Opinion 17/2019 on the UK data protection supervisory authority draft accreditation requirements for a code of conduct monitoring body pursuant to article 41 GDPR

2 Adopted 3 Adopted The European Data Protection Board Having regard to Article 63, Article 64 (1)(c), (3) - (8) and Article 41 (3) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018,

Having regard to Article 10 and Article 22 of its Rules of Procedure of 25 May 2018, Whereas: (1) The main role of the European Data Protection Board (hereinafter “ the Board ” ) is to ensure the consistent application of the GDPR when a supervisory authority ( hereinafter “ SA ” ) intends to approve the requirements for accreditation of a code of conduct (hereinafter “code”) monitoring body pursuant to article 41. The aim of this opinion is therefore to contribute to a harmonised approach with regard to the suggested requirements that a data protection supervisory authority shall draft and that apply during the accreditation of a code monitoring body by the competent supervisory authority. Even though the GDPR does not directly impose a single set of requ irements for accreditation, it does promote consistency. The Board seeks to achieve this objective in its opinion by: firstly, requesting competent SAs to draft their requirements for accreditation of monitoring bodies based on article 41(2) GDPR and on t he Board’s “Guidelines 1/2019 on Codes of Conduct and Monitoring bodies under Regulation 2016/679” (hereinafter the “Guidelines”) , using the eight requirements as outlined in the guidelines’ accreditation section (section 12); secondly, to provide written guidance explaining the accreditation requirements; and , finally , requesting them to adopt these requirements in line with this opinion , so as to achieve an harmonised approach. (2) With reference to article 41 GDPR, the competent supervisory authorities shall adopt requirements for accreditation of monitoring bodies of approved codes. They shall, however, apply the consistency mechanism in order to allow the setting of suitable requirements ensuring that monitoring bodies carry out the monitoring of comp liance with codes in a competent, consistent and independent manner, thereby facilitating the proper implementation of codes across the Union and, as a result, contributing to the proper application of the GDPR. (3) In order for a code covering non - public authorities and bodies to be approved, a monitoring body (or bodies) must be identified as part of the code and accredited by the competent SA as being capable of effectively monitoring the code. The GDPR does not define the term ‘accreditation’. However, article 41 (2) of the GDPR outlines general requirements for the accreditation of the monitoring body. There are a number of requirements , which should be met in order to satisfy the competent supervisory authority to accredit a monitoring body. Code owner s are required to explain and demonstrate how 1 References to the “Union” made throughout this opinion should be understood as references to “EEA”. 4 Adopted their proposed monitoring body meets the requirements set out in article 41 (2) to obtain accreditation. (4) While the requirements for accreditation of monitoring bodies are subject to the consistency mechani sm, the development of the accreditation requirements foreseen in the Guidelines should take into consideration the code’s sector or specificities. Competent supervisory authorities have discretion with regard to the scope and specificities of each code, a nd should take into account their relevant legislation. The aim of the Board’s opinion is therefore to avoid significant inconsistencies that may affect the performance of monitoring bodies and consequently the reputation of GDPR codes of conduct and their monitoring bodies. (5) In this respect, the Guidelines adopted by the Board will serve as a guiding thread in the context of the consistency mechanism. Notably, in the Guidelines, the Board has clarified that even though the accreditation of a monitoring body applies only for a specific code, a monitoring body may be accredited for more than one code, provided it satisfies the requirements for accreditation for each code . (6) The opinion of the Board shall be adopted pursuant to article 64 (3) GDPR in con junction with article 10 (2) of the EDPB Rules of Procedure within eight weeks from the first working day after the Chair and the competent supervisory authority have decide d that the file is complete. Upon decision of the Chair, this period may be extende d by a further six weeks taking into account the complexity of the subject matter. HAS ADOPTED THE FOLLOWING OPINION: SUMMARY OF THE FACTS 1 The United Kingdom Supervisory Authority ( hereinafter “ UK SA ” ) has submitted its draft decision containing the accreditation requirements for a code of conduct monitoring body to the Board , requesting its opinion pursuant to article 64 (1)(c) , for a consistent approach at Union level. The decision on the completeness of the file was taken on 4 th September 2019.

I n compliance with article 10 (2) of the Board Rules of Procedure, due to the complexity of the matter at hand, the initial adoption period of eight weeks was extended by a further six weeks . ASSESSMENT General reasoning of the Board regarding the submitted draft accreditation requirements

All accreditation requirements submitted to the Board for an opinion must fully address article 41(2) GDPR criteria and should be in line with the eight areas outlined by the Board in the accreditation section of the Guidelines (section 12, pages 21 - 25). The Board opinion aims at ensuring consistency and a correct application of article 41 (2) GDPR as regards the presented draft.

This means that, when drafting the requirements for the accreditation of a body for monitoring codes according to articles 41 (3) and 57 (1)(p) GDPR, all the SAs should cover these basic core requirements

Adopted foreseen in the Guidelines, and the Board may reco mmend that the SAs amend their drafts accordingly to ensure consistency. 5 All codes covering non - public authorities and bodies are required to have accredited monitoring bodies. The GDPR expressly request SAs , the Board and the Commission to ‘encourage the drawing up of codes of conduct intended to contribute to the proper application of the GDPR, taking account of the specific features of the various processing sectors and the specific needs of micro, sma ll and medium sized enterprises’ (article 40 (1) GDP R). Therefore , the Board recognises that the requirements need to work for different types of codes, applying to sectors of diverse size, addressing various interests at stake and covering processing activities with different levels of risk.

This opinion does not reflect upon items submitted by the UK SA, which are outside the scope of article 41 (2) GDPR, such as references to national legislation. The Board nevertheless notes that national legislation should be in line with the GDP R , where required. Analysis of the UK accreditation requirements for Code of Conduct’s monitoring bodies

Taking into account that: a. Article 41 (2) GDPR provides a list of accreditation areas that a monitoring body need to address in order to be accredited ; b. Article 41 (4) GDPR requires that all codes (excluding those covering public authorities per Article 41 (6)) have an accredited monitoring body; and c. Article 57 (1) (p) & (q) GDPR provides that a competent supervisory authority must draft and publish the a ccreditation requirements fo r monitoring bodies and conduct the accreditation of a body for monitoring codes of conduct , t he Board is of the opinion that: 2.2.1 GENERAL REMARKS

The Board observes that the introduction section for the UK SA ’s accreditation re quirements refer s to both the Guidelines and the Opinion 9/2019 on the Austrian SA’s draft accreditation requirements for a code of conduct monitoring body pursuant to a rticle 41 GDPR. Whereas the reference to the Guidelines is welcomed, the Board encourages the UK SA to delete the reference to a specific Opinion, and to make a more general statement instead , considering that other opinions of the Board will follow 6 Adopted in relation to the accreditation requirements submitted by other SAs . An example coul d be: “This document should be read alongside the EDPB Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 and the relevant Opinions of the EDPB pursuant to articles 41 (3) and 64 (1) (c)GDPR ”.

With regard to the “ general notes ” , the Board is of the opinion that the references to the legal bases in the second paragraph should also include article 57 (1) (p) GDPR. The Board encourages the UK SA to amend the “general notes” section accordingly .

The Board observes that, in the section “accreditation requirements”, the UK SA establishes the validity of the accreditation to five years, after which a review of the accreditation will be carried out. The Board notes that article 4 1 GDPR does not refer to the validity of the accreditation of a monitoring body, and understands that there is margin of manoeuvre for the national SAs. Moreover, the Board notes that the accreditation requirements should be re - assessed periodically, in ord er to ensure compliance with the GDPR. However, for the sake of clarity, the Board encourages the UK SA to provide transparent information on wh at happens after the expiry of the validity of the accreditation and what the procedure will be .

The Board notes that, for some accreditation requirements, it is not clear whether a specific requirement applies to all monitoring bodies, regardless of their nature (internal or external monitoring body ), or to a specific kind of monitoring bodies. The B oard is of the opinion that the UK SA should specify , for instance, in the “general notes” section at the beginning of the document , that the requirements listed in the document shall apply to the monitoring body, regardless of whether it is internal or ex ternal. Moreover, if the UK SA intends to set out a requirement specifically for an internal or external monitoring body (see for example subsection 1.3.1 of the draft accreditation requirements which refers only to an internal monitoring body) , it should be specified clearly in the document to avoid confusion . Therefore, t he Board recommends the UK SA to amend the draft accordingly.

With regard to the explanatory note on the independence of the monitoring body ( section 1) , the Board notes that the second paragraph provides that (underline added) “ internal bodies may be required to provide evidence [...]” . However, in section 1. 1 ( Legal an d decision - making procedures ) the UK SA uses the word “shall”. The Board encourages the UK SA to adapt the wording o f the explanatory note to be in line with paragraph 16 above . 7 Adopted

With regard to section 1.1 ( L egal and decision - making procedures), the Board welcomes the approach taken in subsection 1.1.2 of the draft accreditation requirements , providing examples o f the means by which evidence o f the monitoring body’s independence can be produced . The Board considers, nonetheless, that the example referring t o “powers and operation of any committees that may be involved with an internal monitoring body” would be more comprehensive if it included a general reference to the personnel who are in charge of the decision - making of the monitoring body. The Board notes that a monitoring body does not necessarily need to be organised in committees, since individuals can also be in charge of making decisions. Therefore, the Board encourages the UK SA to amend the example taking in to account that individuals could als o be in charge of the decision - making .

W ith regard to t he evidence of the independence of the monitoring body personnel ( subsection 1.1.3 ), t he Board encourages the UK SA to follow the same approach taken in the previous subsection and provide examples as to how the monitoring body can provide such evidence .

As for the financial requirements ( section 1. 2 ) , the Board considers that the y would benefit from the inclusion of some example s with regard to the financial independence of the monitoring body, in or der to highlight how the monitoring body can demonstrate that the means by which it obtains financial support should not adversely affect its independence (subsection 1.2.3) . For instance, the monitoring body would not be considered financially independent if the rules governing its financial support allow a code member, who is under investigation by the monitoring body, to stop its financial contributions to it, in order to avoid a potential sanction from the monitoring body. T he Board encourages the UK SA to provide examples o f how the monitoring body can provide such evidence.

The Board notes that subsection 1.3.2 of the UK SA accreditation requirements contain s an example o f how the monitoring body can demonstrate organisational independence “by using different logos or names where appropriate” . The Board welcomes the introduction of examples that facilitate the practical application of the requirements. However, the Board considers that, in this particular case, the example given is more relevant for i nternal monitoring bodies . As a result, the Board encourages the UK SA to clarify if that is the case and, if so, to specify that in the example .

The Board encourages the UK SA to develop subsection 1.3.3 in more detail, in order to provide a better understanding of the criteria to consider that resources and staffing are sufficient for the monitoring body to effectively perform its tasks. In this regard, m onitoring bodies should be composed of an adequate number of personnel so that they are able to fully carry out the monitoring functions, reflecting the sector concerned and the risks of the processing activities addressed by the code of conduct. Personnel of the monitoring body shall be responsible and s hall retain authority for their decisions regarding the monitoring activities. These organisational aspects could be demonstrated through the procedure to appoint the monitoring body personnel, the remuneration of the said personnel, as well as the duratio n of the personnel’s mandate, contract or other formal agreement with the monitoring body .

With regard to the accountability requirements ( section 1.4 ) , the Board considers that the UK SA should clarify what kind of evidence is expected from the monitorin g body, in order to demonstrate its accountability. The Board welcomes the general reference to the accountability requirement in subsection 1.4.1 , but there is a need to specify its content, defining the approach that the UK SA will take in this regard , a nd how the compliance with the requirement will be assessed . This could be done, for instance, by setting up policies to increase awareness among the staff about the governance 8 Adopted structures and the procedures in place (e.g. training) . Thus, the Board recommends the UK SA to clarify the requirements f or accountability, to allow for a better understanding of its content and offer more examples of the kind of evidence that the monitoring bodies can provide.

In s ubs ection 1.4.2 of the UK SA accreditation requirements is not clear as to whether the term “any other organisation” includes also the code owner. Moreover, the Board notes that the wording could be rephrased in order to better reflect that the monitoring body shall make any kind of decision freely. Therefore, the Board encourages the UK SA to rephrase subsection 1.4.2 in order to mirror this. A drafting example could be : “ Any decisions made by the monitoring body related to its functions shall n ot be subject to approval by any oth er organisation , including the codes owner ”. 2.2.3 CONFLICT OF INTEREST

Section 2.2 of the UK SA accreditation requirements include a reference to staff “provided by a body independent from the code” . The Board acknowledges that this wording is taken from the Gu idelines and welcomes its inclusion in the UK SA accreditation requirements. Nonetheless, the Board is of the opinion that, from a practical point of view, some examples might also be helpful . An example of staff provided by a body independent of the code would be monitoring body personnel that have been recruited by an independent external company, which provides recruitment and human resources services. Therefore, the Board encourages the UK S A to add an example in line with the one provided in this paragraph. 2.2.4 EXPERTISE

The Board notes that the UK SA ’s expertise requirements include: an in - depth understanding, knowledge and experience in relation to the specific data processing act ivities in r elation to the code (section 3.1 of the UK SA’s accreditation requirements), appropriate data protection expertise and operation al experience (section 3.2) and, finally, the necessary expertise requirements as defined in the code of conduct (section 3.3).

The Board further acknowledges that the guidelines set a high bar requiring monitoring bodies to have the following expertise: an in - depth understanding of data protection issues, knowledge of the specific processing activities in relation to the code and appropriate operational experience and training for monitoring, such as auditing .

The Board considers that the accreditation requ irements need to be transparent. T hey also need to provide for monitoring bodies seeking accreditation in relation to codes tha t cover micro, small and medium - sized enter prises’ processing activities (a rticle 40 (1) GDPR) .

As required by the Guidelines, every code must fulfil the monitoring mechanism criteria (in section 6.4 of the Guidelines), by demonstrating ‘why their proposal s for monitoring are appropriate and operationally feasible’ (paragraph 41, page 17 of the Guidelines). In this context, all codes with monitoring bodies will need to explain the necessary expertise level for their monitoring bodies in order to deliver the code’s monitoring activities effectively. To that end, in order to evaluat e the expertise level required by the monitoring body , it should , in general, be tak en into account such factors as: the size of the sector concerned, the different interests involv ed and the risks of the processing activities addressed by the code . This would also be important if there are several monitoring bodies, as the code will help ensure a uniform application of the expertise requirements for all monitoring bodies covering the same code. 9 Adopted

In this regard, t he Board considers that section 3.3 of the UK SA’s accreditation requirements referring to the “ necessary expertise requirements [ … ] defined in the code of conduct ” should be better coordinated with section 3.1 and s ection 3.2 , in order to avoid confusion with regard to the scope of section 3.3 in connection with the previous two . Therefore, t he Board encourages the UK SA to clarify the relationship between those section s spec ifying t hat the monitoring body will have to meet the expertise requirements in section s 3.1 and 3.2 in any circumstances, whereas further or specific expertise requirements will only need to be met in case that the code of conduct foresee s them .

T he exper tise of each monitoring body should be a ssessed in line with the particular code. Whereby the SA will verify if the monitoring body possess es adequate competencies for the specific duties and responsibilities to undertake the effective monitoring of the code. The Board encourages the UK SA to en sure that the reference to appropriate data protection expertise, included in section 3.2, is related to the specific sector of the code.

The Board observes that the UK SA’s expertise requirements refer to the “relevant personnel” of the monitoring body in section 3.2, without further clarifying the concept and what are the criteria to consider the personnel relevant. The Board recommends the UK SA to further clarify the notion of “relevant personnel”, explaining how the relevant personne l has to be identified. The clarification could be included in the explanatory notes for this section , providing some practical examples, e.g. personnel conducting audits or making decisions on behalf of the monitoring body. 2.2.5 ESTABLISHED PROCEDURES AND STRU CTURES

The explanatory note for section 4 of the UK SA accreditation requirements establishes that “the monitoring body shall apply the penalties as defined in the code of conduct”. By only referring to penalties, the explanatory note seems to restrict the margin of manoeuvre of the monitoring body with regard to the kind of measures it can apply. The Board considers that a more comprehensive wording would also mention corrective measures, and encourages the UK SA to add the suggested reference in the expla natory note. 2.2.6 TRANSPARENT COMPLAINT HANDLING

Regarding the complaints about code members (section 5.1 of the UK SA accreditation requirements), t he Board acknowledges that complaints handling process requirements should be set at a high level and reference reasonable time frames for answering complaints . In this regard, t he Board notes that the UK SA accreditation requirements state that the monitoring body shall provide the complainant with progress reports and the outcome of the complaint within three months . In the event that, by the term “outcome”, the UK SA refers to the final deci sion in the investigation, t he Board recommends the UK SA to take a more flexible approach, by stating that the monitoring body will have to provide the complainant with progress reports or the outcome within a reasonable time frame, such as three months . I f the UK SA refers to another kind of outcome, different from the final decision of the investigation, the Board recommends the UK SA to clarify what kind of information it is referring to.

The Board notes that , in subsection 5.1.3, the UK SA’s accreditation requirements refer to corrective measures, such as “ training, issuing a warning, report to the board of the member, formal notice requiring action, suspension or exclusion from the code”. Those corrective me asures must be determined in the code of conduct, as per article 4 0 (4) GDPR. Therefore, for the sake of clarity , the Board recommends the UK SA to add a reference to the list of sanctions set out in the code of conduct in cases of infringements of the code by a controller or processor adhering to it .

The Board observes that the accreditation requirements entail that the monitoring body publishes information about the decisions taken in the context of the complaint handling procedure (subsection 5.1.6) . Publication of final decisions could have the same effect of an accessory sanction for the code member to which th e d ecision is addressed . However, general information on the complaints handled by the monitoring body would benefit from transparency. For example, the monitoring body could publish, on a regular basis, statistical data with the result of the monitoring activities, such as the number of complain t s received, the type of infringements and the corrective measures issued. Thus, for the sake of c larity, t he Board recommends that the UK SA specifies the kind of information that the monitoring body is obliged to publish. 2.2.7 COMMUNICATING WITH THE ICO

The Board recommends that the obligation for the monitoring body to report to the competent SA, without undue delay, any substantial change , is explicitly outlined in the accreditation requirements. 2.2.8 CODE REVIEW MECHANISMS

The Board observes that the UK SA ’s accreditation requirements provide that the monitoring body shall set up plans and procedure aiming at ensuring “ that the code remains relevant to the members and continues to meet the application of the GDPR ” (section 7.1). The Board note s that it is the role of the code owner to ensure the continued relevance and compliance of the c ode of conduct with applicable legislation . The monitoring body is not responsible to carry out that task, but it shall contribute to any review of the code . As a result, the Board recommends the UK SA to provide accreditation requirements that make clear that the monitoring body will contribute to any review of the code .

The Board is of the opinion that more information on the content of the report should be included in the accreditation requirements. An example would be an audit report that includes the date of the audit, its scope, the identity of the auditee, the audit conclusion, if corrective measures are applicable, if a complaint received against the auditee, etc. The Board encourages the UK SA to add more details with regard to the kind of information that the monitoring body is expected to include in the annual rep ort.

In addition, t he Board considers that the monitoring body should compile all the information related to the audits car ried on, and have that information at the disposal of the UK SA. Therefore, the Board encourages the UK SA to take this into accoun t and add such provision. 2.2.9 LEGAL STATUS

With regard to the legal status of the monitoring body, the UK SA’s explanatory note for this section states that the monitoring body “ must demonstrate sufficient financial and other resources to deliver its specific duties and responsibilities ”. The Board considers that the existence of sufficient financial and other resources should be accompanied with the necessary procedures to ensure the functioning of the code of conduct over time. Thereby, the Board encourages that the UK SA amend the explanatory note, adding the above - mentioned reference to “procedures”. CONCLUSIONS / RECOM MENDATIONS

The draft accreditation requirements of the United Kingdom Supervisory Authority may lead to an inconsistent application of the accreditation of monitoring bodies and the following changes need to be made :

As general remarks, the Board recommends that the UK SA: 1. specifies at the beginning of the document, or in t he “general notes”, that the requirements listed in the document shall apply to the monitoring body, regardless of whether it is an internal or external monitoring body , unless otherwise specified . 2. avoids the use of “should” in the text of the accreditatio n requirements.

Regarding ‘independence’ the Board recommends that the UK SA: 1. clarifies the requirements for accountability and offers more examples of the kind of evidence that the monitoring bodies can provide.

Regarding ‘expertise’ the Bo ard recommends that the UK SA: 1. clarifies the concept of “relevant personnel” by explaining how the relevant personnel will be identified and providing practical examples, for example, personnel conducting audits or making decisions on behalf of the monitoring body.

Regarding ‘transparent complaint handling’ the Bo ard recommends that the UK SA: 1. take s a more flexible approach, by stating that the monitoring body will have to provide the complainant with progress reports or the outcome within a reasonable time , such as three months . If the UK SA refers to another kind of outcome, different from the final decision of the investigation, the Board recommends that the UK SA should clarify what kind of information it is referring to. 12 Adopted 2. adds a reference to the list of sanctions as set out in the code of conduct. 3. clarifies the kind of information that the monitoring body is obliged to publish.

Regarding ‘code review mechanisms ’ the Board recommends that the UK SA : 1. makes clear that the monitoring body will contribute to any review of the code . FINAL REMARKS

This opinion is addressed to the United Kingdom supervisory authority and will be made public pursuant to Article 64 ( 5)(b) GDPR.

According to Article 64 (7) and (8) GDPR, the supervisory authority shall communicate to the Chair by electronic means within two weeks after receiving the opinion, whether it will amend or maintain its draft decision. Within the same period, it shall provide the amended draft decision or where it does not intend to follow the opinion of the Board, it shall provide the relevant grounds for which it does not intend to follow this opinion, in whole or in part. The supervisory authority shall communicate the final decision to the Board for inclusion in the register of decisions whi ch have been subject to the consistency mechanism, in accordance with article 70 (1) (y) GDPR. For the European Data Protection Board The Chair (Andrea Jelinek)