[{"source":"EDPB News","url":"https://www.edpb.europa.eu/news/coordinated-supervision-committee-extends-scope-to-include-eurodac_en","description":"Brussels, 12 June – As of today, coordinated supervision of the European Union’s asylum and migration database (Eurodac) will be carried out by the Coordinated Supervision Committee (CSC). Eurodac is an information system initially designed to compare the fingerprints of asylum applicants and irregular migrants, which has evolved into a full asylum and migration management system. It plays a key role in implementing the Dublin III Regulation , which aims at determining the Member State responsible for examining an asylum application. Operational since 15 January 2003, this system is currently used by all EU Member States as well as Iceland , Liechtenstein , Norway and Switzerland . National DPAs supervise the processing of personal data by national authorities and its transmission to the Eurodac database (central unit), whereas the European Data Protection Supervisor (EDPS) is responsible for the supervision of the processing of personal data at the central unit and its transmission to the Member States. Coordinated supervision will now be ensured by the CSC, comprising representatives from the national DPAs and the EDPS. Background The CSC is a group of DPAs, which together ensure coordinated supervision of large-scale IT systems, and of EU bodies, offices and agencies falling under its scope. The CSC enjoys an autonomous functioning and positioning, and it adopts its own rules of procedure and working methods. The Committee is established within the framework of the EDPB and the EDPB Secretariat provides the Secretariat of the CSC. You can find more information about the CSC here","titre":"Coordinated Supervision Committee extends scope to include Eurodac","pubDate":"Mon, 22 Jun 2026 14:09:19 +0200","id":2975834},{"titre":"EDPB meets with EU Commissioner McGrath and adopts common data breach notification template","pubDate":"Mon, 22 Jun 2026 14:09:18 +0200","id":2975833,"description":"Brussels, 10 June – During its latest plenary, the EDPB met with Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. In addition, the Board has adopted a common data breach notification template . The Board held a meeting with Commissioner McGrath, engaging in a fruitful discussion about common priorities and ongoing work on areas of mutual interest . The Digital Omnibus was among the key topics that shaped the discussion. The Board reiterated that, while several proposed changes have been welcomed by the Board, it is crucial not to adopt the proposed amendments to the definition of personal data, as they risk significantly weakening individual data protection. “The digital ecosystems we regulate are dynamic, multilayered, and evolving at unprecedented pace. In an increasingly digital and competitive world, the EDPB supports simplification, but never at the expense of fundamental rights. Promoting a human-centric approach to digital regulation—one that balances innovation with dignity, growth with rights, and efficiency with trust, remains central to our mission.” EDPB Chair, Anu Talus The importance of cross-regulatory cooperation was another central theme of the discussion. Commissioner McGrath and the Board explored ways to further strengthen this cooperation and enhance their ability to collaborate effectively within the evolving digital landscape. The meeting was also an opportunity to exchange on other critically important areas of common interest, including the protection of children . The EDPB is currently working on guidelines on processing children’s data . This week, EDPB representatives also took part in a meeting with the Co-Chairs of the Special Panel on Child Safety Online organised by the European Commission. Discussions furthermore covered progress in the field of political advertisement, with a focus on the EDPB guidelines on the processing of personal data to target or deliver political advertisements under the regulation on the transparency and targeting of political advertising . In the context of this ongoing work, at its latest plenary, the EDPB has adopted the report on the dedicated stakeholder event held on 27 March 2026. The discussions also addressed international data transfers and emphasised the importance of cooperation with third countries , which is particularly crucial in reinforcing worldwide data protection standards. During the discussions, the Board emphasised that adequate funding and staffing of DPAs is essential to fulfil their tasks properly. Making GDPR compliance easier while enhancing consistency In line with the EDPB’s Helsinki Statement to make GDPR compliance easier and strengthen consistency across Europe, the EDPB has adopted a common template for data breach notifications , which will be subject to implementation process. The EDPB common template for data breach notifications has been conceived to help organisations and Data Protection Authorities (DPAs) to structure, harmonise , and unify their data breach notification processes*. The template will help ensure that notifications contain the information required by Art. 33 GDPR (on the notification of a personal data breach to the DPA), making it easier for organisations to submit a timely notification and facilitating the assessment of the case by the responsible DPAs. The template provides predefined options to choose from, and further guidance on how to fill in the fields . This will help save time and costs , particularly for smaller organisations lacking dedicated Data Protection Officers (DPOs) or legal resources. The template will be subject to public consultation until 5 August 2026 , providing stakeholders with the opportunity to share their comments and feedback on the content of the template. Following the public consultation, the EDPB will decide on the timeline for the practical implementation of the template by all DPAs.   Note to editors: You can find more information on when a data breach should be notified here","source":"EDPB News","url":"https://www.edpb.europa.eu/news/edpb-meets-with-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification-template_en"},{"titre":"Coordinated Supervision Committee extends scope to include Eurodac","pubDate":"Fri, 12 Jun 2026 14:10:55 +0200","id":2951664,"description":"Brussels, 12 June – As of today, coordinated supervision of the European Union’s asylum and migration database (Eurodac) will be carried out by the Coordinated Supervision Committee (CSC). Eurodac is an information system initially designed to compare the fingerprints of asylum applicants and irregular migrants, which has evolved into a full asylum and migration management system. It plays a key role in implementing the Dublin III Regulation , which aims at determining the Member State responsible for examining an asylum application. Operational since 15 January 2003, this system is currently used by all EU Member States as well as Iceland , Liechtenstein , Norway and Switzerland . National DPAs supervise the processing of personal data by national authorities and its transmission to the Eurodac database (central unit), whereas the European Data Protection Supervisor (EDPS) is responsible for the supervision of the processing of personal data at the central unit and its transmission to the Member States. Coordinated supervision will now be ensured by the CSC, comprising representatives from the national DPAs and the EDPS. Background The CSC is a group of DPAs, which together ensure coordinated supervision of large-scale IT systems, and of EU bodies, offices and agencies falling under its scope. The CSC enjoys an autonomous functioning and positioning, and it adopts its own rules of procedure and working methods. The Committee is established within the framework of the EDPB and the EDPB Secretariat provides the Secretariat of the CSC. You can find more information about the CSC here","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2026/coordinated-supervision-committee-extends-scope-include-eurodac_en"},{"pubDate":"Wed, 10 Jun 2026 14:10:14 +0200","id":2945457,"titre":"EDPB meets with EU Commissioner McGrath and adopts common data breach notification template","description":"Brussels, 10 June – During its latest plenary, the EDPB met with Michael McGrath, Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection. In addition, the Board has adopted a common data breach notification template . The Board held a meeting with Commissioner McGrath, engaging in a fruitful discussion about common priorities and ongoing work on areas of mutual interest . The Digital Omnibus was among the key topics that shaped the discussion. The Board reiterated that, while several proposed changes have been welcomed by the Board, it is crucial not to adopt the proposed amendments to the definition of personal data, as they risk significantly weakening individual data protection. “The digital ecosystems we regulate are dynamic, multilayered, and evolving at unprecedented pace. In an increasingly digital and competitive world, the EDPB supports simplification, but never at the expense of fundamental rights. Promoting a human-centric approach to digital regulation—one that balances innovation with dignity, growth with rights, and efficiency with trust, remains central to our mission.” EDPB Chair, Anu Talus The importance of cross-regulatory cooperation was another central theme of the discussion. Commissioner McGrath and the Board explored ways to further strengthen this cooperation and enhance their ability to collaborate effectively within the evolving digital landscape. The meeting was also an opportunity to exchange on other critically important areas of common interest, including the protection of children . The EDPB is currently working on guidelines on processing children’s data . This week, EDPB representatives also took part in a meeting with the Co-Chairs of the Special Panel on Child Safety Online organised by the European Commission. Discussions furthermore covered progress in the field of political advertisement, with a focus on the EDPB guidelines on the processing of personal data to target or deliver political advertisements under the regulation on the transparency and targeting of political advertising . In the context of this ongoing work, at its latest plenary, the EDPB has adopted the report on the dedicated stakeholder event held on 27 March 2026. The discussions also addressed international data transfers and emphasised the importance of cooperation with third countries , which is particularly crucial in reinforcing worldwide data protection standards. During the discussions, the Board emphasised that adequate funding and staffing of DPAs is essential to fulfil their tasks properly. Making GDPR compliance easier while enhancing consistency In line with the EDPB’s Helsinki Statement to make GDPR compliance easier and strengthen consistency across Europe, the EDPB has adopted a common template for data breach notifications , which will be subject to implementation process. The EDPB common template for data breach notifications has been conceived to help organisations and Data Protection Authorities (DPAs) to structure, harmonise , and unify their data breach notification processes*. The template will help ensure that notifications contain the information required by Art. 33 GDPR (on the notification of a personal data breach to the DPA), making it easier for organisations to submit a timely notification and facilitating the assessment of the case by the responsible DPAs. The template provides predefined options to choose from, and further guidance on how to fill in the fields . This will help save time and costs , particularly for smaller organisations lacking dedicated Data Protection Officers (DPOs) or legal resources. The template will be subject to public consultation until 5 August 2026 , providing stakeholders with the opportunity to share their comments and feedback on the content of the template. Following the public consultation, the EDPB will decide on the timeline for the practical implementation of the template by all DPAs.   Note to editors: You can find more information on when a data breach should be notified here","url":"https://www.edpb.europa.eu/news/news/2026/edpb-meets-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification_en","source":"EDPB News"},{"description":"Brussels, 23 March - On 17 March 2026, the EDPB conference “Cross-regulatory interplay and cooperation in the EU: a data protection perspective” took place in Brussels. The event showcased high-level discussions, featuring contributions from representatives of key EU institutions, European Data Protection Authorities, academia and industry.  Key takeaways from the panel discussions Throughout the day, three panels were held, focusing on 1) data protection and competition , 2) the Digital Markets Act (DMA) and the GDPR , and 3) the Digital Services Act (DSA) and the GDPR .  During the first panel , speakers emphasised the critical need for cooperation between regulatory bodies in the fields of data protection and competition and shared views on what regulators in the two fields can learn from each other, especially in the aftermath of the Bundeskartellamt ruling. A speaker emphasized that regulators should align their approaches and recognize synergies between the two fields, such as protecting consumers and data subjects. Others pointed out that fixing harm to end users does not always solve competition issues, and that data protection should be considered in competition analysis only when relevant, on a case-by-case basis. Panellists also highlighted the need to cooperate not just on individual cases, but on broader concepts and legal principles.  In this context, the EDPB has recently agreed to develop joint guidelines with the European Commission to address the interplay between competition law and data protection. The discussions in the second panel centred on the joint guidelines on the DMA and the GDPR , which were developed by the European Commission and the EDPB and recently underwent public consultation. The joint guidelines are an unprecedented work and a good example of regulatory cooperation paving the way for further examples ahead, in line with the  EDPB Strategy 2024-2027 and  Helsinki Statement ’s objectives to strengthen cross-regulatory cooperation. A crucial goal of the guidelines is the development of a coherent and compatible interpretation of the DMA and the GDPR while respecting the regulatory competences. It was emphasised that these guidelines help break silos, strengthen consistency, and provide further clarity and legal certainty. All of this contributes to easier compliance, which is valued by stakeholders and increases trust. At the same time, certain speakers suggested improvements to the final version of the guidelines, bearing in mind the DMA should not be given primacy over the GDPR and that the measures companies have to comply with should be proportionate.  Other examples of cooperation in this domain were also mentioned, such as the participation in the High Level Group for the Digital Markets Act and specific instances of cooperation on concrete cases.  The last panel of the day explored how the Digital Services Act (DSA) and the GDPR interact. Panellists provided the example of the protection of minors: age   verification should be effective yet fully in line with data protection legislation.  They highlighted the growing need for strong coordination between the two frameworks, including the role of the European Board for Digital Services and other ways for the Commission and the EDPB to work together. A speaker also underlined the challenges and ongoing work on cross-regulatory cooperation from the perspective of a national authority. Another speaker urged regulators to work on building a fully coherent interpretation of the two frameworks and more globally of the digital legislation. Panellists also stressed that emerging technologies such as artificial intelligence are reshaping online ecosystems and, as a result, the role of the DSA and the GDPR.  The panel concluded with a clear message: online safety under the DSA and the lawful processing of personal data are two sides of the same coin, both calling for the DSA and the GDPR to be read coherently.  Highlights from the keynote speeches The event also","titre":"EDPB conference on cross-regulatory cooperation: what we learned","pubDate":"Tue, 24 Mar 2026 14:08:47 +0100","id":2780286,"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2026/edpb-conference-cross-regulatory-cooperation-what-we-learned_en"},{"description":"Brussels, 3 December - As part of its December’s plenary meeting, the European Data Protection Board (EDPB) held yesterday an online meeting with Commissioners and representatives of Data Protection Authorities (DPAs) from the countries and the organisation with an EU adequacy decision. This meeting marked the second of its kind, following the first gathering in October 2024 . An adequacy decision is a key-mechanism in EU data protection legislation which allows free flow of personal data from Europe to third countries or an international organisation offering an adequate level of data protection.* To date, the following countries and organisation benefit from this:   Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, United Kingdom, Uruguay, United States, and the European Patent Organisation . Data Protection Authorities from those countries and the European Patent Organisation are key partners for the EDPB, playing a key role in our joint efforts to strengthen data protection worldwide. Strengthening multilateral cooperation The Board organised a first meeting in October 2024 with Data Protection Authorities from the fifteen countries with an EU adequacy decision. Following that meeting, the EDPB and the Data Protection Authorities from the countries and the organisation with an EU adequacy decision strengthened their cooperation by sharing information on some advisory works and gathering experiences on international data protection enforcement cooperation . “Our first joint meeting in October 2024 paved the way for a stronger cooperation and valuable knowledge and experience sharing on data protection. The high level of engagement shown in this second meeting by the EDPB and the Data Protection Authorities from the countries and the international organisation for which the EU adopted an adequacy decision is a clear sign of our commitment to continue working together in this shared direction.” EDPB Chair, Anu Talus Yesterday’s meeting was an opportunity for all participants to share views on past activities and updates on the next enforcement and advisory priorities .   Note to editors The European Commission has the power to determine, on the basis of Art. 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection. The adoption of an adequacy decision involves: 1) a proposal from the European Commission; 2) an opinion of the European Data Protection Board; 3) approval from representatives of EU countries; 4) adoption of the decision by the European","titre":"Strengthening data protection worldwide: EDPB meets with the countries and organisation with an adequacy decision","id":2548824,"pubDate":"Wed, 03 Dec 2025 15:56:02 +0100","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/strengthening-data-protection-worldwide-edpb-meets-countries-and-organisation_en"},{"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/draft-adequacy-decision-brazil-edpb-adopts-opinion_en","description":"Brussels, 5 November - During its latest plenary, the EDPB adopted an opinion on the European Commission’s draft decision on the adequate level of protection of personal data in Brazil .* Once adopted, the decision will ensure that personal data can flow freely from Europe to Brazil and that individuals can retain control over their data. In its opinion, requested by the Commission, the EDPB assesses whether the Brazilian data protection framework and the rules on government access to personal data transferred from Europe provide safeguards essentially equivalent to the ones in EU legislation. The Board positively notes the close alignment with EU legislation and the case law of the Court of Justice of the EU. The EDPB also examines whether the safeguards provided under the legal framework in Brazil are in place and effective. “The EDPB welcomes the alignment between Brazil and Europe’s data protection frameworks. This is a pivotal moment that will strengthen legal certainty for organisations and competent authorities transferring personal data from Europe to Brazil. We call on the European Commission to address a few remaining points to ensure the effective protection of individuals’ fundamental rights.” EDPB Chair, Anu Talus The EDPB also invites the Commission to provide further clarifications and monitor certain areas in relation to Data Protection Impact Assessments (DPIA), the limitations on transparency related to commercial and industrial secrecy, and the rules on onward transfers. As a general rule, the Brazilian data protection law does not apply to data processed by Brazilian public authorities for the exclusive purposes of public safety, national defence, State security, or the investigation and prosecution of criminal offenses. At the same time, the EDPB positively notes that the Brazilian data protection law partially applies to the processing of personal data in the context of criminal investigations and maintenance of public order, as interpreted by the Federal Supreme Court of Brazil in its case-law. The Board invites the Commission to further specify the applicability of the Brazilian data protection law, as well as the Brazilian Data Protection Authority’s investigatory and corrective powers in relation to law enforcement authorities. Finally, the Board invites the Commission to further clarify the outline of Brazil’s concept of national security.   Note to editors: * An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The European Commission has the power to determine, on the basis of Art. 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection. The adoption of an adequacy decision involves: 1) a proposal from the European Commission; 2) an opinion of the European Data Protection Board; 3) approval from representatives of EU countries; 4) adoption of the decision by the European","titre":"Draft adequacy decision for Brazil: EDPB adopts opinion","id":2548820,"pubDate":"Wed, 03 Dec 2025 15:56:01 +0100"},{"source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/edpb-annual-report-2024-protecting-personal-data-changing-landscape_en","titre":"EDPB annual report 2024: protecting personal data in a changing landscape","id":2073038,"pubDate":"Wed, 23 Apr 2025 15:51:40 +0200","description":"Brussels, 23 April - The European Data Protection Board (EDPB) has published its 2024 Annual Report . The report provides an overview of the EDPB work carried out in 2024 and reflects on important milestones, such as the adoption of the 2024-2027 strategy , the increase in Art. 64(2) consistency opinions and the continued efforts to provide guidance and legal advice. EDPB Chair Anu Talus said: “As I look back on the work carried out over the past year, I am proud to present our achievements. In 2024, we reaffirmed our commitment to safeguarding individuals’ fundamental rights to privacy and data protection in a fast-changing digital landscape. We adopted a new strategy and continued to play a central role in providing guidance and ensuring a consistent application of the General Data Protection Regulation (GDPR) across Europe. To support understanding and implementation of data protection rights and duties, we expanded our outreach activities by devoting special attention to businesses and non-expert individuals. In addition, we acquired new roles in the framework of the new digital legislations.” A new EDPB strategy The EDPB strategy 2024-2027 outlines key priorities and actions to strengthen and modernise data protection across Europe, ensure consistent enforcement of the GDPR, and address emerging challenges, including cross-regulatory cooperation. The strategy also helps strengthen the EDPB’s global presence by engaging with global partners and representing the EU data protection model in key international fora.   EDPB’s central role in providing guidance and legal advice The number of consistency opinions adopted under Art. 64(2) GDPR significantly increased. In 2024, the Board adopted eight Art. 64 (2) GDPR opinions, including on ‘Consent or Pay’ models used by large online platforms, the use of facial recognition at airports , and the use of personal data to train AI models . These opinions address a matter of general application and ensure consistency prior to enforcement. The EDPB actively participated in legislative discussions by issuing statements highlighting data protection considerations and impacts. For example, the Board adopted statements on the draft procedural regulation for GDPR enforcement , and on the DPAs role in the AI Act framework . The EDPB has also expanded its general guidance to help organisations achieve and maintain GDPR compliance. To this end, the Board adopted four new guidelines in 2024, such as the guidelines on legitimate interest and on data transfers to third country authorities .   Proactive engagement with stakeholders In 2024, the EDPB continued to engage with stakeholders to foster open dialogue and mutual understanding between regulators, industry representatives, civil society organisations, and academic institutions.  To collect relevant insights from organisations that have expertise on data protection-related topics, the Board launched public consultations on its adopted guidelines and organised two stakeholder events, related to the upcoming guidelines on “Consent or Pay” models and to the preparation of the Opinion on AI models .   Contributing to cross-regulatory cooperation New digital legislations, including the Digital Markets Act (DMA), the Digital Services Act (DSA), the AI Act, the Data Governance Act (DGA) and the Data Act, build on GDPR. To ensure consistency of application between the GDPR and these acts, the EDPB actively contributed to cross-regulatory cooperation by engaging with European and international partners, including the EU AI Office and the high-level group on the DMA.   Making the GDPR understandable and practical for all Finally, the EDPB continued its efforts to provide information on the GDPR to a broader and non-expert audience by presenting it in a clear and non-technical language. To this end, the EDPB made the Data Protection Guide for Small Business available in 18 languages. In addition, the Board has launched a series of summaries of EDPB guidelines to help"}]