Opinion 2/2020 on the Belgium data protection supervisory authority draft accreditation requirements for a code of conduct monitoring body pursuant to article 41 GDPR

2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64 (1)(c), (3) - (8) and Article 41 (3) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018,

Having regard to Article 10 and Article 22 of its Rules of Procedure of 25 May 2018, Whereas: (1) The main role of the European Data Protection Board (hereinafter “ the Board ” ) is to ensure the consistent application of the GDPR when a supervis ory authority ( hereinafter “ SA ” ) intends to approve the requirements for accreditation of a code of conduct (hereinafter “code”) monitoring body pursuant to article 41. The aim of this opinion is therefore to contribute to a harmonised approach with regard to the suggested requirements that a data protection supervisory authority shall draft and that apply during the accreditation of a code monitoring body by the competent supervisory authority. Even though the GDPR does not directly impose a single set of requirements for accreditation, it does promote consistency. The Board seeks to achieve this objective in its opinion by: firstly, requesting competent SAs to draft their requirements for accreditation of monitoring bodies based on article 41(2) GDPR and on the Board’s “Guidelines 1/20 19 on Codes of Conduct and Monitoring bodies under Regulation 2016/679” (hereinafter the “Guidelines”) , using the eight requirements as outlined in the guidelines’ accreditation section (section 12); secondly, to provide written guidance explaining the acc reditation requirements; and , finally , requesting them to adopt these requirements in line with this opinion , so as to achieve an harmonised approach. (2) With reference to article 41 GDPR, the competent supervisory authorities shall adopt requirements fo r accreditation of monitoring bodies of approved codes. They shall, however, apply the consistency mechanism in order to allow the setting of suitable requirements ensuring that monitoring bodies carry out the monitoring of compliance with codes in a comp etent, consistent and independent manner, thereby facilitating the proper implementation of codes across the Union and, as a result, contributing to the proper application of the GDPR. (3) In order for a code covering non - public authorities and bodies to b e approved, a monitoring body (or bodies) must be identified as part of the code and accredited by the competent SA as being capable of effectively monitoring the code. The GDPR does not define the term ‘accreditation’. However, article 41 (2) of the GDPR outlines general requirements for the accreditation of the monitoring body. There are a number of requirements , which should be met in order to satisfy the competent supervisory authority to accredit a monitoring body. Code owners are required to explain a nd demonstrate how 1 References to the “Union” made throughout this opinion should be understood as references to “EEA”. 4 Adopted their proposed monitoring body meets the requirements set out in article 41 (2) to obtain accreditation. (4) While the requirements for accreditation of monitoring bodies are subject to the consistency mechanism, the development of the a ccreditation requirements foreseen in the Guidelines should take into consideration the code’s sector or specificities. Competent supervisory authorities have discretion with regard to the scope and specificities of each code, and should take into account their relevant legislation. The aim of the Board’s opinion is therefore to avoid significant inconsistencies that may affect the performance of monitoring bodies and consequently the reputation of GDPR codes of conduct and their monitoring bodies. (5) In t his respect, the Guidelines adopted by the Board will serve as a guiding thread in the context of the consistency mechanism. Notably, in the Guidelines, the Board has clarified that even though the accreditation of a monitoring body applies only for a spec i fic code, a monitoring body may be accredited for more than one code, provided it satisfies the requirements for accreditation for each code . (6) The opinion of the Board shall be adopted pursuant to article 64 (3) GDPR in conjunction with article 10 (2) of the EDPB Rules of Procedure within eight weeks from the first working day after the Chair and the competent supervisory authority have decide d that the file is complete. Upon decision of the Chair, this period may be extended by a further six weeks tak ing into account the complexity of the subject matter. HAS ADOPTED THE FOLLOWING OPINION: SUMMARY OF THE FACTS 1 The Belgium Supervisory Authority ( hereinafter “ BE SA ” ) has submitted its draft decision containing the accreditation requirements for a code of conduct monitoring body to the Board , requesting its opinion pursuant to article 64 (1)(c) , for a consistent approach at Union level. The decision on the complet enes s of the file was taken on 25 th October 2019.

In compliance with article 10 (2) of the Board Rules of Procedure, 2 due to the complexity of the matter at hand, the Chair decided to extend the initial adoption period of eight weeks by a further six weeks . ASSESSMENT General reasoning of the Board regarding the submitted draft accreditation requirements

All accreditation requirements submitted to the Board for an opinion must fully address article 41(2) GDPR criteria and should be in line with the eight areas outlined by the Board in the accreditation section of the Guidelines (section 12, pages 21 - 25). T he Board opinion aims at ensuring consistency and a correct application of article 41 (2) GDPR as regards the presented draft. 5 Adopted

This means that, when drafting the requirements for the accreditation of a body for monitoring codes according to articles 41 (3 ) and 57 (1)(p) GDPR, all the SAs should cover these basic core requirements foreseen in the Guidelines, and the Board may recommend that the SAs amend their drafts accordingly to ensure consistency.

All codes covering non - public authorities and bodies ar e required to have accredited monitoring bodies. The GDPR expressly request SAs , the Board and the Commission to ‘encourage the drawing up of codes of conduct intended to contribute to the proper application of the GDPR, taking account of the specific feat ures of the various processing sectors and the specific needs of micro, small and medium sized enterprises.’ (article 40 (1) GDPR). Therefore , the Board recognises that the requirements need to work for different types of codes, applying to sectors of div erse size, addressing various interests at stake and covering processing activities with different levels of risk.

This opinion does not reflect upon items submitted by the BE SA, which are outside the scope of ar ticle 41 (2) GDPR, such as references to national legislation. The Board nevertheless notes that national legislation should be in line with the GDPR , where required. Analysis of the BE accreditation requirements for Code of Conduct’s monitoring bodies

Taking into account that: a. Article 41 (2) GDPR provides a list of accreditation areas that a monitoring body need to address in order to be accredited ; b. Article 41 (4) GDPR requires that all codes (excluding those covering public authorities per Article 41 (6)) have an accredited monitoring body; and c. Article 57 (1) (p) & (q) GDPR provides that a competent supervisory authority must draft and publish the accreditation requirements fo r monitori ng bodies and conduct the accreditation of a body for monitoring codes of conduct . the Board is of the opinion that: GENERAL REMARKS

The Board notes that paragraph 3 of the introduction states that the monitoring body has to fulfil the accreditation requirements set out in the BE SA’s decision , in addition to the requirements of the GDPR and section 12 of the Guidelines . Whereas the ref erence to the Guidelines is welcomed, the Board notes that the BE SA’s requirements are not an addition to the ones established in the GDPR, but rather 6 Adopted a development thereof. The Board encourages the BE SA to amend the wording, in order to make clear that the requirements in the decision are not in addition to those in the GDPR, but based on those.

The Board observes the BE SA’s draft accreditation requirements refer several times to “the number of code members”. In this regard, the second paragraph of req uirement 3.2 of the BE SA accreditation requirements states that the amount and type of human resources required depend on “....the number of code members”. It is unclear how the assessment of the BE SA could be based on this criteria , considering that cod e member numbers might not be known when the monitoring body applies for accreditation and that may change considerably after the accreditation has been granted . Moreover, according to the Guidelines, resources and staffing of the monitoring body should be proportionate to the expected number and size of code members , amongst other elements (paragraph 73, page 24 of the Guidelines). The Board notes the same reference to ‘ number of code members ’ in requi rements 5.2 and 6.2 Therefore the Board recommends the BE SA to include appropriate reference s to “the expected number and size of code of code members”, to align the text with the Guidelines and allow for more flexibility.

The Boar d is of the opinion that independence for a monitoring body should be understood as a series of formal rules and procedures for the appointment, terms of reference and operation of the monitoring body. These rules and procedures will allow the monitoring b ody to perform the monitoring of compliance with a code of conduct in complete autonomy, without being directly or indirectly influenced, nor subject to any form of pressure that might affect its decisions. Therefore, the monitoring body must demonstrate i mpartiality and independence in relation to four main areas: legal and decision making procedures, financial resources, organisational resources and structure and accountability. The examples provided in the BE SA’s accreditation requirements do not cover entirely the four areas outlined. The Board recommends the BE SA to further develop the requirement s concerning imparti ality and independence of the monitoring body , in line with the four areas. Furthermore, the Board encourages the BE SA to include practical examples that provide a clearer view on how the impartiality and independence can be demonstrated in the four areas.

The Board observes that the example given in requirement 1.1, third paragraph, last indent (“information on the contractual relationship between the monitoring body and the code owner”) is only applicable to external monitoring bodies. Where the monitoring body is part of the code owner orga nisation , particular focus must be made on their ability to act independently. The Board encourages the BE SA to tailor the examples taking into account that monitoring bodies can be external or internal monitoring bodies.

Moreover, the Board considers that the l ast paragraph of requirement 1.1 could be clarified to explain how independence from the sector to which the code applies will be assessed, considering that such “sector” might be an indistinct entity. The Board encourages the BE SA to clarify the drafting , providing 7 Adopted for a better understanding of the concept and of the kind of evidence that the monitoring bodies can provide to comply with the requirement .

With regard to the accountability of the monitoring body, the Board notes that t he monitoring body should be able to demonstrate “accountability” for its decisions and actions in order to be considered to be independen t. The Board considers that the accountability requirements in section 9 of the BE SA’s accreditation requirements do not fully cover all the elements that should be taken into account. The BE SA should clarify what kind of evidence is expected from the monitoring body, in order to demonstrate its accountability. This could be accomplished through such things as setting out the roles and de cision - making framework and its reporting procedures , and by setting up policies to increase awareness among the staff about the governance structures and the procedures in place. Thus, the Board recommends the BE SA to strengthen the requirements for acco untability, to allow for a better understanding of its content in relation to the independence of the monitoring body, and offer more examples of the kind of evidence that the monitoring bodies can provide

3 “adequate human resourc es”) of the BE SA accreditation requirements establish es that the monitoring body shall demonstrate that it is “ able to free choose qualified staff in order to fulfil its tasks ”. The Board notes that the monitoring body can also have staff that has been ch ose n by other body independent of the code, as stated in the Guidelines (paragraph 68, page 23). The Board recommends the BE SA to align the wording with the Guidelines, by adding the possibility that the staff is chosen by other body independent of the co de. Furthermore , the Board is of the opinion that, from a practical point of view, some examples might also be helpful. An example of staff provided by a body independent of the code would be monitoring body personnel that have been recruited by an indepen dent external company, which provides recruitment and human resources services. Therefore, the Board encourages the BE SA to add an example in line with the one provided in this paragraph.

Moreover, the Board notes that requirement 3.1 of the BE SA accred itation requirements does not explain how the monitoring body can demonstrate that it is able to freely choose qualified staff . In order to facilitate the practical implementation of the requirements, the Board considers that some examples would be helpful . Hence, the Board encourages the BE SA to clarify how the monitoring body can demonstrate its ability to freely choose qualified staff.

With regard to the obligation of the monitoring body to demonstrate that it is composed of an adequate number of staff ( requirement 3.2 of the BE SA accreditation requirements ), the Board considers that, from a practical point of view, some examples would be helpful. Therefore, the Board encourages the BE SA to clarify how the monitoring body can demonstrate that it is composed of an adequate number of staff.

The Board observe s that r equirement 4.3 of the BE SA accreditation requirements (section “financial arrangements”) requires that the monitoring body shall have “adequate arrangements in place (...) to cover potential financial penalties”. The Board is of the opinion that t his obligation could prevent small or medium monitoring bodies from get ting accredited. Therefore, the Board recommends the BE SA to either delete this requirement or to soften the wording and refer to the monitoring body’s responsibilities in general . 8 Adopted CO NFLICT OF INTEREST

The Board observes that requirement 1.2 of the BE SA accreditation requirements only addresses the situations in which there is a conflict of interest related to the personnel of the monitoring body. The accreditation requirements should also reflect other scenarios where there might be conflicts of interest of the monitoring body itself , for example, due do its activities, relationships, organisation or procedures. Thus, the Board recommends the BE SA to amend the draft accreditation req uirements to reflect that the conflict of interests shall be avoided also in relation to the monitoring body itself, and not only with regard to its staff .

Furthermore, the Board observes that the BE SA accreditation requirements do not explicitly include the obligation of the monitoring body to refrain from any action that is incompatible with its tasks and duties and to not seek nor take instructions from any person, organisation or association (paragraph 68, page 23 of the Guidelines). Therefore, the Board recommends the BE SA to align the text with the Guidelines and include the above - mentioned obligations. EXPERTISE

The Board notes that requirement 5.1 of the BE SA ’s expertise requir ements include: knowledge and experience on data pr otection legislation, knowledge and experience in the sector or processing activity for which it will act as monitoring body as well as knowledge and experience in auditing to establish the monitoring body capacity to monitor compliance of the code me mbers with the code of conduct .

The Board considers that the accreditation requ irements need to be transparent. T hey also need to provide for monitoring bodies seeking accreditation in relation to codes that cover micro, small and medium - sized enter prises’ processing activities (a rticle 40 (1) GDPR) .

As required by the Guidelines, every code must fulfil the monitor ing mechanism criteria (in section 6.4 of the Guidelines), by demonstrating ‘why their proposals for monitoring are appropriate and operationally feasible’ (paragraph 41, page 17 of the Guidelines). In this context, all codes with monitoring bodies will ne ed to explain the necessary expertise level for their monitoring bodies in order to deliver the code’s monitoring activities effectively. To that end, in order to evaluate the expertise level required by the monitoring body, it should, in general, be tak en into account such factors as: the size of the sector concerned, the different interests involved and the risks of the processing activities addressed by the code . This would also be important if there are several monitoring bodies, as the code will help e nsure a uniform application of the expertise requirements for all monitoring bodies covering the same code.

T he exper tise of each monitoring body should be assessed in line with the particular code. Therefore, the Board encourages the BE SA to take into account the additional expertise requirements that can be defined by the code and ensure that the expertise of each monitoring body is assessed in line with the particular code. Whereby the SA will verify if the monitoring body possess adequate compet encies for the specific duties and responsibilities to undertake the effective monitoring of the code. The Board 9 Adopted also encourages the BE SA to redraft the requirement 5.2 following the same wording as other requirements, - I.e. start the requirement with ‘t he monitoring body shall demonstrate that its…’ ESTABLISHED PROCEDURES AND STRUCTURES

The Board notes that requirement 6.3 of the BE SA accreditation requirements refers to a code of conduct as a tool for international transfers. As part of the work pro gram for 2019 - 2020, the Board is currently working on Guidelines on Codes of Conduct as a tool for transfers. Since the Guidelines have not been adopted yet, the Board considers that the reference in requirement 6.3 of the BE SA accreditation requ irements might create confusion and may need to be amended once the Guidelines are adopted. Therefore, the Board recommends the BE SA to delete requirement 6.3 TRANSPARENT COMPLAINT HANDLING

The Board observes that the complaints procedure in requirement 7.1 is addressed only to data subjects, preventing other actors, such as organisations or associations representing data subjects or active in the field of the protection of personal data , to file a complaint with the monitoring body. The Board encourages the BE SA to amend the requirement in order to include a more comprehensive wording that does not limit the possibility to file a complaint only to data subjects .

Moreover, the Board notices that the BE SA accreditation requirements do not make any reference to the corrective measures that must be determined in the code of conduct, as per Article 40(4) GDPR. Therefore, the Board recommends the BE SA to add a reference to the list of sanctions set out in the code of conduct in cases of infringements of the code by a controller or processor adhering to it.

The Board notes that r equirement 7.3 of the BE SA accreditation requirements contains the duty of the monitoring body to make the register of the complain t s received and their outcome available to the SA on request. Whereas the Board acknowledges the intention of the BE SA to comply with the transparency principle regarding the complaints handling procedure, the Board considers that the BE SA a ccreditation requirements should contain the obligation of the monitoring body to make the decisions, or general information thereof, publicly available, as provided in the Guidelines (paragraph 74, page 24). Therefore, the Board recommends the BE SA to al ign the text of the accreditation requirements with the Guidelines, in order to ensure that the decisions, or general information thereof, are publicly available.

Furthermore , where the BE SA decides to ensure the transparency of the complaints handling procedure by requir ing that the monitoring body publishes summary information about the decisions taken in th is context , the Board recommends that the BE SA specifies the kind of information that the monitoring body is obliged to publish. For example, the monitoring body could publish, on a regular basis, statistical data with the result of the monitoring activities, such as the number of complaints receiv ed, the type of infringements and the corrective measures issued. 10 Adopted COMMUNICATING WITH THE BE SA

With regard to the communication with the BE SA, requirement 8.1 establishes that the monitoring body will communicate to the BE SA “at periodic intervals”, any action taken in case s of code infringement s and the reasons for such actions . , alongside annual reporting, providing an overview of the monitoring body’s activities and decisions. Wh ilst the Board welcomes the explicit reference to the pe riodic communication with the SA and the criteria to determine its frequency , the Board considers that there should be an appropriate level of flexibility to help guide monitoring bodies as to when to report, rather than setting the criteria too rigidly; t he criteria should take into account changing circumstances and different factors that are listed. The Board encourages the BE SA to redraft 8.1 to make it clear that the periodic reporting is flexible.

According to requirement 8.1, the frequency of the co mmunication will depend on the “ the risks for data subjects, the sensitivity and complexity of data processing that takes places within the context of the code of conduct, the size of the sector concerned and the number of code members”. In addition, the Board notes that the BE SA review of such reports would normally focus on the more serious or common infringement s and the measure s taken . The Board encourages the BE SA to make refer ence to the seriousness and frequ en cy of infringement s and to the mea sure s taken, as part of the criteria to determine the frequency of communication with the SA. Furthermore , the Board encourages the BE SA to add a reference to the communication requirements as set by the Code of Conduct itself.

The accreditation requirements contain the obligation of the monitoring body to contribute appropriately to the review of the code of conduct (requirement 11.2). The Board enc ourages accreditation requirements which require a monitoring body to develop mechanisms that enable feed back to the code owners and to any other entity referred to in the code of conduct . Some options would be to use the results of the audit process, the handling of complaints or actions taken in code infringement cases . Therefore, the Board encourages the BE SA to amend the draft, a dding that the monitoring body must have mechanisms that enable feedback to the code owner and to any ot her enti ty referred to in the code of conduct. LEGAL STATUS

According to requirement 2.4 of the BE SA accreditation requirements, the sustainability and continuity of the monitoring activities shall be demonstrated in relation to the “mechanisms to overcome the w ithdrawal of one or several code members”. The Board considers that it is unclear how the withdrawal of one or several code members would affect the performance of the monitoring body. Therefore, the Board encourages the BE SA to delete the above - mentioned reference . 11 Adopted

Furthermore, with regard to the reference to “sufficient financial resources” in requirement 2.4 of the BE SA accreditation requirements, the Board considers that the existence of sufficient financial and other resources should be accompanied with the necessary procedures to ensure the functioning of the code of conduct over time. Thereby, the Board encourages that the BE SA amend the explanatory note, adding the above - mentioned reference to “procedures”.

Finally, regarding subcontractors, r eq uirement 10.2 of the BE SA accreditation requirements states that “ t he monitoring body shall identify all of its subcontractors when it applies for accreditation.” The Board considers that the list of subcontractors is not as relevant as the actual tasks and role that they will carry out. Therefore, the Board encourages the BE SA to amend the wording, stating that the monitoring body will specify the tasks and roles that the subcontractors will carry out. CONCLUSIONS / RECOMMENDATIONS

The draft ac creditation requirements of the Belgian Supervisory Authority may lead to an inconsistent application of the accreditation of monitoring bodies and the following changes need to be made:

Regarding ‘independence’ the Board recommends that the BE SA: 1. further develop s the requirement s concerning imparti ality and independence of the monitoring body , in line with the four areas. 2. strengthens the requirements for accountability, to allow for a better understanding of its content in relation to the independence of the monitoring body, and o ffer more examples of the kind of evidence that the monitoring bodies can provide. 3. aligns the wording in requirement 3.1 to the Guidelines, by adding that the monitoring body can also have staff that has been chosen by other body independent of the code. 4. e ither deletes requirement 4.3 or softens the wording and refers to the monitoring body’s responsibilities in general or clarifies the monitoring body’s responsibilities in reference to article 83.4 c) if the GDPR.

Regarding ‘conflict of interest’ the Bo ard recommends that the BE SA: 1. amends the draft accreditation requirements to reflect that the conflict of interests shall be avoided also in relation to the monitoring body itself, and not only with regard to its personnel. 2. aligns the text with the Guidel ines and includes the obligation of the monitoring body to refrain from any action that is incompatible with its tasks and duties and to not seek nor take instructions from any person, organisation or association

Regarding ‘transparent complaint handling’ the Bo ard recommends that the BE SA: 1. adds a reference to the list of sanctions set out in the code of conduct in cases of infringements of the c ode by a controller or processor adhering to it 2. align s the text of the accreditation requirements with the Guidelines, in order to ensure that the decisions, or general information thereof, are publicly available. 3. specifies the kind of information the mo nitoring body is obliged to publish in case the BE SA decides to ensure the transparency of the complaints handling procedure by requiring that the monitoring body publishes summary information about the decisions taken in th is context .

This opinion is addressed to the Belgi um supervisory authority and will be made public pursuant to Article 64 ( 5)(b) GDPR.

According to Article 64 (7) and (8) GD PR, the supervisory authority shall communicate to the Chair by electronic means within two weeks after receiving the opinion, whether it will amend or maintain its draft decision. Within the same period, it shall provide the amended draft decision or wher e it does not intend to follow the opinion of the Board, it shall provide the relevant grounds for which it does not intend to follow this opinion, in whole or in part. The supervisory authority shall communicate the final decision to the Board for inclusi on in the register of decisions which have been subject to the consistency mechanism, in accordance with article 70 (1) (y) GDPR. For the European Data Protection Board The Chair (Andrea Jelinek)