France’s Commission Nationale de l’Informatique et des Libertés (“CNIL”) provides great tools and resources as well.
Germany’s Bundesbeauftragte für den Datenschutz und die Informationsfreiheit published the Federal Data Protection Act to adapt GDPR. Germany provided some extensive guidance on GDPR here. Germany also publishes the standard data protection model, SDPM, in English on its site. Also available from the site are guidance materials about GDPR from the German Data
The United Kingdom’s Information Commissioner’s Office (“ICO”) is a great resource for companies looking for clear DPA guidance. The ICO has provided a Guide to the GDPR which is very targeted and comprehensive as well as resources for organizations including several guides. Getting Ready For GDPR Resources is a nice package of information prepared by
The European Commission – Data Protection links to the Article 29 Working Party Guidelines which supplement our understanding of GDPR:
The European Commission – Data Protection provides links to EC data protection policies, information and services. The Commission provides the official GDPR text in multiple languages, describes the European Data Protection Board and its responsibilities, provides detailed guidance and resources on data transfers outside the EU, and some focused discussion of the changes to
Recently, I have been asked several times where there are good, official resources on GDPR. The following series of posts provide links to these resources. We will post additional resources from time-to-time.
See European Regulation on the Protection of Personal Data Guide Sub-Contractor Edition, September 2017.
The Article 29 Working Party updated the Guidelines on PIAs and evaluation of risk guidance on October 4, 2017:
CNIL created a PIA Infography to outline the main principles. Keep
CNIL, the French DPA, published a new Compliance Pack called “Connected Vehicles: A Compliance Pack for Responsible Data Use” on October 17, 2017. CNIL broke its guidance into three scenarios:
The Article 29 Working Party published two Guidelines related to GDPR:
Guidelines on Personal data breach notification under Regulation 2016/679, wp250
The Guidelines are open for comments until November, 28, 2017. Comments should be sent to JUST-ARTICLE29WP-SEC@ec.europa.eu and presidenceg29@cnil.fr.
Facebook’s experience with regulators is a cautionary tale. Several European Union Data Protection Authorities formed a Contact Group to coordinate their investigations of Facebook. The moral of this story is that when one regulator in the EU becomes interested in reviewing privacy compliance, do not become surprised if there are soon several DPA’s who