CELEX: 52018PC0249
Language: en
Date: 2018-05-02
Title: Proposal for a COUNCIL DECISION on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning an amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement (General Data Protection Regulation)

EUROPEAN COMMISSION
            Brussels, 2.5.2018
            COM(2018) 249 final
            2018/0117(NLE)
            Proposal for a
            COUNCIL DECISION
            on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning an amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement (General Data Protection Regulation)
            (Text with EEA relevance)
            
               
         
         
            
               EXPLANATORY MEMORANDUM
            
            
            
               1.CONTEXT OF THE PROPOSAL
            
            
               •Reasons for and objectives of the proposal
            
            
               
                  The draft Decision of the EEA Joint Committee (annexed to the proposed Council Decision) aims to amend Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement in order to incorporate the General Data Protection Regulation (Regulation (EU) 2016/679)
                     1
                  .
               
            
            
               •Consistency with existing policy provisions in the policy area
            
            
               
                  The annexed draft Joint Committee Decision extends the already existing EU policy to the EEA EFTA States (Norway, Iceland and Liechtenstein). 
               
            
            
               •Consistency with other Union policies
            
            
               The extension of the EU acquis to the EEA EFTA States, through their incorporation into the EEA Agreement is conducted in conformity with the objectives and principles of that Agreement, aiming at establishing a dynamic and homogeneous European Economic Area, based on common rules and equal conditions of competition. 
            
            
               2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
            
            
               •Legal basis
            
            
               The legislation to be incorporated into the EEA Agreement is based on Article 16 of the Treaty on the Functioning of the European Union.
            
            
               Article 1(3) of Council Regulation (EC) No 2894/94
                  2
                concerning arrangements for implementing the EEA Agreement provides that the Council establishes the position to be adopted on the Union’s behalf on such Decisions, on a proposal from the Commission. 
            
            
               The Commission in cooperation with the EEAS submits the draft Decision of the EEA Joint Committee for adoption by the Council as the Union’s position. The Commission would hope to be able to present it in the EEA Joint Committee at the earliest possible opportunity.
            
            
               •Subsidiarity (for non-exclusive competence) 
            
            
               The proposal complies with the subsidiarity principle for the following reason. 
            
            
               The objective of this proposal, namely to ensure the homogeneity of the Internal Market, cannot be sufficiently achieved by the Member States and can therefore, by reason of the effects, be better achieved at Union level. 
            
            
               The process of incorporation of the EU acquis into the EEA Agreement is conducted in conformity with the Council Regulation (EC) No 2894/94 of 28 November 1994 concerning arrangements for implementing the Agreement on the European Economic Area which confirms the approach taken. 
            
            
               
                  •
                        Proportionality
               
            
         
         
            
               In accordance with the principle of proportionality, this proposal does not go beyond what is necessary in order to achieve its objective.
            
            
               •Choice of the instrument
            
            
               In conformity with Article 98 of the EEA Agreement, the chosen instrument is the EEA Joint Committee decision. The EEA Joint Committee shall ensure the effective implementation and operation of the EEA Agreement. To this end, it shall take decisions in the cases provided for in the EEA Agreement. 
            
            
               3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
            
            
               Not applicable
            
            
               4.BUDGETARY IMPLICATIONS
            
            
               There are no budgetary implications expected as a result of the incorporation of Regulation (EU) 2016/679 into the EEA Agreement.
            
            
               5.OTHER ELEMENTS
            
            
               •Justification of the main proposed adaptations 
            
            
               Participation clause (adaptation (a) and (k))
            
            
               As a result of the incorporation of the GDPR into the EEA Agreement, the supervisory authorities of the EEA EFTA States shall participate to the fullest extent possible in the so-called one-stop-shop and the consistency mechanism and shall, but for the right to vote and to stand for election as chair or deputy chairs of the Board, have the same rights and obligations as supervisory authorities of the EU Member States in the European Data Protection Board (the ‘Board’). The positions of the supervisory authorities of the EFTA States shall also be recorded separately.
            
            
               Adaptation (a) also ensures that the rules of procedures of the Board shall give full effect to the participation of the supervisory authorities of the EEA EFTA States and the EFTA Surveillance Authority with the exception of voting rights and to stand for election as chair or deputy chairs of the Board. 
            
            
               As the GDPR vests national supervisory authorities with competences to be exercised at national level and requires international coordination and convergence practice, the participation on equal footing of the supervisory authorities of the EEA EFTA States in the one-stop-shop mechanism and the consistency mechanism is necessary for coherent supervisory cooperation and convergence in the EEA.
            
            
               In order to facilitate and ensure consistent enforcement of EEA rules by the EFTA Surveillance Authority regarding the EEA EFTA States and to enable the exercise of the EFTA Surveillance Authority’s functions under Article 108 of the EEA Agreement, adaptation (k) provides that the EFTA Surveillance Authority shall have the right to participate in the meetings of the Board without voting rights and that the EFTA Surveillance Authority shall designate a representative for the Board. In addition, as stated above, adaptation (a) provides that the rules of procedures of the Board shall give full effect to the participation of the EFTA Surveillance Authority. 
            
            
               Information on negotiations with third countries (adaptation (f)) 
            
            
               The adaptation foresees that the EEA EFTA States are kept informed of consultations with third countries with the aim of adopting an adequacy decision in accordance with the procedure referred to in Article 93(3). As ensured by Article 100 of the EEA Agreement, the EFTA States participate fully in the Committee established pursuant to Article 93, except for the right to vote. 
            
            
               The adaptation also specifies that in cases where the third country or the international organisation undertakes specific obligations regarding the processing of personal data from the Member States, the EU shall take into account the situation of EEA EFTA States and discuss with third countries or international organisations possible mechanisms for subsequent possible application by the EEA EFTA States.
            
            
               Article 45(1) - Transfer of data to third countries and international organisations (adaptation (e))
            
            
               A transfer of personal data from an EEA EFTA State to a third country or an international organisation can take place on the basis of an implementing act (adequacy decision) adopted by the Commission which has been incorporated into the EEA Agreement pursuant to the normal procedures described in the EEA Agreement. The purpose of adaptation (e) is to allow for a transfer of data also where the adequacy decision is applied by an EEA EFTA State, pending a decision by the EEA Joint Committee to incorporate that adequacy decision. Adaptation (e) also foresees that before the entry into force of an adequacy decision, each EEA EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority whether it will apply such adequacy decision at the same time as the EU Member States  or not. If an EFTA State does not inform the Commission and the EFTA Surveillance Authority, it shall apply the measures at the same time as the EU Member States.
            
            
               If an agreement on the incorporation of an adequacy decision into the EEA Agreement cannot be reached in the EEA Joint Committee within twelve months of the entry into force of the adequacy decision, any EEA EFTA State may discontinue the application of such measures, until the adequacy decision has been incorporated into the EEA Agreement, and shall inform the Commission and the EFTA Surveillance Authority thereof without delay. This adaptation does not exclude the use of Article 102 of the EEA Agreement, as specified in the adaptation. 
            
         
         
            
               If an EEA EFTA State decides to discontinue applying measures adopted pursuant to Article 45(5) (measures regarding a third country, a territory or one or more specified sectors within a third country, or an international organisation, which no longer ensures an adequate level of protection) the other Contracting Parties to the EEA Agreement shall prohibit free flow of personal data to that EEA EFTA State. 
            
            
               Article 46(2) – Application of implementing acts regarding standard data protection clauses (adaptation (h))
            
            
               This adaptation is built on the same principle as adaptation (e) (see above). The adaptation makes it possible for EFTA controllers or EFTA processors to use standard data protection clauses at the same time as it enters into force in the EU, unless an EFTA State decides not to apply the measure at the same time as the EU Member States. 
            
            
               Disapplying the reference to the “Charter” (adaptation (i))
            
            
               In line with Article 7 EEA, only acts that have been incorporated into the EEA Agreement are binding upon the EFTA States. The Charter of Fundamental Rights of the European Union is an instrument of the EU’s primary law which is not binding upon non-Member States and is not relevant in an EEA context. Therefore, adaptation (i) to the GDPR disapplies the reference to the Charter contained in Article 58(4).
            
            
               Articles 63, 64(2), 65(1)(c) and 70(1)(e)  – EFTA Surveillance Authority’s requests for advice or opinion from the Board (adaptation (l)) 
            
            
               According to adaptation (l) the EFTA Surveillance Authority shall have the right to request advice or opinions from, and to communicate matters to the Board pursuant to Article 63, 64(2), 65(1)(c) and 70(1)(e). Articles where such rights and obligations should apply, and are relevant to the exercise of the EFTA Surveillance Authority’s functions under Article 109 of the Agreement, are defined in the adaptation.
            
            
               2018/0117 (NLE)
            
            
               Proposal for a
            
            
               COUNCIL DECISION
            
            
               on the position to be adopted, on behalf of the European Union, 
                  within the EEA Joint Committee concerning an amendment to 
                  Annex XI (Electronic communication, audiovisual services and information society) 
                  and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement 
               
                  (General Data Protection Regulation)
               
            
               (Text with EEA relevance)
            
            
               THE COUNCIL OF THE EUROPEAN UNION,
            
            
               Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 16 in conjunction with Article 218(9) thereof,
            
            
               Having regard to Council Regulation (EC) No 2894/94 of 28 November 1994 concerning arrangements for implementing the Agreement on the European Economic Area
                  3
               , and in particular Article 1(3) thereof,
            
            
               Having regard to the proposal from the European Commission,
            
            
               Whereas:
            
            
               (1)The Agreement on the European Economic Area
                  4
                ('the EEA Agreement') entered into force on 1 January 1994.
            
            
               (2)Pursuant to Article 98 of the EEA Agreement, the EEA Joint Committee may decide to amend, inter alia, Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement.
            
            
               (3)Regulation (EU) 2016/679 of the European Parliament and of the Council
                  5
                is to be incorporated into the EEA Agreement.
            
         
         
            
               (4)Regulation (EU) 2016/679 repeals[, with effect from 25 May 2018,] Directive 95/46/EC of the European Parliament and of the Council
                  6
               , which is incorporated into the EEA Agreement and which is consequently to be repealed under the EEA Agreement [with effect from 25 May 2018].
            
            
               (5)Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly. 
            
            
               (6)The position of the Union within the EEA Joint Committee should therefore be based on the attached draft decision,
            
            
               HAS ADOPTED THIS DECISION: 
            
            
               Article 1
            
            
               The position to be adopted, on behalf of the Union, within the EEA Joint Committee on the proposed amendment to Annex XI and Protocol 37 to the EEA Agreement, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.
            
            
               Article 2
            
            
               This Decision shall enter into force on the date of its adoption.
            
            
               Done at Brussels,
            
            
               
                     For the Council
               
               
                     The President
               
            
         
         
            
                  
                     (1)
                  
                        Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (OJ L 119, 4.5.2016, p. 1).
               
               
                  
                     (2)
                  
                        OJ L 305, 30.11.1994, p. 6–8
               
               
                  
                     (3)
                  
                        OJ L 305, 30.11.1994, p. 6.
               
               
                  
                     (4)
                  
                        OJ L 1, 3.1.1994, p. 3. 
               
               
                  
                     (5)
                  
                        Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (OJ L 119, 4.5.2016, p. 1).
               
               
                  
                     (6)
                  
                        OJ L 281, 23.11.1995, p. 31.
               
            
      
    ---documentbreak--- 
      
         
               EUROPEAN COMMISSION
            Brussels,2.5.2018
            COM(2018) 249 final
            ANNEXES
            to the
            Proposal for a Council Decision
            on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning an amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement (General Data Protection Regulation)
            
               
         
         
            
               ANNEX I
                  DECISION OF THE EEA JOINT COMMITTEE 
                  No 
            
            
               of 
            
            
               amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement
            
            
               THE EEA JOINT COMMITTEE,
            
            
               Having regard to the Agreement on the European Economic Area (“the EEA Agreement”), and in particular Article 98 thereof,
            
            
               Whereas:
            
            
               (1)Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
                  1
                is to be incorporated into the EEA Agreement.
            
            
               (2)Recognising that data protection is a fundamental right protected in various international human rights agreements.
            
            
               (3)Recognising the importance of equal rights and obligations of data controllers and processors within the EEA.
            
            
               (4)This Decision provides that the supervisory authorities of the EFTA States shall participate fully in the one-stop-shop and the consistency mechanism and shall, but for the right to vote and to stand for election as chair or deputy chairs of the Board, have the same rights and obligations as supervisory authorities of the EU Member States in the European Data Protection Board (the ‘Board’) established by Regulation (EU) 2016/679. To that effect, the supervisory authorities of the EFTA States should be included in the activities of the Board, including those of any sub-group that the Board may establish to carry out its work, and receive all information necessary to enable their effective participation including, as necessary, by means of full access to any electronic system for information exchange that may be set up by the Board. 
            
            
               (5)Regulation (EU) 2016/679 repeals[, with effect from 25 May 2018,] Directive 95/46/EC of the European Parliament and of the Council
                  2
               , which is incorporated into the EEA Agreement and which is consequently to be repealed under the EEA Agreement [with effect from 25 May 2018].
            
            
               (6)Annex XI and Protocol 37 to the EEA Agreement should therefore be amended accordingly,
            
            
               HAS ADOPTED THIS DECISION:
            
            
               Article 1
            
            
               The text of point 5e (Directive 95/46/EC of the European Parliament and of the Council) of Annex XI to the EEA Agreement shall be replaced by the following with [effect from 25 May 2018]:
            
            
               ‘32016 R 0679: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).
            
            
               The provisions of the Regulation shall, for the purposes of this Agreement, be read with the following adaptations:
            
            
               (a)The supervisory authorities of the EFTA States shall participate in the activities of the European Data Protection Board, hereinafter referred to as “the Board”. To that effect, they shall, but for the right to vote and to stand for election as chair or deputy chairs of the Board, have the same rights and obligations as supervisory authorities of the EU Member States in the Board, unless otherwise provided in this Agreement. The positions of the supervisory authorities of the EFTA States shall be recorded separately by the Board.
            
            
               The rules of procedures of the Board shall give full effect to the participation of the supervisory authorities of the EFTA States and the EFTA Surveillance Authority with the exception of voting rights and to stand for election as chair or deputy chairs of the Board.
            
         
         
            
               (b)Notwithstanding the provisions of Protocol 1 to this Agreement, and unless otherwise provided for in this Agreement, the terms “Member State(s)” and “supervisory authorities” shall be understood to include, in addition to their meaning in the Regulation, the EFTA States and their supervisory authorities, respectively.
            
            
               (c)References to Union law or Union data protection provisions shall be understood as referring to the EEA Agreement or data protection provisions contained therein, respectively.
            
            
               (d)In Articles 13(1)(f) and 14(1)(f), as regards the EFTA States, the words “applicable pursuant to the EEA Agreement” shall be inserted after the words “adequacy decision by the Commission”. 
            
            
               (e)In Article 45, as regards the EFTA States, the following shall be inserted after paragraph 1: 
            
            
               “1a. Pending a decision by the EEA Joint Committee to incorporate into the EEA Agreement an implementing act adopted pursuant to paragraphs 3 or 5 of this Article an EFTA State may decide to apply the measures contained therein.
            
            
               Each EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority, before the entry into force of any implementing act adopted pursuant to paragraphs 3 or 5 of this Article, whether it, pending a decision by the EEA Joint Committee to incorporate the implementing act into the EEA Agreement, will apply the measures contained therein at the same time as the EU Member States or not. In the absence of a decision to the contrary, each EFTA State shall apply the measures contained in an implementing act adopted pursuant to paragraphs 3 or 5 of this Article at the same time as the EU Member States.
            
            
               Notwithstanding Article 102 of the Agreement, if an agreement on the incorporation into the EEA Agreement of an implementing act adopted pursuant to paragraphs 3 or 5 of this Article cannot be reached in the EEA Joint Committee within twelve months of the entry into force of that implementing act, any EFTA State may discontinue the application of such measures and shall inform the Commission and the EFTA Surveillance Authority thereof without delay.
            
            
               The other Contracting Parties to the EEA Agreement shall, by way of derogation from Article 1(3), restrict or prohibit the free flow of personal data to an EFTA State which does not apply the measures contained in an implementing act adopted pursuant to paragraph 5 of this Article in the same way as these measures prevent the transfer of personal data to a third country or an international organisation.”
            
            
               (f)Whenever the EU enters into consultations with third countries or international organisations with the aim of adopting an adequacy decision pursuant to Article 45, the EFTA States shall be kept duly informed. In cases where the third country or the international organisation undertakes specific obligations regarding the processing of personal data from the member states, the EU will take into account the situation of EFTA States and discuss with third countries or international organisation possible mechanisms for subsequent possible application by the EFTA States.
            
            
               (g)In Article 46(2)(d) the following shall be added:
            
            
               “The supervisory authorities of the EFTA States shall have the same right as EU supervisory authorities to submit standard data protection clauses to the Commission for approval pursuant to the examination procedure referred to in Article 93(2).”
            
            
               (h)In Article 46, as regards the EFTA States, the following paragraph shall be inserted after paragraph 2:
            
            
               “2a. Pending a decision by the EEA Joint Committee to incorporate into the EEA Agreement an implementing act, the appropriate safeguards referred to in paragraph 1 may be provided for by standard data protection clauses referred to in points (c) and (d) of Article 46(2) where an EFTA State applies the measures contained therein.
            
            
               Each EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority, before the entry into force of implementing acts adopted pursuant to points (c) and (d) of Article 46(2), whether it, pending a decision by the EEA Joint Committee to incorporate the implementing act into the EEA Agreement, will apply the measures contained therein at the same time as the EU Member States or not. In the absence of a decision to the contrary, each EFTA State shall apply the measures contained in an implementing act adopted pursuant to points (c) and (d) of Article 46(2)  at the same time as the EU Member States.
            
            
               Notwithstanding Article 102 of the Agreement, if an agreement on the incorporation into the EEA Agreement of an implementing act adopted pursuant to points (c) and (d) of Article 46(2) cannot be reached in the EEA Joint Committee within twelve months of the entry into force of that implementing act, any EFTA State may discontinue the application of such measures and shall inform the Commission and the EFTA Surveillance Authority thereof without delay.”
            
            
               (i)In Article 58(4), as regards the EFTA States, the words “in accordance with the Charter” shall not apply.
            
            
               (j)In Article 59, the words “, to the EFTA Surveillance Authority” shall be inserted after the words “to the Commission”.
            
            
               (k)The EFTA Surveillance Authority shall have the right to participate in the meetings of the Board without voting right. The EFTA Surveillance Authority shall designate a representative.
            
            
               (l)Where it is relevant to the exercise of its functions under Article 109 of this Agreement, the EFTA Surveillance Authority shall have the right to request advice or opinions from, and to communicate matters to, the Board pursuant to Articles 63, 64(2), 65(1)(c) and 70(1)(e). In Articles 63, 64(2), 65(1)(c), and 70(1)(e), the words “and, where relevant, the EFTA Surveillance Authority” shall be added after the words “the Commission”.
            
            
               (m)The Chair of the Board, or the secretariat, shall communicate to the EFTA Surveillance Authority the activities of the Board, where relevant pursuant to Articles 64(5)(a) and (b), 65(5), and 75(6)(b). In Articles 64(5)(a) and (b), 65(5), and 75(6)(b), the words “and, where relevant, the EFTA Surveillance Authority” shall be added after the words “the Commission”.
            
         
         
            
               Where it is relevant to the exercise of its functions under Article 109 of this Agreement, the EFTA Surveillance Authority shall have the right to receive information from a supervisory authority of one of EFTA States concerned pursuant to Article 66(1). In Article 66(1) the words “and, where relevant, the EFTA Surveillance Authority” shall be added after the words “the Commission”.
            
            
               (n)In Article 71(1), the words “, to the Standing Committee of the EFTA States, to the EFTA Surveillance Authority” shall be inserted after the words “to the Council”.
            
            
               (o)In Article 73(1), the following sentence shall be added: 
            
            
               “The EFTA States’ members of the Board shall not be eligible to be elected as chair or deputy chairs.”’
            
            
               Article 2 
            
            
               The text of point 13 (Working Party on the Protection of Individuals with regard to the Processing of Personal Data) of Protocol 37 to the EEA Agreement shall be deleted.
            
            
               Article 3
            
            
               The texts of Regulation (EU) 2016/679 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.
            
            
               Article 4
            
            
               This Decision shall enter into force on […], provided that all the notifications under Article 103(1) of the EEA Agreement have been made
                  3*.
            
            
               Article 5
            
            
               This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.
            
            
               Done at Brussels, 
            
            
               
                     For the EEA Joint Committee
               
               
                     The President
                     
                     
                     
                     The Secretaries
                     to the EEA Joint Committee
                     
                  
            
            
               ANNEX II
               
                  Joint Declaration by the Contracting Parties
               
                  to Decision of the Joint Committee No XX of DD.MM.YY incorporating Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) into the EEA Agreement. 
            
            
               Bearing in mind the two pillar system of the EEA Agreement and with regard to the direct binding effect of decisions of the European Data Protection Board towards national supervisory authorities in the EEA EFTA States the Contracting Parties:
            
            
               –take note of the fact that decisions of the European Data Protection Board are directed at national supervisory authorities,
            
            
               –recognise that this solution does not create a precedence for future adaptations of EU acts to be incorporated into the EEA Agreement.
            
         
         
            
                  
                     (1)
                  
                        OJ L 119, 4.5.2016, p. 1.
               
               
                  
                     (2)
                  
                        OJ L 281, 23.11.1995, p. 31.
               
               
                  
                     (3)
                  *
                        [No constitutional requirements indicated.] [Constitutional requirements indicated.]