On 17 February 2023, the European Data Protection Board (“EDPB”) published its Opinion 3/2023 on the draft decision of the competent supervisory authority of Romania regarding the approval of the requirements for the accreditation of a code of conduct monitoring body pursuant to article 41 of the GDPR (the “Opinion“).
In brief, EDPB recommends several amendments on the following main aspects:
- references to EDPB Guidelines 4/2021 on Codes of Conduct as tools for transfers, which are relevant in the context of monitoring codes of conduct intended for international transfers;
- the monitoring body’s independence;
- requirements to avoid conflict of interest;
- the monitoring body’s expertise;
- the monitoring body’s established procedures and structure;
- transparent complaint handling;
- the monitoring body’s legal status.
Within two weeks after receiving the Opinion, the Romanian DPA shall communicate whether it will amend or maintain its draft decision and:
- in case it intends to follow the Opinion, provide the amended draft decision, or
- in case it does not intend to follow the Opinion, in whole or in part, provide the relevant grounds in this respect.
The full Opinion is available here.
