Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18

2023-04-18T15:01:41Z

1 revision imported: GDPRHUB import 2023 04 18

New page

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 69 GDPR|←]] Article 70 - Tasks of the Board [[Article 71 GDPR|→]]
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

== Legal Text ==
<br /><center>'''Article 70 - Tasks of the Board'''</center>

<span id="1">1. The Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own initiative or, where relevant, at the request of the Commission, in particular:</span>

::<span id="1a">(a) monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks of national supervisory authorities;</span>

::<span id="1b">(b) advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;</span>

::<span id="1c">(c) advise the Commission on the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules;</span>

::<span id="1d">(d) issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of personal data from publicly available communication services as referred to in Article 17(2);</span>

::<span id="1e">(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;</span>

::<span id="1f">(f) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2);</span>

::<span id="1g">(g) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach;</span>

::<span id="1h">(h) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1).</span>

::<span id="1i">(i) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for personal data transfers based on binding corporate rules adhered to by controllers and binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47;</span>

::<span id="1j">(j) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1);</span>

::<span id="1k">(k) draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83;</span>

::<span id="1l">(l) review the practical application of the guidelines, recommendations and best practices referred to in points (e) and (f);</span>

::<span id="1m">(m) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2);</span>

::<span id="1n">(n) encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42;</span>

::<span id="1o">(o) carry out the accreditation of certification bodies and its periodic review pursuant to Article 43 and maintain a public register of accredited bodies pursuant to Article 43(6) and of the accredited controllers or processors established in third countries pursuant to Article 42(7);</span>

::<span id="1p">(p) specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under Article 42;</span>

::<span id="1q">(q) provide the Commission with an opinion on the certification requirements referred to in Article 43(8);</span>

::<span id="1r">(r) provide the Commission with an opinion on the icons referred to in Article 12(7);</span>

::<span id="1s">(s) provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country or international organisation, including for the assessment whether a third country, a territory or one or more specified sectors within that third country, or an international organisation no longer ensures an adequate level of protection. To that end, the Commission shall provide the Board with all necessary documentation, including correspondence with the government of the third country, with regard to that third country, territory or specified sector, or with the international organisation.</span>

::<span id="1t">(t) issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65, including in cases referred to in Article 66;</span>

::<span id="1u">(u) promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;</span>

::<span id="1v">(v) promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with international organisations;</span>

::<span id="1w">(w) promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide.</span>

::<span id="1x">(x) issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and</span>

::<span id="1y">(y) maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.</span>

<span id="2">2. Where the Commission requests advice from the Board, it may indicate a time limit, taking into account the urgency of the matter.</span>

<span id="3">3. The Board shall forward its opinions, guidelines, recommendations, and best practices to the Commission and to the committee referred to in Article 93 and make them public.</span>

<span id="4">4. The Board shall, where appropriate, consult interested parties and give them the opportunity to comment within a reasonable period. The Board shall, without prejudice to Article 76, make the results of the consultation procedure publicly available.</span>

==Relevant Recitals==
{{Recital/124 GDPR}}{{Recital/136 GDPR}}{{Recital/139 GDPR}}

== Commentary ==
Article 70(1) GDPR lists the tasks of the EDPB (Article 70(1)(a)-(y), which share the overall aim of ensuring the GDPR's consistent application across the EU.

===(1) Tasks to Ensure GDPR's Consistent Application===

Articles 70(1)(a) and (t) GDPR grant the EDPB an important and new role regarding the GDPR’s consistency mechanism.<ref>''Schiedermair'' in Simitis et al., Data Protection Law, Article 70 GDPR, margin numbers 6-8 (C.H. Beck 2019, 1st edition).</ref> In particular, the EDPB is required to issue: opinions on draft measures by supervisory authorities (“''SA''”) under the consistency mechanism (Article 64(1) GDPR); opinions on matters of general application, or producing effects in more than one member state, in particular where a competent SA does not comply with obligations for mutual assistance (Article 64(2) GDPR); binding decisions under the dispute resolution procedure (Article 65 GDPR); and binding decisions where a SA has adopted provisional measures under the urgency procedure and considers a need for definitive action (Article 66 GDPR). The EDPB adopted its first binding decision under the Article 65 GDPR dispute resolution procedure on 9 November 2020 on a draft decision by the Irish SA concerning a data breach by Twitter, which SAs in Austria, Denmark, France, Germany, Hungary, Italy and Spain had objected to.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR) Update of Selected Articles, Article 68 GDPR, p. 240 (Oxford University Press 2021).</ref> The EDPB asked the Irish SA to re-assess the elements it relied upon to calculate the fine to be imposed on twitter, and to amend its draft decision by increasing this fine in order to ensure it fulfils its purpose as a corrective measure.<ref>EDPB, 9 November 2020, Twitter International Company, Decision 01/2020 (available [https://edpb.europa.eu/sites/default/files/files/file1/edpb_bindingdecision01_2020_en.pdf here]).</ref>

Article 70(1)(b) GDPR states that the Commission may consult the EDPB on any issue regarding data protection in the Union. This provision is similar to that in Article 42 Regulation 2018/1725, which states the Commission may consult either: (1) the EDPS, in relation to legislative proposals or drafts implementing measures impacting data protection, or (2), both the EDPS and EDPB jointly, where such proposals are of particular importance. On 13 May 2019, the Commission submitted its first request for a joint opinion of this kind on the draft Implementation Decision on eHealth.<ref>EDPB-EDPS, Guidelines 3/2019 on processing of personal data through video devices, 29 January 2020.</ref> The EDPB and EDPS have also submitted joint advice to the European Parliament, although the GDPR does not specifically provide for this.<ref>EDPB-EDPS Joint Response to the LIBE Committee on the impact of the US Cloud Act on the European legal framework for personal data protection, referenced by ''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR) Update of Selected Articles, Article 68 GDPR, p. 240 (Oxford University Press 2021).</ref>

Under Article 70(1)(e) GDPR, the EDPB must examine – either on its own initiative or in response to a request from a member of the Commission – questions covering the GDPRs application, as well as issue guidelines, recommendations, and best practices. Articles 70(1)(f)-(j) GDPR specify areas in which these should be issued, namely: profiling; data breaches and the risk to data subject rights and freedoms; binding corporate rules; and data transfers. As Schiedermair emphasises, these guidelines are an “''important building block in the effort to gradually dismantle''” the varied enforcement of data protection law by member states.<ref>''Schiedermair'' in Simitis et al., Data Protection Law, Article 70 GDPR, margin number 4 (C.H. Beck 2019, 1st edition).</ref> The Meijers Committee – an independent group researching and advising on privacy law – has highlighted the potential risks of soft law instruments such as these guidelines, recommendations, and best practices, which are in practice often treated as law. Soft law can consequently have legal effects, which means it requires a specific legal basis. Moreover, soft law may lack “''safeguards, transparency and the involvement of democratically chosen bodies or interested citizens or organisations associat'' edition”.<ref>Meijers Committee, Note on the use of soft law instruments under EU law, in particular in the area of freedom, security and justice, and its impact on fundamental rights, democracy and the rule of law, 9 April 2018, referenced in ''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR) Update of Selected Articles, Article 68 GDPR, p. 243 (Oxford University Press 2021).</ref> Docksey notes that the EDPB’s competence to issue guidelines, recommendations, and best practices under Article 70s largely avoids these risks.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR) Update of Selected Articles, Article 68 GDPR, p. 243 (Oxford University Press 2021).</ref> Importantly, the EDPB has a clear statutory mandate, to “''ensure the consistent application''” of the GDPR (Article 70(1) GDPR). Article 70(4) GDPR also requires the EDPB, “''where appropriate''”, to consult interested stakeholders and provide them with the opportunity to comment, and the results of this consultation must be made public.

The fact that Article 70(1)(l) GDPR only requires the EDPB to review the practical application of guidelines, recommendations, and best practices referred to in Article 70(1)(e) and (f) GDPR was an editorial error; this obligation applies to all guidance issued by the Board.<ref>''Albrecht'' in Ehmann, Selmayr, DS-GVO, Article 70 GDPR, margin numbers 6,7 (C.H. Beck 2018, 2nd edition).</ref>

Articles 70(1)(n) to (q) GDPR outline the EDPB’s responsibilities regarding the drawing up of codes of conduct, and the accreditation of certification bodies pursuant to Articles 40-41 GDPR and Articles 42-43 GDPR, respectively. On certification, the EDPB must encourage the creation of codes of conduct on certification mechanisms (Article 70(1)(n) GDPR), as well as actually accredit the certification bodies, regularly review them, and keep a public register (Article 70(1)(n) GDPR). The latter requirement conflicts with the wording of Article 43(1) GDPR, which only requires national SAs to carry out accreditation. Article 70(1)(n) GDPR thus contains an editorial error as the EDPB is merely required to review accreditation decisions by national SAs.
===(2) Time Limit===
Article 70(2) GDPR postulates that, where the Commission requests advice from the EDPB, it may indicate a time limit, taking into account the urgency of the matter. However, the question whether the time limit is binding for the EDPB, seems to be unclear. Some argue that it is not binding but that the EDPB should give priority to corresponding requests from the Commission and inform it that the deadline cannot be met and for what reasons, or by when the Committee can deliver the desired opinion.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 70 GDPR, margin number 16 (C.H. Beck 2020, 3rd edition); ''Brink'' in BeckOK Datenschutzrecht, Wolff/Brink DS-GVO Article 69 margin number 19 (C.H. Beck, 39th edition).</ref> Others indicate an option for leeway only in cases of Article 64(2) GDPR but not the context of Article 70(2) GDPR.<ref>''Hellmich'', in Taeger, Gabel, Datenschutzrecht, Article 69 DSGVO BDSG, margin number 5 (C.H. Beck 2022, 4th edition).</ref>

===(3) Forwarding the Opinions, Guidelines, and Recommendations===
According to Article 70(3) GDPR, the EDPB is obligated to “''forward its opinions, guidelines, recommendations, and best practices to the Commission and to the committee referred to in Article 93 and make them public''.” At the same time, it has to publish all these working results, as the Article 29 Working Party has always done. For the decisions in the consistency mechanism, a more precise publication obligation results from Article 65(5) GDPR. The opinions, guidelines, recommendations and best practices are also published online.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 70 GDPR, margin number 17 (C.H. Beck 2020, 3rd edition).</ref>

===(4) Consultation of Interested Parties===
Article 70(4) GDPR requires the EDPB, where appropriate, to consult interested groups and provide them with the opportunity to comment. Interested groups may include data protection experts from science and practice, interested groups may also include any other groups active regarding data protection issues.<ref>''Schiedermair'' in Simitis et al., Data Protection Law, Article 70 GDPR, margin number 13 (C.H. Beck 2019, 1st edition).</ref> In practice, the EDPB conducts consultations ''ex ante'', by hosting workshops and ‘fablabs,’ and ''ex post'', by providing stakeholders the opportunity to comment on draft guidelines.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR) Update of Selected Articles, Article 68 GDPR, p. 243 (Oxford University Press 2021).</ref>

== Decisions ==
→ You can find all related decisions in [[:Category:Article 70 GDPR]]

== References ==
<references />

[[Category:Article 70 GDPR]] [[Category:GDPR Articles]]

Article 70 GDPR - Revision history

Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18