Opinion 5/2017 links to the “increased transparency of the DPO function”. In the EDPS Video-surveillance Guidelines (p. 64/Appendix 2), regarding the contact details of the security unit, the EDPS recommends referring to telephone number and email address of the security unit. In one case , where an EU institution had justified the intention of refraining from giving a telephone number to avoid "prank calls", the EDPS accepted and noted the existence of an email address provided in the on-the-spot CCTV notice.

39. “(d) the recipients or categories of recipients of the personal data”: Already according to Article 2(g) of Regulation 45/2001, entities that receive data in the framework of a particular inquiry are not to be considered recipients, which represents an exemption from the information obligation under Articles 11(1)(c) and 12(1)(d) of Regulation 45/2001 . In the light of Article 4(9) GDPR (via Article 3(1)(a) of the Proposal), the same applies under the Proposal. There is no need to inform about the fact that in such inquiries, e.g. Courts, the Ombudsman, OLAF, the IAS or the EDPS may receive data, as otherwise these entities would have to be mentioned in every single data protection notice.

40. “(e) ... controller intends to transfer / ... transfers”: Another novelty compared to Regulation 45/2001. For general guidance on transfers, including on what can be considered “appropriate or suitable safeguards”, see EDPS position paper on “The transfer of personal data to third countries and international organisations by EU institutions and bodies” . 14 | P a g e

41. Items listed in Article 15(1) of the Proposal are mandatory, except where the data subject already has them. The items under Article 15(2) of the Proposal should be included where they are necessary for the fairness and transparency of the processing. The amount of further information needed depends on the processing operations in questions.

42. . ...

43. . ...

5. ARTICLE 16 - Information to be provided where personal data have not been obtained from the data subject

2.14 General remarks

44. Article 16 of the Proposal deals with cases where personal data have been obtained from sources other than the data subject, e.g. from other persons (example: data about alleged harasser provided by alleged victim in anti-harassment procedures), received from third parties (e.g. referral to OLAF) or collected from public sources.

45. There are two main differences to Article 15 of the Proposal: 15 | P a g e  Data subjects must be informed about the categories of data processed and, where possible, their source;  Paragraph 5 provides a carve-out for not informing data subjects in certain cases.

46. “...(b) the contact details of the data protection officer”: A novelty compared to Regulation 45/2001, see §38 above.

47. Controllers have to actively provide this information to data subjects; mere publication of a data protection notice is as a rule not enough. 16 | P a g e

48. Article 16(2)(b): Existence of other data subject rights: As already noted in the GL DS Rights (p. 9), merely mentioning these rights is insufficient : The data subject is entitled to receive adequate information as to how these rights are guaranteed and which limitations might apply. Usually, the Implementing Rules for Regulation 45/2001 should contain usable guidance for data subjects, but see section 2.2.2 above (§§12/13) for a possible need to adapt the wording.

49. Article 16(2)(e) from which source the personal data originate...”: See Recital 29 of the Proposal, which stipulates that “Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided.” In doing so, keep in mind the twofold objective (see above §33): informing the data subject is a precondition for verifying the lawfulness of the processing as well as for the further exercise of other data subject rights.

50. Recital 29 of the Proposal stipulates that “The information in relation to the processing of personal data relating to the data subject should be given to him or her... where the personal data are obtained from another source, within a reasonable period, depending on the circumstances of the case...”. As this case-by-case requirement indicates, there are no hard and fast rules as to what represents “a reasonable period” in the sense of Article 16(3)(a) and, currently, there are no precedent cases. 17 | P a g e

52. “...(b) the provision of such information ...would involve a disproportionate effort”: Article 12(2) of Regulation 45/2001 already contained a similar provision. This exception aims at cases in which the personal data of the data subject do not provide a way to contact him/her, e.g. because no address or other means of contact are known . In such situations, the controller is usually not obliged to conduct further research to reach the data subject. Where the e-mail addresses of a data subject is known, sending an email with the data protection notice or a link to it does not appear to require a disproportionate effort .

53. In a consultation from the European Ombudsman on their policy regarding the information of third party data subjects , the EDPS had the opportunity to provide further guidance on this exemption. The consultation regarded the provision of individual information to third parties mentioned in (i) complaints outside the European Ombudsman’s mandate and (ii) inadmissible complaints and inquiries that do not give rise to a transfer of personal data of third parties to an EU institution. The EDPS considered that for those (limited!) situations, adequate safeguards were provided by the publication of an information note on the European Ombudsman’s website with a link to the European Ombudsman’s policy on the info of third party data subjects .

54. “... (c) obtaining or disclosure is expressly laid down by Union law”: This exception applies only to cases in which there is a clear obligation in Union law to record or disclose information not collected from the data subject. The EDPS has found that the fact that Union law provides that a whistleblowing scheme has to exist for a particular EU institution is not enough to trigger this exception. This is because under such circumstances, it is only the existence of a procedure that is mandatory, not the recording or disclosure of data relating to specific data subjects . 18 | P a g e

Annex 1: Summary of main changes

Regarding transparency rights and obligations, the Proposal provides for the following main changes compared to Regulation 45/2001:

Article Ex- Change / novelty Proposal article

Transparent information

1. 14(1) Use of plain language for Privacy statements + replies to data subjects’ requests 2. 14(2) Controller shall facilitate data subjects’ rights exercise 3. 14(3) Controller bound to reply to data subjects requests, in principle within max 1 months 4. 14(4) Controller needs to motivate non-action + inform data subject about complaint possibility to EDPS 5. 14(5) Controller’s reply free of charge. Manifestly unfounded or excessive requests may not be answered. 6. 14(7)+(8) Controller shall provide information through standardised icons if COM adopts delegated acts determining such Information to data subjects [where data are collected from data subject]

7. 15 (1) under Contact details of DPO should be contained in the Privacy statement (b) where data are collected from the data subject. 8. 15 (1) (e) 11 Controller shall inform through Privacy statement See also 47- - the fact that data are intended to be transferred to 3rd countries or 51 international Organisations - existence/absence of a Commission’s adequacy decision - reference to safeguards (if transfer under article 49)

9. 15 (1) and More detailed information to be provided to data subjects, e.g. on (2) rights + withdrawal of consent + existence of automated decision making Information to data subjects [where data have not been obtained from data subject]

10. 16(1) Contact details of DPO should be contained in the Privacy statement under (b) where the data have not been obtained from data subject. 11. 16 (1) (e) 12 Controller shall inform data subjects about See also 47- - the fact that data are intended to be transferred to 3rd countries or 51 international Organisations - existence/absence of a Commission’s adequacy decision - reference to safeguards (if transfer under article 49)

12. 16 (1) and More detailed information to be provided to data subjects, e.g. on (2) rights + withdrawal of consent + existence of automated decision making 13. 16(3) Obligation for Controller to inform data subjects within reasonable period but at the latest 1 month after having obtained the data 19 | P a g e

Annex 2: Suggestions by other DPAs

 The CNIL (France) advocates a “mapping exercise” (“Cartographier vos traitements de données personnelles”), see ;

 The UK’s ICO has published comprehensive guidance, see https://ico.org.uk/fororganisations/guide-to-data-protection/privacy-notices-transparency-andcontrol/privacy-notices-under-the-eu-general-data-protection-regulation/;

 The Spanish DPA has published extended guidance on information obligations, see https://www.agpd.es/portalwebAGPD/temas/reglamento/common/pdf/modeloclausula informativa.pdf;

 Other DPAs have published a variety of brochures:

o ‘The GDPR and you - Preparing for 2018’ by the Irish Data Protection Commissioner: https://www.dataprotection.ie/docimages/documents/The%20GDPR%20and% 20You.pdf o 13-step plan by the Belgian Privacy Commission: https://www.privacycommission.be/sites/privacycommission/files/documents/ STAPPENPLAN%20NL%20-%20V2.pdf (in NL) and https://www.privacycommission.be/sites/privacycommission/files/documents/ STAPPENPLAN%20FR%20-%20V2.pdf (in FR): o Garante (Italy): http://www.garanteprivacy.it/regolamentoue (in IT).

20 | P a g e