- STAR - listserv.vub.be

ACTION REQUIRED! advancing guidance and handbook
by Alessandra Calvi 10 Aug '20

10 Aug '20

Dear all, this is to update you on the feedback received so far concerning the guidance for DPAs and handbook for SMEs. For the Guidance for DPAs, we did not receive substantial comments on how to improve it, it is generally clear and understandable. Since there was interest in the questions raised by SMEs and the level of details of the replies given by NAIH, perhaps we could include some Q&A in an annex, but it is a decision of NAIH. @David Barnard-Wills<mailto:David.Barnard-Wills@trilateralresearch.com>, Lina told me that TRI offered to take care of the layout of the Guidance (for online publication). Could you please get in touch with your graphic designers and follow up? It would be great to have the Guidance ready for online publication by Thursday 20 August, so we can share it with speakers and participants a couple of weeks before the event. You may use the document in attachment as starting point. For the Handbook for SMEs, it was noted that the document is comprehensive but still too complex and theoretical. More real-life examples and practical advice would be beneficial. VUB is working on further simplifying the theoretical part, but @Gábor KULITSÁN<mailto:kulitsan.gabor@naih.hu>, @'Nagy Renáta'<mailto:nagy.renata@naih.hu> and @Julia SZIKLAY<mailto:sziklay.julia@naih.hu>, for the real-life examples and practical advice, we need NAIH help. In attachment, you may find the draft D4.1 that was circulated for feedback in May. For each topic, I included some yellow boxes where you may include further real-life examples and practical advice/tips on how to implement certain provisions of the GDPR in practice, on the basis of the questions received and the replies given via the hotline. Please also refer to decisions issued by NAIH concerning SMEs (if any). It would be great if you may send your contribution by Thursday 6 August so that, around mid-August, we can share the updated handbook with TRI for comments and finalize it before the event. Let me know if you have any questions. Thank you in advance for your support and cooperation. Best regards, Alessandra Calvi, LL.M. Researcher d.pia.lab<http://www.dpialab.org/> | Brussels Laboratory for Data Protection & Privacy Impact Assessments Research Group on Law, Science, Technology & Society (LSTS<https://lsts.research.vub.be/>) Vrije Universiteit Brussel (VUB) | Faculty of Law and Criminology Room 4B306, Pleinlaan 2, 1050, Brussels, Belgium

1 1

Draft Agenda Validation workshop
by Alessandra Calvi 06 Jul '20

06 Jul '20

Dear Gabor, dear all, Please find enclosed a draft programme for the online validation workshop on STARII guidance and on the handbook, now scheduled for Thursday 3 September 2020 from 12:00 to 14:30. Probably, the platform will be Microsoft teams or Microsoft live events. This is an internal version and none of the proposed speakers has been contacted yet (except from Mr Hijmans. Before leaving, Lina anticipated him we would have invited him as a speaker for an event in September, but he did not confirm yet). It would be great if the entire consortium could provide support to workshop by making presentations or moderating the panels. I made some suggestions concerning the possible roles. The proposed format is very much dynamic and interactive, and presupposes that the panellists are familiar with STAR II work. Accordingly, the proposed speakers (except one) have already provided more or less extended and critical feedback on the guidance and on the handbook. Of course, if you have some other potential speakers in mind, please let me know. You will notice that there are two proposed people from Belgian DPA (Mr Hijmans and Ms Peneva). Ms Peneva is coordinating the project BOOST<https://www.autoriteprotectiondonnees.be/projet-boost-pour-les-pme>, that supports SMEs compliance with the GDPR, too. I believe inviting both her and Mr Hijmans would be a good way to create synergy and increase the visibility of our projects, but let me know if the agenda looks too unbalanced. I would very much appreciate if you may provide me a feedback on the programme and on the agenda by Tuesday 7 July EOB, so that I can start inviting the speakers before summer holidays. It would be great also to have already the names of the consortium members who would like to present/moderate (if any). In that respect, please keep in mind gender balance. I am looking forward to hearing from you. In the meantime, have a lovely weekend! Alessandra Alessandra Calvi, LL.M. Researcher d.pia.lab<http://www.dpialab.org/> | Brussels Laboratory for Data Protection & Privacy Impact Assessments Research Group on Law, Science, Technology & Society (LSTS<https://lsts.research.vub.be/>) Vrije Universiteit Brussel (VUB) | Faculty of Law and Criminology Room 4B306, Pleinlaan 2, 1050, Brussels, Belgium

2 1

STAR II pre-financing payment
by nagy.renata＠naih.hu 10 Jun '20

10 Jun '20

Dear All, please, be so kind as to send us the timesheets, payslips and any other financial documents for the STAR II Q3 and Q4 as soon as possible but no later than 19.06.2020. According to the Consortium Agreement unless the required documentation is received, the pre-financing payment can not be delivered. Thank you for your kind co-operation in advance! Best regards, Renáta

1 0

Request for feedback on the DPA guidance and SME handbook developed under the STAR II project
by nagy.renata＠naih.hu 26 May '20

26 May '20

Dear Colleagues, On behalf of the STAR II Consortium let me share the guidance for DPAs on good practices in raising awareness, especially for SMEs about GDPR issues. The STAR II (SupporT small And medium enterprises on the data protection Reform II) project, running in the partnership of the National Authority for Data Protection and Freedom of Information (NAIH), the Research Group on Law, Science, Technology & Society (LSTS) of the Vrije Universiteit Brussel (VUB), and the Trilateral Research Limited (TRI IE) between 2018 and 2020, has the aim of enhancing compliance with the GDPR by assisting DPAs and SMEs. The Consortium reviewed the state of the art in DPA’s awareness-raising activities, analysed SMEs’ experience within first months of the functioning of the GDPR, ran an awareness raising campaign for SMEs and also operated a trial hotline (12 months) to respond to SMEs’ questions, measuring its performance and the most frequently asked questions. At the recent phase of the STAR II project the Partners had prepared the draft version of the digital guidance for DPAs on good practices in running a hotline and raising SME awareness. The guidance, after situating awareness raising task within the redefined role of DPAs, builds on the experience of NAIH obtained during the timespan of a hotline for SMEs. The guidance provides recommendations on how to set up and run a hotline. It pays special attention to the required infrastructure, resources required, engaged personnel, internal policies, legal implications and ethical considerations. Please share with us your comments or suggestions concerning the guidance for DPAs. Your kind contribution to the finalization of the draft guidance for DPAs is a vital factor of the validation of the document. An innovative, FAQ-based handbook (digital and printed) for SMEs on EU personal data protection law was also drafted. The draft version of the handbook is also enclosed to this e-mail. We would be grateful if you could share your thoughts on the handbook as well. Please, send your feedback to Ms. Alessandra Calvi, LL.M. (e-mail: Alessandra.Calvi(a)vub.be). We would highly appreciate if you would be so kind as to send your response until 12 June 2020. We are looking forward for your valuable co-operation. Yours sincerely, On behalf of the STAR II Consortium Renáta Nagy project assistant National Authority for Data Protection and Freedom of Information H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.

1 0

[STAR II] decision on amendment request
by kulitsan.gabor＠naih.hu 15 May '20

15 May '20

Dear All, Please be informed that the European Commission evaluated and approved our request for 4-months-long-prolongation of STAR II. This means that the submission deadlines of all remaining deliverables have been extended accordingly and the project itself will end on 30/11/2020. You can find all information in the attached axcel sheet and in the Participant Portal as well. @Lina: I know we still owe you NAIH's comments on D4.1. I've been a bit busy due to my othe tasks, but I/we will send you some feedback for sure. Best, Gábor

4 4

feedback on STAR II 4.1
by David Barnard-Wills 03 Apr '20

03 Apr '20

Dear all, First, I sincerely apologise for not getting this feedback to you earlier. I assume that D4.1 was submitted? On the positive side, this feedback can presumably be included in the final version of these deliverables. We got Alan Moore, one of our DPO team, with good practical expertise with various commercial clients to review the guidance document (You met him at the Brussels workshop). His feedback is below. Best wishes, DBW I have gone through the document and have a few suggestions: P7 Section 3.2 It can be suggested that to compensate for being awarded with limited enforcement powers….. I would hold they have significant powers beyond the ability to fine. Their powers to instruct controllers / processor top cease processing data, among others, can ultimately shut down a business without a fine being levied. To ignore these instructions can land a director in jail for up to 5 years! P8. DPAs The focus on standardisation and EDPB. Art 60 was an after thought and the general view is the it cannot operate within the prescribed timelines. The ECJ will be the ultimate arbiter for standardisation of approaches / laws / requirements but each National Authority must be free to interpret facts presented in its own way. Their independence is anchored in the EU treaties. A complication that will eventually need to be addressed. P8. 3.3 Should be aware that translation into romance languages can carry a different commutation the was intended by the Directive and DPA have a key role to explain the true intent / meaning. P9. 3.4 Typo in second paragraph. It also could be considered e the most P10. It appeared that most DPAs do not use internal guidance to direct…. What has been the result of this? A key concern in the Irish DPC has been delivering a consistent message and not providing a different answer to the same or similar callers on different occasions. P11. 4 Unclear use of language - first paragraph This initiative allowed to be confirmed that It allowed to be obtained P11.4. Would stress the importance of standardisation of response & P12 4 Add ‘c’? Implement a control process to ensure standardisation of responses to similar questions / scenarios P13. 4.2 Might mention the concern that callers may have that showing their hand may trigger an investigation. Callers need to be reassured and encouraged to participate. Approaches do differ between different DPAs. P13. 4.2.1 It was decided to create a dedicated part Following up on from this decision P15. 4.2.3 I would stress the value of face to face more as context can be complicated and the caller is subject to information and power asymmetry. P16 4.5 last paragraph We are included inclined to P21 6.2 last paragraph DPAs across the EU have reported to engage that they have engaged in P22 6.3 4.5 last paragraph Slovic suggests that the following elements play a role when evaluating risk: 1. The degree to which an individual feels in control 2. The nature of consequences and the distribution of the impact P23 6.3 2nd paragraph Which is perceived ‘as the coordinated activities to direct and control an organisation with regard to risk’ 47 This is most practically evidenced by the development and maintaining of a formal risk register. (This risk section is very cerebral I fear and wont help with the ‘how’) P23 6.3.1 Typically, the risk based approach formula approach in the GDPR includes the following elements to be taken into account: * The state of the art in terms of technology for of the means of processing (state of the art needs to be explained – does not mean the best there is but rather the minimum expectable / expected) P24 6.3.2 I would add a sentence or two on the benefits undertaking a voluntary DPIA which include: * Documented understanding of the how the system works * Known points of integration with other systems * Assigning accountability * Ensuring organisational standards (security / access etc) are being complied with * Demonstrated commitment to GDPR * General piece of mind / greater organisational resilience P24 6.3.5 I would add a piece on keeping a formal risk register of risks to data subjects, separate from ant organisation risk register of risks to the organisation in which all risks are assigned an owner and a review date. P25 6.3.5 (b) What does SMEs need to do to be accountable? Second paragraph …that the principle of accountability as an elements of good P.26 first line … that the demonstration of compliance P.26 6.3.6 (b) * Implement data protection principles (see Article 5) and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects (see Chapter III) in an effective manner; * This should done at the time of the determination of the means for processing and implemented before the time of the processing itself. (not that clear in the text.) P.27 6.3.6 (c) It should be noted that some DPAs while note defining and technical or organisation measures will nonetheless express an expectation such as the Irish DPC in terms of the use of encryption whenever possible where personal data is at rest or in transit. P.28 6.3.7 (b) 2nd paragraph It is assumed that organisations will, however, benefit more from maintaining their documentation electronically as such documentation can they can easily added to, have entries removed when obsolete, and amend entries it as necessary. However paper documentation is regarded as being appropriate for SMEs and micro enterprises. It should be added that SMEs (entities having less than 250 employees) are technically exempt from this obligation if provided they are undertaking: • processing that is not likely to result in a risk to the rights and freedoms of data subjects; • processing that is not occasional (meaning that it is not regularly / frequently undertaken); or • processing that does not include special categories of data or personal data relating to criminal convictions and offences. In reality, very few SMEs can avail of this exemption unless the process very little data. Most SMEs will usually have some special category data as part of their HR files. They can be are available on the websites…. P.29 6.3.8 (a) 2 Large scale is not defined by the legislation though different DPAs have given some guidance relevant to different activities. For SMEs who provide services into other organisations, the voluntary appointment of an internal or outsourced DPO can provide commercial and strategic advantage by communicating a commitment to data protection and promoting higher levels of trust. P.29 6.3.8 (b) A DPO may either be an employee of the SME or an external expert, but in both cases, it is fundamental that he or she is independent, in the sense that: • the DPO shall be provided of with all the necessary resources to carry on his/her tasks, in terms of money, time, workforce, time to devote to professional development etc.; • the DPO shall not receive instructions for the exercise of his/her tasks; • the DPO shall not be dismissed or penalized for the performance of his/her tasks; • the DPO shall report to the highest level of management; and • the DPO should not be in have any conflict of interest in respect to other tasks and duties (e.g. determining objects and purposes of the processing, representing the SME in legal proceeding). P.30 6.3.8 (c) Task of DPOs DPOs cannot Inform and advice the SME on the obligations arising from the GDPR and the national data protection provisions Be held accountable for the information and advice given to the SME (I do not agree with this. They are not accountable for whether their advice is implemented or not but they can be held accountable for being negligent) Monitor the compliance of the SME with the GDPR, the national data protection provisions and (eventual) its internal data policies Be considered personally responsible for non-compliance with data protection requirements Carry on awareness raising activities and training for the staff of the SME dealing with data processing Perform the DPIA. Not true. There is no reason why a DPO cannot take the lead in undertaking a DPIA especially where the skills do not exist elsewhere in the organization. but the responsibility to ensure one is done remains with the Controller. Provide advice to the SME and monitor the performance in relation to the DPIA (when a DPIA is required) Represent the SME in front of the DPA or in a court in case of proceedings. Not quite so. The DPO remains the first point of contact for data subjects and the DPAs and may be called to account for advice / provide an explanation as to how data was processed based on their monitoring of processing activities. I Act as contact point for the supervisory authority in case of prior consultation Be considered responsible for the maintenance of the register True but they are responsible for providing oversight as to whether it is maintained. Cooperate with the supervisory authority Simultaneously hold another position in the organization that helps define the means and purposes of processing of any personal data. Be contacted by data subjects willing wishing to exercise their rights Create and maintain the register of processing (in the exceptional situations where SME are required to have it one) Not True, under Art 30 it is the responsibility of the Controller P.31 6.3.9(a) Data Protection Impact Assessment (a) Background The DPIA is a new addition to the EU data protection framework. It builds on the rich experience of conducting impact assessments in other fields, in particular, on the environmental impact assessments. To be effective, impact assessments are carried out at the early stage of a project (proactive initiative), at the phase of planning or designing, and are aimed to identify and help mitigate anticipate the any potential beneficial and adverse (i.e. negative) impacts arising from the intended processing of personal data of such within the project. Impact assessments are risk based exercises that help decision-makers find the best and most beneficial solutions for the development and deployment of initiatives while protecting the rights and freedoms of data subjects. To be practical, impact assessments must be scalable, flexible and applicable inter alia for large organisations, consortia or for small and medium-sized enterprises. Any risks identified will be entered into the Data Protection Risk Register. P.32 6.3.9(c) (c) What are the elements and characteristics of the processing that may generate the high risks to rights and freedoms of individuals? The following elements that contribute to the high risks to data subjects from this provision were extracted by the (d) What situations could require a DPIA? Examples of processing operations that could trigger a DPIA: • If the SME is implementing a new tool to monitor access to office combining use of fingerprints and face facial recognition technology; • If the SME is a biotechnology company offering genetic tests directly to consumers in order to assess and predict the disease/health risks • If the SME is providing CCTV surveillance for a shopping centre or using a large number of cameras in their own premises (e) Who and when should perform a DPIA? Albeit the data processor and the data protection officer shall assist the data controller (i.e., SME), the final responsibility on for the DPIA process relies on rests with the data controller. (f) When is a DPIA is not required? • When the data processing operations are included in any list of data processing operations compiled by the DPA non which do not requiring a DPIA P.33 6.3.9(g) 4) Involve data subjects and/or their representatives, the data protection officer and any other expert (e.g. information security officer) and the data processor in the process, ideally in each phase of the assessment process. This consultation must be meaningful. P.33 6.3.9(h) (h) When a new (revised) DPIA is required? A new (i.e. revised version of) DPIA could be required if the risks resulting from the processing operations are to change, for example because a new technology is to be has been introduced, a new processor is to be engaged under contract, or because personal data is being to be used for a different purpose In that case, the review of the risk analysis made can show that the performance of a DPIA is no longer required. P.34 6.3.10(b) (b) How the security obligation is related to other provisions? This obligation also requires the controller wishing to engage a processor under contract to undertake due diligence and assess whether the guarantees offered by the data processor, in this case the cloud service provider, are sufficient. A controller must only engage such a processor where they have faith in their ability to comply with the obligations under GDPR. During this process, the controller may take into account whether the processor provides adequate documentation proving compliance with data protection principles that could be found in privacy policies, records management policies, information security policies, external audit reports, certifications and similar documentation. The controller in particular should take into account the processor’s expert knowledge (e.g. technical expertise when dealing with data breaches and security measures), reliability and its resources. A site visit may also be necessary. After carrying out the due diligence process, the controller should be able to take a decision with sufficient evidence demonstrating that the processor is suitable, it can then enter into a binding arrangement. It should be added that this due diligence process is not a one-time effort. and it needs to be regularly repeated in order The controller will have an ongoing obligation to check whether the processor is compliant and meeting their obligations either by auditing using their own staff or a trusted third party. When outsourcing the processing of personal data (e.g. for the provision of technical assistance or cloud services), the controller should must conclude a contract, another legal act or binding arrangement with the other entity already setting out clear and precise data protection obligations and the nature of processing in a detailed data processing agreement. P.35 6.3.10(c) An information security policy foreseeing the role of each user and the required permission levels (access control) appropriate to the role which minimises access to only that data necessary for that role. This includies the system administrator accounts is as an example of an appropriate organisational measure. P.35 6.3.10(d) What technical security measures can a SME take? Technical measures must therefore include both physical and computer or IT security. When considering cybersecurity, you should look at factors such as: • system security – the security of your network and information systems, including especially those which process personal data; • data security – the security of the data you hold within your systems, e.g., ensuring appropriate access controls are in place and that data is held securely through the use of suitable levels of encryption; P.36 6.3.10(e) Would add: Where Special Category Data is processed (such as health data) or personal data relating to minors, higher levels of security will be expected to be implemented and documented. P.36 6.3.11 This section should start with the definition of what is meant by a breach and explain the difference between an incident and a breach. It is confusing otherwise. P.37 6.3.11(b) Consequently, this means that the controller must have an internal procedures defined, tested and documented allowing to confirm to appropriately identify and handle any breach of security concerning personal data. In an ideal scenario, an information incident response policy should precede be in place before processing of personal data begins so that any the occurrence of an incident so that it could be used should a data breach take place. P.37 6.3.11(d) Would add a final paragraph. As GDPR is maturing, different DPAs are expressing different thresholds for the reporting of breaches. Where originally there was a fear of over reporting, the DPC in Ireland has requested a breach be reported when there is any risk identified to the data subject. This allows the Commission to identify trends and to have confidence that controllers are identifying the minor breaches and thus are able to identify the more serious beaches should they arise. I hope you find this useful. Alan From: star-bounces(a)listserv.vub.ac.be <star-bounces(a)listserv.vub.ac.be> On Behalf Of Lina JASMONTAITE Sent: 28 February 2020 13:09 To: nagy.renata(a)naih.hu; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu> Cc: 'STAR' <star(a)listserv.vub.ac.be> Subject: Re: [star] STAR II - Update on EDPB and validation workshop? Dear Renata and Gabor, Here comes D4.1 with both parts now included. We made further minor edits to Part A. We believe that the pfd version can be submitted. We look forward to your comments on Part B, which unfortunately comes a bit later than planned. Best regards, Lina From: star-bounces(a)listserv.vub.ac.be<mailto:star-bounces@listserv.vub.ac.be> <star-bounces(a)listserv.vub.ac.be<mailto:star-bounces@listserv.vub.ac.be>> On Behalf Of Lina JASMONTAITE Sent: Friday, February 28, 2020 8:45 AM To: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>> Subject: Re: [star] STAR II - Update on EDPB and validation workshop? Dear Renata and Gabor, Thank you for your additions and edits. The document to be submitted to the EC will reach you shortly after noon. Best regards, Lina From: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu> <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>> Sent: Thursday, February 27, 2020 4:31 PM To: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear Lina! Dear All! Thank you for sharing the restructured version of the guidance for DPAs. We only added minor additions/corrections. We confirm that the yellow parts are accurate. We are looking forward to the handbook (the submission deadline is 29.02.2020) Best regards, Renáta From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: Thursday, February 20, 2020 10:32 AM To: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear Renata and Gabor, Once again, thank you for preparing a revised version of the guidance for DPAs. We reviewed it now enclose an improved version of it. It includes nearly all of your report (see the document you shared; we marked in yellow parts that were used). However, the current version is restructured, rephrased and embedded in a wider context of DPAs’ awareness raising duties. We also extracted recommendations from your report and developed a graph presenting these recommendations. There are two parts marked in yellow that need to be checked for accuracy. Perhaps, you will want to add some other clarifications in the text. In particular, further additions could be made to the concluding remarks part. As we provided contributions to the initial text, we would like to be considered co-authors of this guidance. What do you think about this? The part B – the handbook for SMEs – is on a way. Best regards, Lina From: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu> <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>> Sent: Tuesday, January 28, 2020 4:16 PM To: 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com<mailto:david.barnard-wills@trilateralresearch.com>>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear All! Please, find enclosed the updated version of the guidance. Best, Renáta From: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Sent: Tuesday, January 28, 2020 10:09 AM To: 'Leanne Cochrane' <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: 'David Barnard-Wills' <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; 'Lina JASMONTAITE' <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Hi Leanne, Thanks for the update on the newsletter. Regarding the upcoming events: * The plan is to present the drafts of the guidance and the handbook at the EDPB plenary in February. However, as this is scheduled for 18-19 February, we can only do this, if the drafts are ready by then. Renáta will circulate the updated version of the guidance soon. As for the other document (handbook), Lina can provide further information. * I have no further information on the validation workshop planned for March-April 2020. Best, Gábor From: Leanne Cochrane [mailto:leanne.cochrane@trilateralresearch.com] Sent: Monday, January 27, 2020 6:25 PM To: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Sziklay Júlia <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: STAR II - Update on EDPB and validation workshop? Hi Gabor, I hope you are keeping well. Our dissemination team is preparing to send out the STAR II newsletter we mentioned on our previous calls. It will be sent out this Thursday with links to the approved deliverables and some blogs. We are also including a section on upcoming events and I wanted to check with NAIH if we had any further information on the following two events: * A presentation by NAIH to the EDPB on the STAR II project planned for the February EDPB plenary (18th-19th) in Brussels. * A Validation workshop for the STAR II outputs, namely a 'A Risk Focused Handbook for SMEs' and a 'Guidance for DPAs' planned for March-April 2020 in Brussels. Can I just check this information is still current and there is nothing more specific we can add at this stage? I would be grateful if you can cc all in the reply as I am off tomorrow and the dissemination team are in need of the confirmation. Thanks and best wishes, Leanne [A képet a feladó eltávolította.]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane

8 27

Re: [star] Star II - publication for WP5
by Lina JASMONTAITE 02 Apr '20

02 Apr '20

Dear David, Once again, many thanks for going through the draft paper. You were part of our discussions with Leanne, guided us during the process and contributed to the paper, so I think you should share co-authorship of this piece. I removed the comments, accepted track changes and made some edits. As you can’t see them immediately in the document, I will summarise them here: * I left the term EU legislator but added an additional explanation in a footnote (see footnote 19) pointing out the three co-legislating institutions: EC, EP, the Council. I think of a term ‘the EU legislator’ as a synonym to ‘the EU legislative procedure’. * I understand why you suggested to replace ‘enforcement’ with ‘governance’ but I do not agree with this suggestion. I went back to scholars on regulatory theories and several of them suggest that enforcement includes both compliance (soft enforcement) and deterrence approaches (hard enforcement). I stand by this idea, so I added a footnote explaining this view (see footnote 14). * You questioned what is meant by the role of the leader, it comes from the writing of Hielke and others, where it is suggested that awareness raising tasks fall within the scope of this role. * You questioned the need to have a section describing survey methodology. I wouldn’t add it to the paper but I included a reference to it in a footnote. * I added a definition of SME Association: Within the scope of this article we use a term SME Associations to refer to different types of organisations that provide a meaningful support, advice, guidance and training services to SMEs on their functioning, ranging from trade and sectoral associations to chambers of commerce. They can be financed through membership fees or through public sources of funding. * The following statement was added to explain why we haven’t judged the quality of such guidance. Think about it as a disclaimer: The perception of these guidelines and their usefulness was not explored within the scope of STAR II questions because originally more narrow focus was placed on the relationship between DPAs and SMEs directly, before the potential for the role of SME Associations emerged. * I really like the idea of DPAs and SME associations co-creating guidance for SMEs. * I didn’t add info about projects mentioned at the end of the paper as there are links provided to their websites. * Instead ‘of good quality compliance advice’, I opted in for ‘an improved quality compliance advice’. If you are ok with this, I will send it over to the EDPL. Looking forward to your reply! Best regards, Lina From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: 18 March 2020 13:57 To: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>> Cc: Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Subject: RE: Star II - publication for WP5 Hi David, Attached is the last version of it. Any comments and suggestions are very much appreciated. Perhaps, there’s sth that we forgot. Best regards, Lina From: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>> Sent: Wednesday, March 18, 2020 10:57 AM To: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>> Subject: RE: Star II - publication for WP5 Hi Lina, I’ll review it if you like. Can you send me the latest version? DBW From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: 17 March 2020 17:08 To: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>> Subject: RE: Star II - publication for WP5 Dear Leanne, I hope this email finds you well during these uneasy times. I would like to ask you to review the paper in the upcoming week or two, so we can send it for a review to the EDPL. I will be going on a maternity leave in mid-April and will not be available till late July. Of course, if we are asked to make some changes or implement comments of a reviewer, I will find time for that. In any case, even if the project is prolonged, it would be great to proceed with the publication as soon as possible as it takes some time. Best regards, Lina From: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Sent: Sunday, February 16, 2020 8:40 PM To: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com<mailto:david.barnard-wills@trilateralresearch.com>>; nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>; Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>>; 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>>; Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>>; Carlotta RIGOTTI <Carlotta.Rigotti(a)vub.be<mailto:Carlotta.Rigotti@vub.be>> Subject: Re: Star II - publication for WP5 Dear Lina, Many thanks for this and the previous email. I am on leave until Tuesday 25th February. I will schedule time at that stage to take up the article again. With best wishes, Leanne [https://trilateralresearch.co.uk/wp-content/uploads/2018/12/tri-logo.jpg]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane I send emails at a time that suits me. I don’t expect you to read, action or respond out of your own working hours. ________________________________ From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: 10 February 2020 15:34 To: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu> <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>>; 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>>; Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>>; Carlotta RIGOTTI <Carlotta.Rigotti(a)vub.be<mailto:Carlotta.Rigotti@vub.be>> Subject: Star II - publication for WP5 Dear Leanne, Following up on the discussions last autumn, I prepared yet another draft of an article foreseen in task 5.2. It’s also saved on the shared folder with additional materials. While I tried to keep it focused, I think some important issues remain untouched, such as that there’s a lot of guidance available by DPAs though it is not always clear how to find the relevant one; national guidance documents usually build on the EDPB opinions or the EC, so guidance on EU level for SMEs should be encouraged. Now we suggested that such guidance should be primarily developed at national level. Throughout the contribution we mostly assume that there are distinctive needs of SMEs but we never elaborate on them. Do you think we need to further elaborate on such needs? Perhaps, SME association expectations from DPAs should be also more nuanced? @Kulitsán Gábor<mailto:kulitsan.gabor@naih.hu> & @Nagy Renáta<mailto:nagy.renata@naih.hu> perhaps you could provide some comments on this contribution? Best regards, Lina Jasmontaite Doctoral researcher Law, Science, Technology and Society (LSTS) Vrije Universiteit Brussel (VUB) Brussels Privacy Hub (BPH) Room 4B306, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be<https://lsts.research.vub.be/> | www.brusselsprivacyhub.org<http://www.brusselsprivacyhub.org/> [VUB-LSTS_RGB]

1 0

Re: [star] STAR II - Update on EDPB and validation workshop?
by Lina JASMONTAITE 05 Mar '20

05 Mar '20

Dear Renata and Gabor, Once again, thank you for preparing a revised version of the guidance for DPAs. We reviewed it now enclose an improved version of it. It includes nearly all of your report (see the document you shared; we marked in yellow parts that were used). However, the current version is restructured, rephrased and embedded in a wider context of DPAs’ awareness raising duties. We also extracted recommendations from your report and developed a graph presenting these recommendations. There are two parts marked in yellow that need to be checked for accuracy. Perhaps, you will want to add some other clarifications in the text. In particular, further additions could be made to the concluding remarks part. As we provided contributions to the initial text, we would like to be considered co-authors of this guidance. What do you think about this? The part B – the handbook for SMEs – is on a way. Best regards, Lina From: nagy.renata(a)naih.hu <nagy.renata(a)naih.hu> Sent: Tuesday, January 28, 2020 4:16 PM To: 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear All! Please, find enclosed the updated version of the guidance. Best, Renáta From: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Sent: Tuesday, January 28, 2020 10:09 AM To: 'Leanne Cochrane' <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: 'David Barnard-Wills' <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; 'Lina JASMONTAITE' <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Hi Leanne, Thanks for the update on the newsletter. Regarding the upcoming events: * The plan is to present the drafts of the guidance and the handbook at the EDPB plenary in February. However, as this is scheduled for 18-19 February, we can only do this, if the drafts are ready by then. Renáta will circulate the updated version of the guidance soon. As for the other document (handbook), Lina can provide further information. * I have no further information on the validation workshop planned for March-April 2020. Best, Gábor From: Leanne Cochrane [mailto:leanne.cochrane@trilateralresearch.com] Sent: Monday, January 27, 2020 6:25 PM To: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Sziklay Júlia <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: STAR II - Update on EDPB and validation workshop? Hi Gabor, I hope you are keeping well. Our dissemination team is preparing to send out the STAR II newsletter we mentioned on our previous calls. It will be sent out this Thursday with links to the approved deliverables and some blogs. We are also including a section on upcoming events and I wanted to check with NAIH if we had any further information on the following two events: * A presentation by NAIH to the EDPB on the STAR II project planned for the February EDPB plenary (18th-19th) in Brussels. * A Validation workshop for the STAR II outputs, namely a 'A Risk Focused Handbook for SMEs' and a 'Guidance for DPAs' planned for March-April 2020 in Brussels. Can I just check this information is still current and there is nothing more specific we can add at this stage? I would be grateful if you can cc all in the reply as I am off tomorrow and the dissemination team are in need of the confirmation. Thanks and best wishes, Leanne [A képet a feladó eltávolította.]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane

3 5

[STAR II] Deliverable D4.2 rejected
by Kulitsán Gábor 24 Feb '20

24 Feb '20

Dear All, The PO has requested the revision of Deliverable D4.2. (The rejection letter and the deliverable are enclosed). In addition to the letter the policy unit made the following comments (see "Process communications" in the Research Portal): "Regarding the other deliverable submitted: WP4 D4.2 D14 Third validation workshop (Dublin) * This deliverable was rendered moot by the fact that the last two events are going to be merged in one * It also indicates that STAR II was presented during this CPDP in Brussels, * We would therefore expect that we will therefore not pay the full amount since only one, not two events will be organised * Since the first event in Dublin was very disappointing (only 14 attendance, when 100 were foreseen), we could ask for improved dissemination of the event to be included in the deliverable, and for it to be resubmitted." If I understand correctly, the EC asks us to briefly report on the CPDP conference. @VUB and/or @TRI: Could you please summarize what happened at the CPDB and what was the outcome? Thanks. Gábor

3 4

STARII: a draft programme for the workshop in BXL
by Lina JASMONTAITE 20 Feb '20

20 Feb '20

Dear Gabor, dear all, Please find enclosed a draft programme for the validation workshop on the guidance and on the handbook that is scheduled for 22 of April. It’s our internal version and it includes some provisional speakers. None of them have been contacted so far but we are going to approach them next week after receiving your feedback. If you have some speakers in mind that we should consider/invite, please let us know. We intend to organise nearly a full day event on the second day of the preliminary EDPB meeting in a hope that some DPA representatives will join the event or at least a part of it. From the programme you can see that we also hope that you will provide support to the event by making presentations, in particular, the ones in the afternoon part on DPAs’ hotline practices and on the dedicated hotline for SMEs. We would appreciate receiving your comments by Wednesday morning or earlier if that is possible. Wishing you a nice weekend, Lina Jasmontaite Doctoral researcher Law, Science, Technology and Society (LSTS) Vrije Universiteit Brussel (VUB) Brussels Privacy Hub (BPH) Room 4B306, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be<https://lsts.research.vub.be/> | www.brusselsprivacyhub.org<http://www.brusselsprivacyhub.org/> [VUB-LSTS_RGB]

4 4

2024

2023

2022

2021

2020

2019

2018

2017

STAR