News

EU-Datenschutzbeauftragter rügt EU-Parlament, 5.1.2022

In light of the above, the EDPS concludes that the Parliament has infringed the following Articles of the Regulation:

a. Articles 26(1) and 29(1) due to its failure to fulfil its responsibilities as controller and use a processor providing sufficient guarantees to implement appropriate technical and organisational measures;

b. Article 29(3) due to its failure to provide documentation relating to the detailed instructions given to the processor for the setting up and functioning of the website;

c. Articles 4(1)(a) and 14, 4(2), and 15 due to its failure to respect the principle of transparency, accountability and the data subjects’ right to information because of the inaccurate data protection notice and cookie banner on the dedicated website;

d. Article 46 and Article 48(2)(b) of the Regulation, due to its reliance on the Standard Contractual Clauses in the absence of a demonstration that data subjects’ personal data transferred to the US were provided an essential equivalent level of protection;

e. Article 37 read in the light of Article 5(3) of the ePrivacy Directive, due to its failure to protect information (the cookies) transmitted to, stored in, related to, processed by and collected from the users’ terminal equipment;

f. Articles 17 and 14(4) due to its failure to reply to the data subjects’ request for access to their personal data.

On the basis of the facts and findings as described above, the EDPS decides:

1. to issue a reprimand to the Parliament in accordance with Article 58(2)(b) of the Regulation, for the above infringements;

2. to order the Parliament, pursuant to Article 58(2)(b) of the Regulation, to update its data protection notices in the dedicated website in order to provide all relevant information relating to the processing of personal data. The Parliament should address this order within one (1) month from the date of this decision.