Implementing decision 2018/743 - Pilot project to implement the administrative cooperation provisions set out in Regulation 2016/679 by means of the Internal Market Information System - Main contents

EN

Official Journal of the European Union

L 123/115

The Internal Market Information System (‘IMI’), established by Regulation (EU) No 1024/2012 is a software application accessible via the internet, developed by the Commission in cooperation with the Member States, in order to assist Member States with the practical implementation of information exchange requirements laid down in Union acts by providing a centralised communication mechanism to facilitate cross-border exchange of information and mutual assistance.

Regulation (EU) 2016/679 of the European Parliament and of the Council (2) lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. It sets out procedures for administrative cooperation between the supervisory authorities, between supervisory authorities and the European Data Protection Board (‘the Board’), and where relevant, with the Commission. IMI could be an effective tool in implementing provisions on administrative cooperation set out in Regulation (EU) 2016/679. It is therefore necessary to carry out a pilot project referred to in Article 4 of Regulation (EU) No 1024/2012.

In those cases where Member States have designated, in line with Regulation (EU) 2016/679, a supervisory authority to function as a single contact point, such a contact point should also be considered as a competent authority for the purposes of this pilot project.

In order to ensure the consistent application of the provisions of Regulation (EU) 2016/679, outlining the cooperation between supervisory authorities, the Commission and the Board, IMI should provide for the storing of all data relevant for information exchanges. IMI should allow supervisory authorities to reuse such data for any subsequent processing in information exchanges under Articles 56, 60 to 66 of Regulation (EU) 2016/679.

IMI should provide for functionality that allows the European Data protection Board to share documents and information in accordance with points (d) to (k), (m) and (x) of Article 70(1) of Regulation (EU) 2016/679 that is necessary to ensure consistent and timely processing of cases.

In accordance with Article 4(2) of Regulation (EU) No 1024/2012 the Commission is to submit an evaluation of the outcome of the pilot project to the European Parliament and the Council. It is appropriate to provide for a date by which such evaluation should be submitted.

Regulation (EU) 2016/679 will apply from 25 May 2018. This Decision should therefore apply from the same date.

The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 24 of Regulation (EU) No 1024/2012,

initiation of a consultation to determine the lead supervisory authority and any other supervisory authorities concerned for a given cross-border processing;

communication of an intention to participate in a consultation under point (a);

communication of an intention to handle a case locally;

communication of the lead authority's intention to handle or not to handle the case.

communication and initiation of a consultation on a draft decision;

communication and initiation of a consultation on a revised draft decision;

communication of an intention to participate in the consultation under point (a) and (b), including communication of relevant and reasoned objections;

communication of an adopted decision.

requesting mutual assistance from another supervisory authority in the form of information and/or supervisory measures;

responding to a mutual assistance request including acceptance or in exceptional cases refusals to comply with the request;

communication of the progress and the result of measures taken in order to respond to the request;

communication of any cost considerations.

invitation to take part in the joint operations including joint investigations and joint enforcement measures.

communication of a request to participate or not in a joint operation

communication of the agreement to conduct a joint operation.

submitting a request for an opinion of the Board on the following:

communicating a draft opinion of the Board;

communication concerning the request and in particular the draft opinion of the Board;

communicating a final opinion issued by the Board;

communicating an intention to follow or not the opinion of the Board and where relevant to amend the draft decision and communicate the amended draft decision.

submitting a request for a binding decision of the Board where:

communicating the draft of a binding decision of the Board;

communication on the request and in particular the binding decision of the Board;

communicating the binding decision adopted by the Board;

communicating that a supervisory authority has notified respectively to the controller or the processor and to the data subject the final decision and the date of the notification.

communication of provisional measures and the reasons for adopting them;

submitting a request for an urgent opinion or an urgent decision of the Board;

communicating a draft opinion or a draft decision of the Board;

communication concerning the request and in particular the draft opinion or draft decision of the Board;

communicating the Board's final opinion or final decision;

communicating an intention to follow or not the opinion of the Board and where relevant to amend the draft decision;

communicating that a supervisory authority has notified the parties concerned of the decision.