EU Art 29 Working Party issues guidance on data portability, Data Protection Officers and lead supervisory authorities

As we enter 2017, 2018 doesn’t seem that far away…and with the new General Data Protection Regulation due to come into effect from 25 May 2018, organisations are running out of time to ensure compliance. It is therefore not surprising that the Art 29 Working Party is already issuing guidance.  The most recent guidelines cover:

• The right to data portability
• The role of the data protection officer
• The establishment of the lead supervisory authority

The new rights of data portability gives greater control to individuals over their data as this right requires controllers to inform individuals about their right to receive their personal data in a structured, commonly used and machine-readable format and to transmit them to another controller.  The guidance covers the main elements of the right, its application, and how the portable data is to be provided.

The guidance relating to Data Protection Officers covers such officer's professional requirements, their independence, the scope of work and clarifies their status by making it clear that an officer will not be personally liable for any non-compliance with the GDPR.

The lead supervisory authority is the authority responsible for dealing with a cross-border data processing activity, for handling individuals complaints and managing any investigation which might include other supervisory authorities.  The guidance includes the what factors should be considered when determining an organization's main establishment, and makes it clear that there can be situations where there is more than one lead supervisory authority.

As As May 2018 approaches…

As the Art 29 Working Party delivers on its action plan, Reed Smith will publish further information about guidance on the GDPR.  Read more at Technology Law Dispatch