EDPB publishes its opinion on the Romanian draft requirements for accreditation of a code of conduct monitoring body


On 17 February 2023, the European Data Protection Board (“EDPB”) published its Opinion 3/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for the accreditation of a code of conduct monitoring body pursuant to article 41 of the GDPR (the “Opinion“).

In brief, EDPB recommends several amendments on the following main aspects:

  • references to EDPB Guidelines 4/2021 on Codes of Conduct as tools for transfers, which are relevant in the context of monitoring codes of conduct intended for international transfers;
  • the monitoring body’s independence;
  • requirements to avoid conflict of interest;
  • the monitoring body’s expertise;
  • the monitoring body’s established procedures and structure;
  • transparent complaint handling;
  • the monitoring body’s legal status.

Within two weeks after receiving the Opinion, the Romanian DPA shall communicate whether it will amend or maintain its draft decision and:

  • in case it intends to follow the Opinion, provide the amended draft decision, or
  • in case it does not intend to follow the Opinion, in whole or in part, provide the relevant grounds in this respect.

The full Opinion is available here.