EDPB issues statement on DPAs role in AI Act, FAQs on DPF

Following its July plenary session on Wednesday, 17 July 2024, the European Data Protection Board (EDPB) made three announcements.

EDPB adopts Statement on the role of data protection authorities (DPAs) in the EU Artificial Intelligence Act (AI Act) framework.

• Due to their experience and expertise in dealing with the impact of AI on fundamental rights, DPAs should be designated Market Surveillance Authorities (MSAs) for "high-risk AI systems used for law enforcement, border management, administration of justice and democratic processes";
• Member states should consider designating DPAs as MSAs for "other high-risk AI systems, taking account of the views of the national DPA, particularly where those high-risk AI systems are in sectors likely to impact natural persons rights and freedoms with regard to the processing of personal data";
• Where appointed as an MSA, DPAs are to become the "single points of contact for the public and counterparts at member state and EU levels";
• Clear procedures for cooperation should be established between MSAs and the other regulatory authorities, including DPAs, the EDPB and the EU AI Office.

EDBP publishes two FAQ documents clarifying the functioning of the EU-US Data Privacy Framework (DPF).

• FAQ for individuals clarifies benefits to citizens along with complaints procedure;
• FAQ for businesses outlines which US businesses are eligible, what EU businesses should do before transferring personal data to a DPF-registered company in the US, and resources for further guidance.

EDPB adopts Opinion approving a new European Data Protection Seal.

The Opinion approves the EuroPriSe Criteria Catalogue for the certification of processing activities by processors, resulting in EuroPriSe becoming a European Data Protection Seal.