The Spanish DPA (AEPD) presented new materials to help SMEs comply with the European Data Protection Regulation
These materials have been developed by the Spanish DPA and the regional Catalan and Basque DPA’s. The new materials include a “Guide to the Regulation for Data Controllers”, “Guidelines for Drafting Contracts between Data Controllers and Data Processors”, and a “Guide for complying with the Duty to Inform”.
The Spanish DPA recently issued a press release in which it stated that “the Authority, within its preventive tasks, intends to facilitate, during the transitional period, that SMEs are aware of the impact that the Regulation will have on the way in which they process data so that they can adapt their processes to the new regulations, regulations which imply a change in the compliance model and requires a more active commitment. The purpose is to offer the as much information as possible to support SMEs since SMEs represent 99% of the Spanish companies.”
In more detail, the materials presented are the following:
- “Guide for complying with the Duty to Inform”. The GDPR attaches great importance to the information to be provided to the citizens whose data are to be processed, thereby establishing an exhaustive list of contents that must be clearly and accessibly made available. This Guide offers practical recommendations and solutions on how to provide this information.
- “Guide to the Regulation for Data Controllers”. This document sets out the main issues that organizations must take into account to fulfill the obligations contained in the Regulation. The Guide includes in its final part a Checklist with which the entities can determine if they have taken the necessary steps to be able to make a correct implementation of the GDPR.
Some of the recommendations offered in the Guide can be implemented almost immediately, because they have to do with actions that should be initiated during this transitional period. In other cases, such recommendations or proposals should only be taken into account at the time the GDPR applies, although they have been included to encourage entities to be able to anticipate when the measures are mandatory.
- “Guidelines for Drafting Contracts between Data Controllers and Processors”. The GDPR establishes that the relations between data controller and data processor must be formalized in a contract or legal act that is binding upon them and describes in detail their minimum content. These guidelines have been prepared with the aim that the contracts reflect all the contents included in the Regulation.
Related articles:
- https://www.agpd.es/portalwebAGPD/temas/reglamento/common/pdf/guia_rgpd.pdf
- https://www.agpd.es/portalwebAGPD/temas/reglamento/common/pdf/directricescontratos.pdf
- https://www.agpd.es/portalwebAGPD/temas/reglamento/common/pdf/modeloclausulainformativa.pdf
Article published by:
Belén Arribas
Miliners Abogados y Asesores Tributarios
barribas@miliners.com
+34 93 272 01 80
Interview:
Question: What is the added value of the Cloud Privacy Checks?
Belén Arribas: The Cloud Privacy Check provides cloud service customers with an initial overview of how to proceed. While the CPC cannot replace detailed examination together with a legal specialist, it lays out the fundamental legal framework, thereby saving time and costs for legal consultation.
Question: What does the first step of evaluation under the CPC look like, for example?
Belén Arribas: In the first step of the CPC, we determine whether the examined service actually deals with personal data. If the answer is yes, the second step of the Cloud Privacy Check is performed. In this step, we check whether a third party processes or has access to personal data. This depends on the technical arrangement of the service, and a so-called transition point can be defined.
Question: Are there differences between national regulations?
Belén Arribas: There are certain differences and peculiarities in almost every country, and being aware of them is precisely the point of our service. That is why we created the Data Privacy Compliance Reports, country reports that all share a common structure and juristic language. The small but significant differences I have mentioned are marked in orange in these documents.
Question: How do you plan to proceed with this approach?
Belén Arribas: We have now established an international network of legal offices in more than 30 countries, and the CPC is available in 26 languages at no cost. Our information portal is designed to help people understand and apply data protection laws easily and quickly and to compare them between countries. We want the CPC portal to become the most important source of information on data protection issues. We will integrate the new European Data Protection Regulation, answer the most common questions asked by companies, and continue to inform about the most important topics comprehensibly and free of charge.
Question: Is the CPC suitable also for larger customers with own legal departments?
Belén Arribas: Yes. It should be noted, though, that the use of the CPC should be well coordinated with the internal legal department. It should not be forgotten that the CPC cannot replace a full legal assessment. Performing such analysis is in the responsibility of the internal legal department. They usually best know the challenges faced by their company. If the CPC is discussed early with the internal legal department it can, however, help to find a common language for data protection issues within the company.
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
CPC project office: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.at