Article 29 Working Party stakeholder consultation

Click here to download the letter.

The Article 29 Working Party (hereafter “the Working Party”) will soon become the European Data Protection Board (EDPB) and has already begun the work that the EDPB is tasked with on guidelines under the General Data Protection Regulation (GDPR). The GDPR and these guidelines will have a wide ranging and fundamental impact on the financial services industry. Providing interested parties with the possibility to provide feedback on the guidelines is an essential part of ensuring their transparency and success.

The Association for Financial Markets in Europe (AFME), the Association of Mutual Insurers and Insurance Cooperatives in Europe (AMICE), the European Federation of Insurance Intermediaries (BIPAR), BusinessEurope, the European Banking Federation (EBF), the European Fund and Asset Management Association (EFAMA), the Federation of European Securities Exchanges (FESE), PensionsEurope, Insurance Europe and Invest Europe very much welcome the opportunity given to the stakeholders to provide comments on certain guidelines published recently by the Working Party, but would like to express concerns over the Working Party’s stakeholder consultation process.

The European Commission guidelines for stakeholder consultation under the Better Regulation agenda1 provide for a 12-week public consultation period for certain initiatives. We therefore believe that the consultation processes of the Working Party, which have taken place so far with 30-day deadlines to respond, were much too short.

The industry needs to receive guidance in a timely manner to prepare for the entry into force of the GDPR on 25 May 2018. At present, there are no indications of when or if stakeholder feedback would be expected through a timetable or roadmap. As we understand that a balance between efficient and representative consultation needs to be found, we call on the Working Party to work to ensure that the final GDPR guidelines are developed as swiftly as possible and that a reasonable consultation period (for example 8 weeks) is set. In the longer term, the EDPB should follow the Better Regulation guidelines and use 12-week consultation periods.

The undersigned European associations welcome the Working Party’s intention to continue engaging with stakeholders through the so-called ‘Fablab’ or workshops. However, we would suggest improvements to ensure that these workshops are a useful part of the stakeholder consultation process. Firstly, we would suggest that more than one stakeholder representative should be allowed to attend the workshops, where several sessions are held at the same time, to enable parties to express their opinion on the issues relevant to them. Secondly, in order to allow stakeholders to properly prepare, the questions for discussion at workshops should be made available well in advance; ideally at least 6 weeks in advance.

An additional concern is that the Working Party guidelines effectively introduce additional rules, which are not in line with the agreement by co-legislators in the Level 1 text. The guidelines are non-binding, but can still be introduced as compulsory requirements at national level. It is therefore important that the guidelines provide clarity and help facilitate implementation, and do not undermine the existing Level 1 provisions that were set as part of this political agreement.

We remain at your disposal for any further clarification and very much hope that you could take these concerns into consideration for the Working Party’s continuing work on the GDPR.