EDPB accountability and the right to challenge guidance

Really interesting insights from Greet Gysen from the EDPB at the Nordic Privacy and Innovation Summit in Stockholm. Part of the consequences of the “Helsinki statement” adopted by the European Data Protection Board are that the EDPB will be consulting stakeholders more in advance – this much we knew already.

She also highlighted that the importance of pragmatism by regulators if the regulation doesn’t help (a very welcome comment).

But the EDPB is apparently working on something else: a manner for stakeholders to alert the EDPB of national guidance that might diverge from EDPB guidance, in the hopes of fostering greater harmonisation.

While I love the idea as a means of getting to better guidance, this does raise a serious concern on my end. We have heard repeatedly that EDPB guidance is just guidance. “Guidelines are just guidelines”, “they are not binding”, and so there should be no way to challenge them separately.

I have always had my doubts about this in practice and have raised the issue of EDPB accountability (see e.g. https://lnkd.in/em28GM3s ).
And this idea of a “whistleblowing” tool (not the EDPB’s words, that was the label given by the moderator) suggests EDPB guidance *should* be viewed as more binding upon national authorities.

So, my question to the EDPB – and to EU legislators: isn’t it high time we properly recognised the right to challenge EDPB guidance directly?

Readers will know I often like to question the EDPB – it’s part of my role as a data litigator and strategic advisor too, plus I really think some of its guidance is overexpansive – but I respect them personally and their resilience. I do believe however that any guidance that forms the basis for enforcement must be challengeable.

Better regulation doesn’t always mean more regulation or just no regulation – it sometimes means regulatory approaches that are also challengeable.

Thanks Greet for the great insights, and I think many of us are looking forward to seeing how things evolve with the EDPB’s approach.

See also slides from my keynote kicking off that same summit: https://lnkd.in/eKfnjCQw

Data protection GDPR privacy