COMMISSION IMPLEMENTING DECISION (EU) 2018/743

of 16 May 2018

on a pilot project to implement the administrative cooperation provisions set out in Regulation (EU) 2016/679 of the European Parliament and of the Council by means of the Internal Market Information System

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (‘the IMI Regulation’)(1), and in particular Article 4(1) thereof,

Whereas:

(1) The Internal Market Information System (‘IMI’), established by Regulation (EU) No 1024/2012 is a software application accessible via the internet, developed by the Commission in cooperation with the Member States, in order to assist Member States with the practical implementation of information exchange requirements laid down in Union acts by providing a centralised communication mechanism to facilitate cross-border exchange of information and mutual assistance.

(2) Regulation (EU) 2016/679 of the European Parliament and of the Council(2) lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. It sets out procedures for administrative cooperation between the supervisory authorities, between supervisory authorities and the European Data Protection Board (‘the Board’), and where relevant, with the Commission. IMI could be an effective tool in implementing provisions on administrative cooperation set out in Regulation (EU) 2016/679. It is therefore necessary to carry out a pilot project referred to in Article 4 of Regulation (EU) No 1024/2012.

(3) In those cases where Member States have designated, in line with Regulation (EU) 2016/679, a supervisory authority to function as a single contact point, such a contact point should also be considered as a competent authority for the purposes of this pilot project.

(4) In order to ensure the consistent application of the provisions of Regulation (EU) 2016/679, outlining the cooperation between supervisory authorities, the Commission and the Board, IMI should provide for the storing of all data relevant for information exchanges. IMI should allow supervisory authorities to reuse such data for any subsequent processing in information exchanges under Articles 56, 60 to 66 of Regulation (EU) 2016/679.

(5) IMI should provide for functionality that allows the European Data protection Board to share documents and information in accordance with points (d) to (k), (m) and (x) of Article 70(1) of Regulation (EU) 2016/679 that is necessary to ensure consistent and timely processing of cases.

(6) In accordance with Article 4(2) of Regulation (EU) No 1024/2012 the Commission is to submit an evaluation of the outcome of the pilot project to the European Parliament and the Council. It is appropriate to provide for a date by which such evaluation should be submitted.

(7) Regulation (EU) 2016/679 will apply from 25 May 2018. This Decision should therefore apply from the same date.

(8) The measures provided for in this Decision are in accordance with the opinion of the Committee established by Article 24 of Regulation (EU) No 1024/2012,

HAS ADOPTED THIS DECISION:

Article 1

The pilot project

Articles 56, 60 to 66 and points (d) to (k), (m) and (x) of Article 70(1) of Regulation (EU) 2016/679 shall be subject to a pilot project to implement the administrative cooperation provisions set out in those Articles by means of the Internal Market Information System (‘IMI’).

Article 2

Competent authorities

For the purposes of the pilot project, the supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 and the European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679 (‘the Board’) shall be considered as competent authorities.

Article 3

Administrative cooperation between supervisory authorities

1. For the purposes of Article 56 of Regulation (EU) 2016/679, IMI shall, in particular, provide for the following basic technical functionality:

(a) initiation of a consultation to determine the lead supervisory authority and any other supervisory authorities concerned for a given cross-border processing;

(b) communication of an intention to participate in a consultation under point (a);

(d) communication of the lead authority's intention to handle or not to handle the case.

2. For the purposes of Article 60 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality:

(a) communication and initiation of a consultation on a draft decision;

(b) communication and initiation of a consultation on a revised draft decision;

(c) communication of an intention to participate in the consultation under point (a) and (b), including communication of relevant and reasoned objections;

(d) communication of an adopted decision.

3. For the purposes of Article 61 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality:

(a) requesting mutual assistance from another supervisory authority in the form of information and/or supervisory measures;

(b) responding to a mutual assistance request including acceptance or in exceptional cases refusals to comply with the request;

(d) communication of any cost considerations.

4. For the purposes of Article 62 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality:

(a) invitation to take part in the joint operations including joint investigations and joint enforcement measures.

(b) communication of a request to participate or not in a joint operation

Article 4

Administrative cooperation between supervisory authorities, the Board and the Commission

1. For the purposes of Article 64 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality:

(a) submitting a request for an opinion of the Board on the following:

(i) a draft decision of the competent supervisory authority concerning any of the measures listed in Article 64(1);

(ii) a matter of general application;

(iii) matter producing effects in more than one Member State;

(b) communicating a draft opinion of the Board;

(d) communicating a final opinion issued by the Board;

(e) communicating an intention to follow or not the opinion of the Board and where relevant to amend the draft decision and communicate the amended draft decision.

2. For the purposes of Article 65 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality:

(a) submitting a request for a binding decision of the Board where:

(i) a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority and the lead authority has rejected such a relevant and reasoned objection as being not relevant or reasoned in accordance with Article 60(4) of Regulation (EU) 2016/679;

(ii) there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;

(iii) a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64 (1) of Regulation (EU) 2016/679;

(iv) a competent supervisory authority does not follow an opinion of the Board issued under Article 64 of Regulation (EU) 2016/679;

(b) communicating the draft of a binding decision of the Board;

(d) communicating the binding decision adopted by the Board;

(e) communicating that a supervisory authority has notified respectively to the controller or the processor and to the data subject the final decision and the date of the notification.

3. For the purposes of Article 66 of Regulation (EU) 2016/679, IMI shall, in particular, provide for the following basic technical functionality:

(a) communication of provisional measures and the reasons for adopting them;

(b) submitting a request for an urgent opinion or an urgent decision of the Board;

(d) communication concerning the request and in particular the draft opinion or draft decision of the Board;

(e) communicating the Board's final opinion or final decision;

(f) communicating an intention to follow or not the opinion of the Board and where relevant to amend the draft decision;

(g) communicating that a supervisory authority has notified the parties concerned of the decision.

Article 5

Storage and reuse of data for subsequent processing

IMI shall provide for storage of data processed during information exchanges under Articles 56, 60 to 66 of Regulation (EU) 2016/679. Where such data is necessary for subsequent processing under those Articles, IMI shall allow for the reuse of stored data.

Article 6

Ensuring consistent application of Regulation (EU) 2016/679

IMI shall provide for functionality that allows the Board to share documents and information as referred to in points (d) to (k), (m) and (x) of Article 70 (1) of Regulation (EU) 2016/679.

Article 7

Evaluation

An evaluation of the outcome of the pilot project referred to in Article 4(2) of Regulation (EU) No 1024/2012 shall be submitted to the European Parliament and the Council by 31 December 2021.

Article 8

Entry into force and application

This Decision shall enter into force on the twentieth day following that of its publication in the

Official Journal of the European Union

It shall apply from 25 May 2018.

Done at Brussels, 16 May 2018.

For the Commission

The President

Jean-Claude JUNCKER

(1)

OJ L 316, 14.11.2012, p. 1

(2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1