On 11 April 2023, the Romanian DPA published the draft of the Decision approving the accreditation requirements for a code of conduct monitoring body according to Article 41 of the GDPR (the “Draft Decision”).
The Draft Decision is accessible here, being subject to public consultation. Proposals, suggestions, and opinions can be sent to [email protected], within 10 calendar days as of 11 April 2023 – the date of the public announcement.
On 17 February 2023, the European Data Protection Board (“EDPB”) published its Opinion 3/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for the accreditation of a code of conduct monitoring body under Article 41 of the GDPR (the “Opinion”). The update summarizing this Opinion is available here.
We highlight some of the amendments recommended by EDPB in its Opinion that were reflected by the Romanian DPA within the Draft Decision, such as:
- Amending the definition of “Accreditation”, to include that “The accreditation of a monitoring body applies to a specific code”;
- Clearly providing that an internal monitoring body cannot be set up within a code member;
- Explicitly stipulating that in case of substantial changes to the monitoring body relating to the monitoring body’s ability to function independently and effectively, such a review will always be conducted;
- Clarifying the independence of the monitoring body;
- Strengthening the requirements for accountability requirement and offering examples of the kind of evidence that the monitoring bodies can provide;
- Including in the accreditation requirements, that the procedures and measures in place to avoid conflict of interest ensure that the monitoring body shall refrain from any action incompatible with its tasks and duties;
- Detailing the level of experience and providing examples;
- Including the obligation for the monitoring body to make decisions on complaints publicly available;
- Explicitly providing that updating the code of conduct is the responsibility of the code owner.
The press release is available here (only in Romanian).
