- STAR - listserv.vub.be

ACTION REQUIRED! advancing guidance and handbook
by Alessandra Calvi 10 Aug '20

10 Aug '20

Dear all, this is to update you on the feedback received so far concerning the guidance for DPAs and handbook for SMEs. For the Guidance for DPAs, we did not receive substantial comments on how to improve it, it is generally clear and understandable. Since there was interest in the questions raised by SMEs and the level of details of the replies given by NAIH, perhaps we could include some Q&A in an annex, but it is a decision of NAIH. @David Barnard-Wills<mailto:David.Barnard-Wills@trilateralresearch.com>, Lina told me that TRI offered to take care of the layout of the Guidance (for online publication). Could you please get in touch with your graphic designers and follow up? It would be great to have the Guidance ready for online publication by Thursday 20 August, so we can share it with speakers and participants a couple of weeks before the event. You may use the document in attachment as starting point. For the Handbook for SMEs, it was noted that the document is comprehensive but still too complex and theoretical. More real-life examples and practical advice would be beneficial. VUB is working on further simplifying the theoretical part, but @Gábor KULITSÁN<mailto:kulitsan.gabor@naih.hu>, @'Nagy Renáta'<mailto:nagy.renata@naih.hu> and @Julia SZIKLAY<mailto:sziklay.julia@naih.hu>, for the real-life examples and practical advice, we need NAIH help. In attachment, you may find the draft D4.1 that was circulated for feedback in May. For each topic, I included some yellow boxes where you may include further real-life examples and practical advice/tips on how to implement certain provisions of the GDPR in practice, on the basis of the questions received and the replies given via the hotline. Please also refer to decisions issued by NAIH concerning SMEs (if any). It would be great if you may send your contribution by Thursday 6 August so that, around mid-August, we can share the updated handbook with TRI for comments and finalize it before the event. Let me know if you have any questions. Thank you in advance for your support and cooperation. Best regards, Alessandra Calvi, LL.M. Researcher d.pia.lab<http://www.dpialab.org/> | Brussels Laboratory for Data Protection & Privacy Impact Assessments Research Group on Law, Science, Technology & Society (LSTS<https://lsts.research.vub.be/>) Vrije Universiteit Brussel (VUB) | Faculty of Law and Criminology Room 4B306, Pleinlaan 2, 1050, Brussels, Belgium

1 1

Draft Agenda Validation workshop
by Alessandra Calvi 06 Jul '20

06 Jul '20

Dear Gabor, dear all, Please find enclosed a draft programme for the online validation workshop on STARII guidance and on the handbook, now scheduled for Thursday 3 September 2020 from 12:00 to 14:30. Probably, the platform will be Microsoft teams or Microsoft live events. This is an internal version and none of the proposed speakers has been contacted yet (except from Mr Hijmans. Before leaving, Lina anticipated him we would have invited him as a speaker for an event in September, but he did not confirm yet). It would be great if the entire consortium could provide support to workshop by making presentations or moderating the panels. I made some suggestions concerning the possible roles. The proposed format is very much dynamic and interactive, and presupposes that the panellists are familiar with STAR II work. Accordingly, the proposed speakers (except one) have already provided more or less extended and critical feedback on the guidance and on the handbook. Of course, if you have some other potential speakers in mind, please let me know. You will notice that there are two proposed people from Belgian DPA (Mr Hijmans and Ms Peneva). Ms Peneva is coordinating the project BOOST<https://www.autoriteprotectiondonnees.be/projet-boost-pour-les-pme>, that supports SMEs compliance with the GDPR, too. I believe inviting both her and Mr Hijmans would be a good way to create synergy and increase the visibility of our projects, but let me know if the agenda looks too unbalanced. I would very much appreciate if you may provide me a feedback on the programme and on the agenda by Tuesday 7 July EOB, so that I can start inviting the speakers before summer holidays. It would be great also to have already the names of the consortium members who would like to present/moderate (if any). In that respect, please keep in mind gender balance. I am looking forward to hearing from you. In the meantime, have a lovely weekend! Alessandra Alessandra Calvi, LL.M. Researcher d.pia.lab<http://www.dpialab.org/> | Brussels Laboratory for Data Protection & Privacy Impact Assessments Research Group on Law, Science, Technology & Society (LSTS<https://lsts.research.vub.be/>) Vrije Universiteit Brussel (VUB) | Faculty of Law and Criminology Room 4B306, Pleinlaan 2, 1050, Brussels, Belgium

2 1

STAR II pre-financing payment
by nagy.renata＠naih.hu 10 Jun '20

10 Jun '20

Dear All, please, be so kind as to send us the timesheets, payslips and any other financial documents for the STAR II Q3 and Q4 as soon as possible but no later than 19.06.2020. According to the Consortium Agreement unless the required documentation is received, the pre-financing payment can not be delivered. Thank you for your kind co-operation in advance! Best regards, Renáta

1 0

Request for feedback on the DPA guidance and SME handbook developed under the STAR II project
by nagy.renata＠naih.hu 26 May '20

26 May '20

Dear Colleagues, On behalf of the STAR II Consortium let me share the guidance for DPAs on good practices in raising awareness, especially for SMEs about GDPR issues. The STAR II (SupporT small And medium enterprises on the data protection Reform II) project, running in the partnership of the National Authority for Data Protection and Freedom of Information (NAIH), the Research Group on Law, Science, Technology & Society (LSTS) of the Vrije Universiteit Brussel (VUB), and the Trilateral Research Limited (TRI IE) between 2018 and 2020, has the aim of enhancing compliance with the GDPR by assisting DPAs and SMEs. The Consortium reviewed the state of the art in DPA’s awareness-raising activities, analysed SMEs’ experience within first months of the functioning of the GDPR, ran an awareness raising campaign for SMEs and also operated a trial hotline (12 months) to respond to SMEs’ questions, measuring its performance and the most frequently asked questions. At the recent phase of the STAR II project the Partners had prepared the draft version of the digital guidance for DPAs on good practices in running a hotline and raising SME awareness. The guidance, after situating awareness raising task within the redefined role of DPAs, builds on the experience of NAIH obtained during the timespan of a hotline for SMEs. The guidance provides recommendations on how to set up and run a hotline. It pays special attention to the required infrastructure, resources required, engaged personnel, internal policies, legal implications and ethical considerations. Please share with us your comments or suggestions concerning the guidance for DPAs. Your kind contribution to the finalization of the draft guidance for DPAs is a vital factor of the validation of the document. An innovative, FAQ-based handbook (digital and printed) for SMEs on EU personal data protection law was also drafted. The draft version of the handbook is also enclosed to this e-mail. We would be grateful if you could share your thoughts on the handbook as well. Please, send your feedback to Ms. Alessandra Calvi, LL.M. (e-mail: Alessandra.Calvi(a)vub.be). We would highly appreciate if you would be so kind as to send your response until 12 June 2020. We are looking forward for your valuable co-operation. Yours sincerely, On behalf of the STAR II Consortium Renáta Nagy project assistant National Authority for Data Protection and Freedom of Information H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.

1 0

[STAR II] decision on amendment request
by kulitsan.gabor＠naih.hu 15 May '20

15 May '20

Dear All, Please be informed that the European Commission evaluated and approved our request for 4-months-long-prolongation of STAR II. This means that the submission deadlines of all remaining deliverables have been extended accordingly and the project itself will end on 30/11/2020. You can find all information in the attached axcel sheet and in the Participant Portal as well. @Lina: I know we still owe you NAIH's comments on D4.1. I've been a bit busy due to my othe tasks, but I/we will send you some feedback for sure. Best, Gábor

4 4

feedback on STAR II 4.1
by David Barnard-Wills 03 Apr '20

03 Apr '20

Dear all, First, I sincerely apologise for not getting this feedback to you earlier. I assume that D4.1 was submitted? On the positive side, this feedback can presumably be included in the final version of these deliverables. We got Alan Moore, one of our DPO team, with good practical expertise with various commercial clients to review the guidance document (You met him at the Brussels workshop). His feedback is below. Best wishes, DBW I have gone through the document and have a few suggestions: P7 Section 3.2 It can be suggested that to compensate for being awarded with limited enforcement powers….. I would hold they have significant powers beyond the ability to fine. Their powers to instruct controllers / processor top cease processing data, among others, can ultimately shut down a business without a fine being levied. To ignore these instructions can land a director in jail for up to 5 years! P8. DPAs The focus on standardisation and EDPB. Art 60 was an after thought and the general view is the it cannot operate within the prescribed timelines. The ECJ will be the ultimate arbiter for standardisation of approaches / laws / requirements but each National Authority must be free to interpret facts presented in its own way. Their independence is anchored in the EU treaties. A complication that will eventually need to be addressed. P8. 3.3 Should be aware that translation into romance languages can carry a different commutation the was intended by the Directive and DPA have a key role to explain the true intent / meaning. P9. 3.4 Typo in second paragraph. It also could be considered e the most P10. It appeared that most DPAs do not use internal guidance to direct…. What has been the result of this? A key concern in the Irish DPC has been delivering a consistent message and not providing a different answer to the same or similar callers on different occasions. P11. 4 Unclear use of language - first paragraph This initiative allowed to be confirmed that It allowed to be obtained P11.4. Would stress the importance of standardisation of response & P12 4 Add ‘c’? Implement a control process to ensure standardisation of responses to similar questions / scenarios P13. 4.2 Might mention the concern that callers may have that showing their hand may trigger an investigation. Callers need to be reassured and encouraged to participate. Approaches do differ between different DPAs. P13. 4.2.1 It was decided to create a dedicated part Following up on from this decision P15. 4.2.3 I would stress the value of face to face more as context can be complicated and the caller is subject to information and power asymmetry. P16 4.5 last paragraph We are included inclined to P21 6.2 last paragraph DPAs across the EU have reported to engage that they have engaged in P22 6.3 4.5 last paragraph Slovic suggests that the following elements play a role when evaluating risk: 1. The degree to which an individual feels in control 2. The nature of consequences and the distribution of the impact P23 6.3 2nd paragraph Which is perceived ‘as the coordinated activities to direct and control an organisation with regard to risk’ 47 This is most practically evidenced by the development and maintaining of a formal risk register. (This risk section is very cerebral I fear and wont help with the ‘how’) P23 6.3.1 Typically, the risk based approach formula approach in the GDPR includes the following elements to be taken into account: * The state of the art in terms of technology for of the means of processing (state of the art needs to be explained – does not mean the best there is but rather the minimum expectable / expected) P24 6.3.2 I would add a sentence or two on the benefits undertaking a voluntary DPIA which include: * Documented understanding of the how the system works * Known points of integration with other systems * Assigning accountability * Ensuring organisational standards (security / access etc) are being complied with * Demonstrated commitment to GDPR * General piece of mind / greater organisational resilience P24 6.3.5 I would add a piece on keeping a formal risk register of risks to data subjects, separate from ant organisation risk register of risks to the organisation in which all risks are assigned an owner and a review date. P25 6.3.5 (b) What does SMEs need to do to be accountable? Second paragraph …that the principle of accountability as an elements of good P.26 first line … that the demonstration of compliance P.26 6.3.6 (b) * Implement data protection principles (see Article 5) and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects (see Chapter III) in an effective manner; * This should done at the time of the determination of the means for processing and implemented before the time of the processing itself. (not that clear in the text.) P.27 6.3.6 (c) It should be noted that some DPAs while note defining and technical or organisation measures will nonetheless express an expectation such as the Irish DPC in terms of the use of encryption whenever possible where personal data is at rest or in transit. P.28 6.3.7 (b) 2nd paragraph It is assumed that organisations will, however, benefit more from maintaining their documentation electronically as such documentation can they can easily added to, have entries removed when obsolete, and amend entries it as necessary. However paper documentation is regarded as being appropriate for SMEs and micro enterprises. It should be added that SMEs (entities having less than 250 employees) are technically exempt from this obligation if provided they are undertaking: • processing that is not likely to result in a risk to the rights and freedoms of data subjects; • processing that is not occasional (meaning that it is not regularly / frequently undertaken); or • processing that does not include special categories of data or personal data relating to criminal convictions and offences. In reality, very few SMEs can avail of this exemption unless the process very little data. Most SMEs will usually have some special category data as part of their HR files. They can be are available on the websites…. P.29 6.3.8 (a) 2 Large scale is not defined by the legislation though different DPAs have given some guidance relevant to different activities. For SMEs who provide services into other organisations, the voluntary appointment of an internal or outsourced DPO can provide commercial and strategic advantage by communicating a commitment to data protection and promoting higher levels of trust. P.29 6.3.8 (b) A DPO may either be an employee of the SME or an external expert, but in both cases, it is fundamental that he or she is independent, in the sense that: • the DPO shall be provided of with all the necessary resources to carry on his/her tasks, in terms of money, time, workforce, time to devote to professional development etc.; • the DPO shall not receive instructions for the exercise of his/her tasks; • the DPO shall not be dismissed or penalized for the performance of his/her tasks; • the DPO shall report to the highest level of management; and • the DPO should not be in have any conflict of interest in respect to other tasks and duties (e.g. determining objects and purposes of the processing, representing the SME in legal proceeding). P.30 6.3.8 (c) Task of DPOs DPOs cannot Inform and advice the SME on the obligations arising from the GDPR and the national data protection provisions Be held accountable for the information and advice given to the SME (I do not agree with this. They are not accountable for whether their advice is implemented or not but they can be held accountable for being negligent) Monitor the compliance of the SME with the GDPR, the national data protection provisions and (eventual) its internal data policies Be considered personally responsible for non-compliance with data protection requirements Carry on awareness raising activities and training for the staff of the SME dealing with data processing Perform the DPIA. Not true. There is no reason why a DPO cannot take the lead in undertaking a DPIA especially where the skills do not exist elsewhere in the organization. but the responsibility to ensure one is done remains with the Controller. Provide advice to the SME and monitor the performance in relation to the DPIA (when a DPIA is required) Represent the SME in front of the DPA or in a court in case of proceedings. Not quite so. The DPO remains the first point of contact for data subjects and the DPAs and may be called to account for advice / provide an explanation as to how data was processed based on their monitoring of processing activities. I Act as contact point for the supervisory authority in case of prior consultation Be considered responsible for the maintenance of the register True but they are responsible for providing oversight as to whether it is maintained. Cooperate with the supervisory authority Simultaneously hold another position in the organization that helps define the means and purposes of processing of any personal data. Be contacted by data subjects willing wishing to exercise their rights Create and maintain the register of processing (in the exceptional situations where SME are required to have it one) Not True, under Art 30 it is the responsibility of the Controller P.31 6.3.9(a) Data Protection Impact Assessment (a) Background The DPIA is a new addition to the EU data protection framework. It builds on the rich experience of conducting impact assessments in other fields, in particular, on the environmental impact assessments. To be effective, impact assessments are carried out at the early stage of a project (proactive initiative), at the phase of planning or designing, and are aimed to identify and help mitigate anticipate the any potential beneficial and adverse (i.e. negative) impacts arising from the intended processing of personal data of such within the project. Impact assessments are risk based exercises that help decision-makers find the best and most beneficial solutions for the development and deployment of initiatives while protecting the rights and freedoms of data subjects. To be practical, impact assessments must be scalable, flexible and applicable inter alia for large organisations, consortia or for small and medium-sized enterprises. Any risks identified will be entered into the Data Protection Risk Register. P.32 6.3.9(c) (c) What are the elements and characteristics of the processing that may generate the high risks to rights and freedoms of individuals? The following elements that contribute to the high risks to data subjects from this provision were extracted by the (d) What situations could require a DPIA? Examples of processing operations that could trigger a DPIA: • If the SME is implementing a new tool to monitor access to office combining use of fingerprints and face facial recognition technology; • If the SME is a biotechnology company offering genetic tests directly to consumers in order to assess and predict the disease/health risks • If the SME is providing CCTV surveillance for a shopping centre or using a large number of cameras in their own premises (e) Who and when should perform a DPIA? Albeit the data processor and the data protection officer shall assist the data controller (i.e., SME), the final responsibility on for the DPIA process relies on rests with the data controller. (f) When is a DPIA is not required? • When the data processing operations are included in any list of data processing operations compiled by the DPA non which do not requiring a DPIA P.33 6.3.9(g) 4) Involve data subjects and/or their representatives, the data protection officer and any other expert (e.g. information security officer) and the data processor in the process, ideally in each phase of the assessment process. This consultation must be meaningful. P.33 6.3.9(h) (h) When a new (revised) DPIA is required? A new (i.e. revised version of) DPIA could be required if the risks resulting from the processing operations are to change, for example because a new technology is to be has been introduced, a new processor is to be engaged under contract, or because personal data is being to be used for a different purpose In that case, the review of the risk analysis made can show that the performance of a DPIA is no longer required. P.34 6.3.10(b) (b) How the security obligation is related to other provisions? This obligation also requires the controller wishing to engage a processor under contract to undertake due diligence and assess whether the guarantees offered by the data processor, in this case the cloud service provider, are sufficient. A controller must only engage such a processor where they have faith in their ability to comply with the obligations under GDPR. During this process, the controller may take into account whether the processor provides adequate documentation proving compliance with data protection principles that could be found in privacy policies, records management policies, information security policies, external audit reports, certifications and similar documentation. The controller in particular should take into account the processor’s expert knowledge (e.g. technical expertise when dealing with data breaches and security measures), reliability and its resources. A site visit may also be necessary. After carrying out the due diligence process, the controller should be able to take a decision with sufficient evidence demonstrating that the processor is suitable, it can then enter into a binding arrangement. It should be added that this due diligence process is not a one-time effort. and it needs to be regularly repeated in order The controller will have an ongoing obligation to check whether the processor is compliant and meeting their obligations either by auditing using their own staff or a trusted third party. When outsourcing the processing of personal data (e.g. for the provision of technical assistance or cloud services), the controller should must conclude a contract, another legal act or binding arrangement with the other entity already setting out clear and precise data protection obligations and the nature of processing in a detailed data processing agreement. P.35 6.3.10(c) An information security policy foreseeing the role of each user and the required permission levels (access control) appropriate to the role which minimises access to only that data necessary for that role. This includies the system administrator accounts is as an example of an appropriate organisational measure. P.35 6.3.10(d) What technical security measures can a SME take? Technical measures must therefore include both physical and computer or IT security. When considering cybersecurity, you should look at factors such as: • system security – the security of your network and information systems, including especially those which process personal data; • data security – the security of the data you hold within your systems, e.g., ensuring appropriate access controls are in place and that data is held securely through the use of suitable levels of encryption; P.36 6.3.10(e) Would add: Where Special Category Data is processed (such as health data) or personal data relating to minors, higher levels of security will be expected to be implemented and documented. P.36 6.3.11 This section should start with the definition of what is meant by a breach and explain the difference between an incident and a breach. It is confusing otherwise. P.37 6.3.11(b) Consequently, this means that the controller must have an internal procedures defined, tested and documented allowing to confirm to appropriately identify and handle any breach of security concerning personal data. In an ideal scenario, an information incident response policy should precede be in place before processing of personal data begins so that any the occurrence of an incident so that it could be used should a data breach take place. P.37 6.3.11(d) Would add a final paragraph. As GDPR is maturing, different DPAs are expressing different thresholds for the reporting of breaches. Where originally there was a fear of over reporting, the DPC in Ireland has requested a breach be reported when there is any risk identified to the data subject. This allows the Commission to identify trends and to have confidence that controllers are identifying the minor breaches and thus are able to identify the more serious beaches should they arise. I hope you find this useful. Alan From: star-bounces(a)listserv.vub.ac.be <star-bounces(a)listserv.vub.ac.be> On Behalf Of Lina JASMONTAITE Sent: 28 February 2020 13:09 To: nagy.renata(a)naih.hu; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu> Cc: 'STAR' <star(a)listserv.vub.ac.be> Subject: Re: [star] STAR II - Update on EDPB and validation workshop? Dear Renata and Gabor, Here comes D4.1 with both parts now included. We made further minor edits to Part A. We believe that the pfd version can be submitted. We look forward to your comments on Part B, which unfortunately comes a bit later than planned. Best regards, Lina From: star-bounces(a)listserv.vub.ac.be<mailto:star-bounces@listserv.vub.ac.be> <star-bounces(a)listserv.vub.ac.be<mailto:star-bounces@listserv.vub.ac.be>> On Behalf Of Lina JASMONTAITE Sent: Friday, February 28, 2020 8:45 AM To: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>> Subject: Re: [star] STAR II - Update on EDPB and validation workshop? Dear Renata and Gabor, Thank you for your additions and edits. The document to be submitted to the EC will reach you shortly after noon. Best regards, Lina From: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu> <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>> Sent: Thursday, February 27, 2020 4:31 PM To: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear Lina! Dear All! Thank you for sharing the restructured version of the guidance for DPAs. We only added minor additions/corrections. We confirm that the yellow parts are accurate. We are looking forward to the handbook (the submission deadline is 29.02.2020) Best regards, Renáta From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: Thursday, February 20, 2020 10:32 AM To: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>; 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear Renata and Gabor, Once again, thank you for preparing a revised version of the guidance for DPAs. We reviewed it now enclose an improved version of it. It includes nearly all of your report (see the document you shared; we marked in yellow parts that were used). However, the current version is restructured, rephrased and embedded in a wider context of DPAs’ awareness raising duties. We also extracted recommendations from your report and developed a graph presenting these recommendations. There are two parts marked in yellow that need to be checked for accuracy. Perhaps, you will want to add some other clarifications in the text. In particular, further additions could be made to the concluding remarks part. As we provided contributions to the initial text, we would like to be considered co-authors of this guidance. What do you think about this? The part B – the handbook for SMEs – is on a way. Best regards, Lina From: nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu> <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>> Sent: Tuesday, January 28, 2020 4:16 PM To: 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com<mailto:david.barnard-wills@trilateralresearch.com>>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear All! Please, find enclosed the updated version of the guidance. Best, Renáta From: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Sent: Tuesday, January 28, 2020 10:09 AM To: 'Leanne Cochrane' <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: 'David Barnard-Wills' <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; 'Lina JASMONTAITE' <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Hi Leanne, Thanks for the update on the newsletter. Regarding the upcoming events: * The plan is to present the drafts of the guidance and the handbook at the EDPB plenary in February. However, as this is scheduled for 18-19 February, we can only do this, if the drafts are ready by then. Renáta will circulate the updated version of the guidance soon. As for the other document (handbook), Lina can provide further information. * I have no further information on the validation workshop planned for March-April 2020. Best, Gábor From: Leanne Cochrane [mailto:leanne.cochrane@trilateralresearch.com] Sent: Monday, January 27, 2020 6:25 PM To: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Sziklay Júlia <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: STAR II - Update on EDPB and validation workshop? Hi Gabor, I hope you are keeping well. Our dissemination team is preparing to send out the STAR II newsletter we mentioned on our previous calls. It will be sent out this Thursday with links to the approved deliverables and some blogs. We are also including a section on upcoming events and I wanted to check with NAIH if we had any further information on the following two events: * A presentation by NAIH to the EDPB on the STAR II project planned for the February EDPB plenary (18th-19th) in Brussels. * A Validation workshop for the STAR II outputs, namely a 'A Risk Focused Handbook for SMEs' and a 'Guidance for DPAs' planned for March-April 2020 in Brussels. Can I just check this information is still current and there is nothing more specific we can add at this stage? I would be grateful if you can cc all in the reply as I am off tomorrow and the dissemination team are in need of the confirmation. Thanks and best wishes, Leanne [A képet a feladó eltávolította.]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane

8 27

Re: [star] Star II - publication for WP5
by Lina JASMONTAITE 02 Apr '20

02 Apr '20

Dear David, Once again, many thanks for going through the draft paper. You were part of our discussions with Leanne, guided us during the process and contributed to the paper, so I think you should share co-authorship of this piece. I removed the comments, accepted track changes and made some edits. As you can’t see them immediately in the document, I will summarise them here: * I left the term EU legislator but added an additional explanation in a footnote (see footnote 19) pointing out the three co-legislating institutions: EC, EP, the Council. I think of a term ‘the EU legislator’ as a synonym to ‘the EU legislative procedure’. * I understand why you suggested to replace ‘enforcement’ with ‘governance’ but I do not agree with this suggestion. I went back to scholars on regulatory theories and several of them suggest that enforcement includes both compliance (soft enforcement) and deterrence approaches (hard enforcement). I stand by this idea, so I added a footnote explaining this view (see footnote 14). * You questioned what is meant by the role of the leader, it comes from the writing of Hielke and others, where it is suggested that awareness raising tasks fall within the scope of this role. * You questioned the need to have a section describing survey methodology. I wouldn’t add it to the paper but I included a reference to it in a footnote. * I added a definition of SME Association: Within the scope of this article we use a term SME Associations to refer to different types of organisations that provide a meaningful support, advice, guidance and training services to SMEs on their functioning, ranging from trade and sectoral associations to chambers of commerce. They can be financed through membership fees or through public sources of funding. * The following statement was added to explain why we haven’t judged the quality of such guidance. Think about it as a disclaimer: The perception of these guidelines and their usefulness was not explored within the scope of STAR II questions because originally more narrow focus was placed on the relationship between DPAs and SMEs directly, before the potential for the role of SME Associations emerged. * I really like the idea of DPAs and SME associations co-creating guidance for SMEs. * I didn’t add info about projects mentioned at the end of the paper as there are links provided to their websites. * Instead ‘of good quality compliance advice’, I opted in for ‘an improved quality compliance advice’. If you are ok with this, I will send it over to the EDPL. Looking forward to your reply! Best regards, Lina From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: 18 March 2020 13:57 To: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>> Cc: Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Subject: RE: Star II - publication for WP5 Hi David, Attached is the last version of it. Any comments and suggestions are very much appreciated. Perhaps, there’s sth that we forgot. Best regards, Lina From: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>> Sent: Wednesday, March 18, 2020 10:57 AM To: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>> Subject: RE: Star II - publication for WP5 Hi Lina, I’ll review it if you like. Can you send me the latest version? DBW From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: 17 March 2020 17:08 To: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>> Subject: RE: Star II - publication for WP5 Dear Leanne, I hope this email finds you well during these uneasy times. I would like to ask you to review the paper in the upcoming week or two, so we can send it for a review to the EDPL. I will be going on a maternity leave in mid-April and will not be available till late July. Of course, if we are asked to make some changes or implement comments of a reviewer, I will find time for that. In any case, even if the project is prolonged, it would be great to proceed with the publication as soon as possible as it takes some time. Best regards, Lina From: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Sent: Sunday, February 16, 2020 8:40 PM To: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com<mailto:david.barnard-wills@trilateralresearch.com>>; nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>; Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>>; 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>>; Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>>; Carlotta RIGOTTI <Carlotta.Rigotti(a)vub.be<mailto:Carlotta.Rigotti@vub.be>> Subject: Re: Star II - publication for WP5 Dear Lina, Many thanks for this and the previous email. I am on leave until Tuesday 25th February. I will schedule time at that stage to take up the article again. With best wishes, Leanne [https://trilateralresearch.co.uk/wp-content/uploads/2018/12/tri-logo.jpg]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane I send emails at a time that suits me. I don’t expect you to read, action or respond out of your own working hours. ________________________________ From: Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>> Sent: 10 February 2020 15:34 To: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu> <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>>; 'STAR' <star(a)listserv.vub.ac.be<mailto:star@listserv.vub.ac.be>>; Alessandra Calvi <Alessandra.Calvi(a)vub.be<mailto:Alessandra.Calvi@vub.be>>; Carlotta RIGOTTI <Carlotta.Rigotti(a)vub.be<mailto:Carlotta.Rigotti@vub.be>> Subject: Star II - publication for WP5 Dear Leanne, Following up on the discussions last autumn, I prepared yet another draft of an article foreseen in task 5.2. It’s also saved on the shared folder with additional materials. While I tried to keep it focused, I think some important issues remain untouched, such as that there’s a lot of guidance available by DPAs though it is not always clear how to find the relevant one; national guidance documents usually build on the EDPB opinions or the EC, so guidance on EU level for SMEs should be encouraged. Now we suggested that such guidance should be primarily developed at national level. Throughout the contribution we mostly assume that there are distinctive needs of SMEs but we never elaborate on them. Do you think we need to further elaborate on such needs? Perhaps, SME association expectations from DPAs should be also more nuanced? @Kulitsán Gábor<mailto:kulitsan.gabor@naih.hu> & @Nagy Renáta<mailto:nagy.renata@naih.hu> perhaps you could provide some comments on this contribution? Best regards, Lina Jasmontaite Doctoral researcher Law, Science, Technology and Society (LSTS) Vrije Universiteit Brussel (VUB) Brussels Privacy Hub (BPH) Room 4B306, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be<https://lsts.research.vub.be/> | www.brusselsprivacyhub.org<http://www.brusselsprivacyhub.org/> [VUB-LSTS_RGB]

1 0

Re: [star] STAR II - Update on EDPB and validation workshop?
by Lina JASMONTAITE 05 Mar '20

05 Mar '20

Dear Renata and Gabor, Once again, thank you for preparing a revised version of the guidance for DPAs. We reviewed it now enclose an improved version of it. It includes nearly all of your report (see the document you shared; we marked in yellow parts that were used). However, the current version is restructured, rephrased and embedded in a wider context of DPAs’ awareness raising duties. We also extracted recommendations from your report and developed a graph presenting these recommendations. There are two parts marked in yellow that need to be checked for accuracy. Perhaps, you will want to add some other clarifications in the text. In particular, further additions could be made to the concluding remarks part. As we provided contributions to the initial text, we would like to be considered co-authors of this guidance. What do you think about this? The part B – the handbook for SMEs – is on a way. Best regards, Lina From: nagy.renata(a)naih.hu <nagy.renata(a)naih.hu> Sent: Tuesday, January 28, 2020 4:16 PM To: 'Kulitsán Gábor' <kulitsan.gabor(a)naih.hu>; Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu> Subject: RE: STAR II - Update on EDPB and validation workshop? Dear All! Please, find enclosed the updated version of the guidance. Best, Renáta From: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Sent: Tuesday, January 28, 2020 10:09 AM To: 'Leanne Cochrane' <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: 'David Barnard-Wills' <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; 'Corinna Pannofino' <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; 'Angelo Napolano' <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; 'Lina JASMONTAITE' <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Hi Leanne, Thanks for the update on the newsletter. Regarding the upcoming events: * The plan is to present the drafts of the guidance and the handbook at the EDPB plenary in February. However, as this is scheduled for 18-19 February, we can only do this, if the drafts are ready by then. Renáta will circulate the updated version of the guidance soon. As for the other document (handbook), Lina can provide further information. * I have no further information on the validation workshop planned for March-April 2020. Best, Gábor From: Leanne Cochrane [mailto:leanne.cochrane@trilateralresearch.com] Sent: Monday, January 27, 2020 6:25 PM To: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Sziklay Júlia <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: STAR II - Update on EDPB and validation workshop? Hi Gabor, I hope you are keeping well. Our dissemination team is preparing to send out the STAR II newsletter we mentioned on our previous calls. It will be sent out this Thursday with links to the approved deliverables and some blogs. We are also including a section on upcoming events and I wanted to check with NAIH if we had any further information on the following two events: * A presentation by NAIH to the EDPB on the STAR II project planned for the February EDPB plenary (18th-19th) in Brussels. * A Validation workshop for the STAR II outputs, namely a 'A Risk Focused Handbook for SMEs' and a 'Guidance for DPAs' planned for March-April 2020 in Brussels. Can I just check this information is still current and there is nothing more specific we can add at this stage? I would be grateful if you can cc all in the reply as I am off tomorrow and the dissemination team are in need of the confirmation. Thanks and best wishes, Leanne [A képet a feladó eltávolította.]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane

3 5

[STAR II] Deliverable D4.2 rejected
by Kulitsán Gábor 24 Feb '20

24 Feb '20

Dear All, The PO has requested the revision of Deliverable D4.2. (The rejection letter and the deliverable are enclosed). In addition to the letter the policy unit made the following comments (see "Process communications" in the Research Portal): "Regarding the other deliverable submitted: WP4 D4.2 D14 Third validation workshop (Dublin) * This deliverable was rendered moot by the fact that the last two events are going to be merged in one * It also indicates that STAR II was presented during this CPDP in Brussels, * We would therefore expect that we will therefore not pay the full amount since only one, not two events will be organised * Since the first event in Dublin was very disappointing (only 14 attendance, when 100 were foreseen), we could ask for improved dissemination of the event to be included in the deliverable, and for it to be resubmitted." If I understand correctly, the EC asks us to briefly report on the CPDP conference. @VUB and/or @TRI: Could you please summarize what happened at the CPDB and what was the outcome? Thanks. Gábor

3 4

STARII: a draft programme for the workshop in BXL
by Lina JASMONTAITE 20 Feb '20

20 Feb '20

Dear Gabor, dear all, Please find enclosed a draft programme for the validation workshop on the guidance and on the handbook that is scheduled for 22 of April. It’s our internal version and it includes some provisional speakers. None of them have been contacted so far but we are going to approach them next week after receiving your feedback. If you have some speakers in mind that we should consider/invite, please let us know. We intend to organise nearly a full day event on the second day of the preliminary EDPB meeting in a hope that some DPA representatives will join the event or at least a part of it. From the programme you can see that we also hope that you will provide support to the event by making presentations, in particular, the ones in the afternoon part on DPAs’ hotline practices and on the dedicated hotline for SMEs. We would appreciate receiving your comments by Wednesday morning or earlier if that is possible. Wishing you a nice weekend, Lina Jasmontaite Doctoral researcher Law, Science, Technology and Society (LSTS) Vrije Universiteit Brussel (VUB) Brussels Privacy Hub (BPH) Room 4B306, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be<https://lsts.research.vub.be/> | www.brusselsprivacyhub.org<http://www.brusselsprivacyhub.org/> [VUB-LSTS_RGB]

4 4

Re: [star] STAR II - Update on EDPB and validation workshop?
by Lina JASMONTAITE 20 Feb '20

20 Feb '20

Dear Leanne, David and Gabor, As you may have been aware, at VUB we went through some internal changes concerning work and resource distribution for the STARII project. The outcome of these changes is that our team now consists of three of us – Alessandra and Carlotta have recently joined the project and will work on it within different capacities till its end. On the same note, I want to provide updates on the handbook for SMEs, the guidance for DPAs, the website, the event in Brussels and the panel at CPDP. 1. Handbook: we took into consideration your comments provided to us in January and we’ll share our draft on 17 February. We will kindly ask you to provide your feedback by 21 of February. 2. Guidance: Thanks for NAIH team for sharing the revised version of the document. We appreciate the changes you’ve implemented. We’ll share more detailed feedback by 14 February. 3. Website: TRI kindly offered to help us with this task, as we have been having difficulties to live up to our promises made in the DOW. We’ve been negotiating a service contract for a website (in fact a separate website from STAR I) for nearly two months (the parties to the contract did not agreed to use each other standard templates) and VUB legal service team should enter into agreement this week. Provided how complicated this process was for a rather simple service and that’ve had discussions on the outline and features of the website, I would prefer to continue pursuing this path. We, however, agree that having a LinkedIn page would provide an alternative route to disseminate our work. 4. Workshop in Brussels: after consulting Gabor, we decided to host the workshop (merging two tasks) on the 22 of April. It is the second day of the monthly EDPB plenary meeting. We’ll share a draft agenda with you before the end of this week, so you can comment and make suggestions for speakers/ timing/ etc. We hope that this date works well for you and that you will be able to contribute to the event. 5. CPDP panel that was organised in cooperation with the SMOOTH project was successful and received some positive feedback, you can watch it here: https://www.youtube.com/watch?v=V-s1iUoAM-Q. As Renata shared an updated data concerning the hotline in the afternoon before the event and the panel took place on Wed at 8:45, the slide with this info was not updated. Many thanks TRI for their contribution! Best regards, Lina From: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com> Sent: Wednesday, January 29, 2020 1:02 PM To: Kulitsán Gábor <kulitsan.gabor(a)naih.hu> Cc: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com>; 'Nagy Renáta' <nagy.renata(a)naih.hu>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu> Subject: Re: STAR II - Update on EDPB and validation workshop? Hi Gabor, Thanks for this information and thanks to Renata for the updated guidance. Best wishes, Leanne [https://trilateralresearch.co.uk/wp-content/uploads/2018/12/tri-logo.jpg]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane ________________________________ From: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Sent: 28 January 2020 09:08 To: Leanne Cochrane <leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; 'Lina JASMONTAITE' <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; 'Sziklay Júlia' <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: RE: STAR II - Update on EDPB and validation workshop? Hi Leanne, Thanks for the update on the newsletter. Regarding the upcoming events: - The plan is to present the drafts of the guidance and the handbook at the EDPB plenary in February. However, as this is scheduled for 18-19 February, we can only do this, if the drafts are ready by then. Renáta will circulate the updated version of the guidance soon. As for the other document (handbook), Lina can provide further information. - I have no further information on the validation workshop planned for March-April 2020. Best, Gábor From: Leanne Cochrane [mailto:leanne.cochrane@trilateralresearch.com] Sent: Monday, January 27, 2020 6:25 PM To: Kulitsán Gábor <kulitsan.gabor(a)naih.hu<mailto:kulitsan.gabor@naih.hu>> Cc: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com<mailto:David.Barnard-Wills@trilateralresearch.com>>; Corinna Pannofino <Corinna.Pannofino(a)trilateralresearch.com<mailto:Corinna.Pannofino@trilateralresearch.com>>; Angelo Napolano <Angelo.Napolano(a)trilateralresearch.com<mailto:Angelo.Napolano@trilateralresearch.com>>; 'Nagy Renáta' <nagy.renata(a)naih.hu<mailto:nagy.renata@naih.hu>>; Lina JASMONTAITE <Lina.Jasmontaite(a)vub.be<mailto:Lina.Jasmontaite@vub.be>>; Sziklay Júlia <sziklay.julia(a)naih.hu<mailto:sziklay.julia@naih.hu>> Subject: STAR II - Update on EDPB and validation workshop? Hi Gabor, I hope you are keeping well. Our dissemination team is preparing to send out the STAR II newsletter we mentioned on our previous calls. It will be sent out this Thursday with links to the approved deliverables and some blogs. We are also including a section on upcoming events and I wanted to check with NAIH if we had any further information on the following two events: * A presentation by NAIH to the EDPB on the STAR II project planned for the February EDPB plenary (18th-19th) in Brussels. * A Validation workshop for the STAR II outputs, namely a 'A Risk Focused Handbook for SMEs' and a 'Guidance for DPAs' planned for March-April 2020 in Brussels. Can I just check this information is still current and there is nothing more specific we can add at this stage? I would be grateful if you can cc all in the reply as I am off tomorrow and the dissemination team are in need of the confirmation. Thanks and best wishes, Leanne [https://trilateralresearch.co.uk/wp-content/uploads/2018/12/tri-logo.jpg]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com<mailto:leanne.cochrane@trilateralresearch.com> www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane

2 2

Star II - publication for WP5
by Lina JASMONTAITE 17 Feb '20

17 Feb '20

Dear Leanne, Following up on the discussions last autumn, I prepared yet another draft of an article foreseen in task 5.2. It’s also saved on the shared folder with additional materials. While I tried to keep it focused, I think some important issues remain untouched, such as that there’s a lot of guidance available by DPAs though it is not always clear how to find the relevant one; national guidance documents usually build on the EDPB opinions or the EC, so guidance on EU level for SMEs should be encouraged. Now we suggested that such guidance should be primarily developed at national level. Throughout the contribution we mostly assume that there are distinctive needs of SMEs but we never elaborate on them. Do you think we need to further elaborate on such needs? Perhaps, SME association expectations from DPAs should be also more nuanced? @Kulitsán Gábor<mailto:kulitsan.gabor@naih.hu> & @Nagy Renáta<mailto:nagy.renata@naih.hu> perhaps you could provide some comments on this contribution? Best regards, Lina Jasmontaite Doctoral researcher Law, Science, Technology and Society (LSTS) Vrije Universiteit Brussel (VUB) Brussels Privacy Hub (BPH) Room 4B306, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be<https://lsts.research.vub.be/> | www.brusselsprivacyhub.org<http://www.brusselsprivacyhub.org/> [VUB-LSTS_RGB]

2 2

STAR II - Feedback on DPA guidance draft
by David Barnard-Wills 03 Dec '19

03 Dec '19

Hi Gabor, Thank you for sending around the draft of the best practice DPA guidance. We have the following comments/thoughts * The audience for the deliverable will be your fellow DPAS. * Its audience already has a high level of background contextual knowledge, so we can jump straight in to the best practices - so we can probably cut some of this content down. * Perhaps the aim of this deliverable should be to 1) introduce best practices in awareness raising that they might not be aware of and 2) provide some evidence base for what has been found to be effective. * I would suggest keeping the report as brief and accessible as possible. * We don't want to duplicate the report on the interviews (d2.1) and the report on the hotline (d3.2). * Perhaps we can identify 5-10 best practices for awareness raising for SMES * Description of the practice * Followed by why we think its "best"/"good" practice. * This could include conventional/standard/must have practices - such as a hotline of some description - then then more cutting-edge/innovative/experimental practices - where we don't have as much evidence for success, but they're new for an audience. * E.g. Ireland's conference with DPOs from large corporations advising SMEs. * We should be talking about best practices we can be confident of recommending. The readers will want to know why we are confident about our recommendations, or what our rationale for recommending them is (examples will likely be - its had positive feedback from interviews, we found out about it during our information gathering, it worked during the trial of the hotline.... ) * Include other best practices we are aware of, not just activities from STAR II (hotline and awareness raising campaign). * One (or more) of the best practices should relate to the hotline (setting up, management) * A potential example is the PHAEDRA II project final recommendations report - http://www.phaedra-project.eu/wp-content/uploads/PHAEDRA2_D41_final_2017011… (particularly, the early single page with all the best practices together, then short sections setting out the substance of the best practice, and our justification for supporting it). * We have some specific feedback, notes and suggestions to this effect on the attached word document. Best wishes, DBW Dr David Barnard-Wills Research Manager (Policy, Ethics and Emerging Technologies) Trilateral Research Ltd. 1 Knightsbridge Green London SW1X 7QA www.trilateralresearch.com<http://www.trilateralresearch.com/> www.twitter.com/dbarnardwills<http://www.twitter.com/dbarnardwills> I'm part time - Working hours: 9.30 to 14.45, Mon, Tues, Thurs, Fri

5 7

Re: [star] STAR - input for dissemination report
by nagy.renata＠naih.hu 08 Nov '19

08 Nov '19

Dear All, please, find enclosed the remaining Deliverables. Best, Renáta From: Istvan Mate BOROCZ <Istvan.Mate.Borocz(a)vub.be> Sent: Thursday, October 31, 2019 2:21 PM To: David Barnard-Wills <david.barnard-wills(a)trilateralresearch.com>; nagy.renata(a)naih.hu; kulitsan hu <kulitsan.gabor(a)naih.hu> Subject: RE: STAR - input for dissemination report hi all, please find attached the draft of D5.1 star communication tools current status: * D1.5 minutes - draft written, waiting for review and submission * D1.6 wrap-up minutes - draft written, waiting for review and submission * D4.2 finalised materials - draft written, waiting for review and submission * D4.3 feedback forms - waiting * D5.1 comm channels - draft written, waiting for review and submission * D5.2 journal article - draft written, waiting for review and submission * D5.3 press releases - waiting for the 3rd one to be published, submitting after * D5.4 trade press articles - waiting for a hungarian article to be written, submitting after * D5.5 dissemination report - waiting * D5.6 webinars - waiting * summary of the project - to be written best istván From: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com <mailto:David.Barnard-Wills@trilateralresearch.com> > Sent: Wednesday, October 30, 2019 5:27 PM To: nagy.renata(a)naih.hu <mailto:nagy.renata@naih.hu> ; kulitsan hu <kulitsan.gabor(a)naih.hu <mailto:kulitsan.gabor@naih.hu> > Cc: Istvan Mate BOROCZ <Istvan.Mate.Borocz(a)vub.be <mailto:Istvan.Mate.Borocz@vub.be> > Subject: STAR - input for dissemination report Hi Gabor, Renata, Please find attached the contributions to the dissemination report we discussed today: * information on the ICO event TRI exhibited the STAR materials at. * the version of the GDPR flyer (based on STAR material) that we distributed at the event (Renata, you'll recognise it from the STAR II workshop, but it was originally made for this event). Best wishes, DBW Dr David Barnard-Wills Research Manager (Policy, Ethics and Emerging Technologies) Trilateral Research Ltd. 1 Knightsbridge Green London SW1X 7QA <http://www.trilateralresearch.com/> www.trilateralresearch.com <http://www.twitter.com/dbarnardwills> www.twitter.com/dbarnardwills I'm part time - Working hours: 9.30 to 14.45, Mon, Tues, Thurs, Fri

1 0

STAR final event - 17 October
by Istvan Mate BOROCZ 29 Oct '19

29 Oct '19

Dear Colleague, Thank you for registering to the Support training activities on the data protection reform (STAR) - Final conference, held at 17 October 2019 at the Vrije Universiteit Brussel (link<https://brusselsprivacyhub.eu/events/17102019.html>). During the event we introduced the EU co-funded project, STAR (Support Training Activities on the data protection Reform) and its final outcomes: * 11 training topics focusing on the GDPR, * seminar materials (i.e. Microsoft PowerPoint presentations) for each one of the topics with detailed guidance for trainers and suggested reading materials, * training scenarios, * a takeaway reference GDPR checklist, * a ten-point GDPR introductory list, * an evaluation questionnaire for attendees. During the event attendees were also provided with the STAR handbook for supporting training activities in the data protection reform, which aims to aid the trainers in using the STAR materials. Please find the handbook attached. Both the training materials and the handbook are freely and publicly available in a digital form at the project’s website: http://www.project-star.eu/training-materials. To further increase the quality of the materials and to develop a supporting handbook for trainers we encourage you to use them during your training activities. Furthermore, we would like to ask you to share your impressions and opinion by filling this short questionnaire: https://www.surveymonkey.co.uk/r/2R2P3Y3 Thank you for helping us develop and ameliorate the STAR training materials. Best regards, István Böröcz – on behalf of the STAR consortium

1 0

FW: Interest in getting an article about the STAR research project for the Journal of Data Protection & Privacy
by David Barnard-Wills 23 Oct '19

23 Oct '19

Hi all, What do we make of the Journal of Data Protection & Privacy? (https://www.henrystewartpublications.com/jdpp) – we’ve been approached by the editor for an article. We currently have a STAR II paper submitted to Computer, Law and Security Review, but as yet, haven’t heard anything about it. We could either pursue an additional publication thought this route, or even potentially pull the paper from CLSR and submit here. I wouldn’t normally consider this, but this might progress us along the timeframe a lot quicker. Any thoughts? DBW From: Ardi Kolah <ardi.kolah(a)brighthorizons.com> Sent: 21 October 2019 09:59 To: David Barnard-Wills <David.Barnard-Wills(a)trilateralresearch.com> Cc: Ardi Kolah <ardi(a)kolah.com> Subject: Interest in getting an article about the STAR research project for the Journal of Data Protection & Privacy Dear David I hope you’re well. I’m the founding Editor-in-Chief of the Journal of Data Protection & Privacy, published globally by Henry Stewart Publications. I’m interested to get an article from you on the research project (STAR) that would be of great interest to our readers (we have in excess of 2700 on the LinkedIn Group). It would also be useful to know what future plans exist for STAR and whether this is a move towards a European-standard training approach on data protection, privacy and security and how this compares with the IAPP? Articles tend to be up to 6,000 words plus tables/graphs/charts. I’m attaching a previous edition of the JDPP (for background). Let me know if this is something of interest. Deadline would be end of November for inclusion in the December’s edition of JDPP 3.2 Best wishes Ardi [cid:image001.gif@01D587F5.274C3260] [cid:image002.gif@01D587F5.274C3260]<www.brighthorizons.co.uk> [cid:image003.png@01D587F9.C9AE7DC0] Ardi Kolah LLM Global Privacy Officer T: +443300949673 M: +447519121515 E: ardi.kolah(a)brighthorizons.com<mailto:ardi.kolah@brighthorizons.com> W: brighthorizons.co.uk<www.brighthorizons.co.uk> [cid:image005.gif@01D587F5.274C3260]<https://www.facebook.com/BrightHorizonsFamiliesUK>[cid:image007.gif@01D587F5.274C3260]<https://twitter.com/BHFamiliesUK>[cid:image008.gif@01D587F5.274C3260]<https://www.youtube.com/user/BHFamiliesUK>[cid:image009.gif@01D587F5.274C3260]<https://www.linkedin.com/company/bright-horizons-uk/>[cid:image010.gif@01D587F5.274C3260]<https://www.instagram.com/brighthorizons_uk/> [cid:image011.gif@01D587F5.274C3260] Bright Horizons Children's Centers LLC., 200 Talcott Avenue South, Watertown MA 02472 USA Bright Horizons Family Solutions Limited (Co. No. 2328679), r/o 2 Crown Court, Rushden, Northamptonshire NN10 6BS UK This e-mail and any attachments to it are intended only for the addressee and may contain information which is confidential and/or legally privileged. If you are not the intended recipient, you are hereby notified that any dissemination,distribution or copying is strictly prohibited. If you have received this e-mail in error,please contact the sender immediately and delete the material from any computer and anyprintout thereof. Bright Horizons cannot guarantee that this e-mail communication is secure or free of error. No liability is accepted for any viruses or for any corruption, amendment to or deletion of or from this e-mail.

3 2

star 1 telco
by Istvan Mate BOROCZ 08 Oct '19

08 Oct '19

Dear all, Would you be available for a telco this week (Thursday or Friday preferably)? To discuss the two agenda of the upcoming final events. best istván -- István Böröcz, LL.M. Research Group on Law, Science, Technology & Society (LSTS) | Vrije Universiteit Brussel (VUB) Room 4C339, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be/

3 4

STAR I - trade press article
by David Barnard-Wills 27 Sep '19

27 Sep '19

Hi all, Privacy Law and Business have agreed to publish an article based on STAR. This will fulfil our requirement to write a trade press article during the project. I've drafted the attached. Would you be able to give it a quick review? Anything you think I'm missing? The deadline for submission is the 30th of September, which I think will get it out before out two launch events. So can I have your suggested edits by Friday please? Best wishes, DBW Dr David Barnard-Wills Research Manager (Policy, Ethics and Emerging Technologies) Trilateral Research Ltd. 1 Knightsbridge Green London SW1X 7QA www.trilateralresearch.com<http://www.trilateralresearch.com/> www.twitter.com/dbarnardwills<http://www.twitter.com/dbarnardwills> I'm part time - Working hours: 9.30 to 14.45, Mon, Tues, Thurs, Fri

2 1

STAR project final events
by Istvan Mate BOROCZ 14 Sep '19

14 Sep '19

Dear Colleagues, With this email we would like to cordially invite you to the final events of the EU co-funded project, STAR (Support Training Activities on the data protection Reform), to be held on: * Wednesday, 17 October 2019 Brussels, Belgium 12:30-14:00, U-residence, Vrije Universiteit Brussel, 1050 Brussels * this event is dedicated specifically to Data Protection Officers * please see the details of the event here: https://brusselsprivacyhub.eu/events/17102019.html * Tuesday, 22 October 2019 Tirana, Albania 16:30-18:00, Side Event of the International Conference of Data Protection and Privacy Commissioners * this event is dedicated specifically to representatives of Data Protection Authorities * please see the details of the event here: https://privacyconference2019.info/conference/side-events/ These events will introduce and discuss the final results of the STAR project (co-funded by the European Union (EU) under its Rights, Equality and Citizenship programme (2014-2020)) which supports training activities of EU Data Protection Authorities (DPAs) and Data Protection Officers (DPOs) on the EU data protection reform, and especially on the General Data Protection Regulation (GDPR). The panel will identify the challenges and best practices around data protection training. The panels will then launch the ready-made, easy-to-customise and easy-to-run training materials, (i.e. 11 Microsoft PowerPoint presentations, training scenarios, further supporting forms as well as a handbook for trainers and users of the materials) targeted for DPAs and DPOs and which are freely and publicly available in a digital form at the project’s website: http://www.project-star.eu/training-materials. During the event speakers will guide the audience through the STAR materials and, in form of a discussion, gather their feedback and experience from training activities thereafter. Looking forward to meeting you in Brussels and in Tirana. Kind regards, István Böröcz – on behalf of the STAR consortium -- István Böröcz, LL.M. Research Group on Law, Science, Technology & Society (LSTS) | Vrije Universiteit Brussel (VUB) Room 4C339, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be/

1 1

FW: 41 ICDPPC official side event/No. 20 !
by Istvan Mate BOROCZ 26 Aug '19

26 Aug '19

From: Contact 41 ICDPPC <contact(a)privacyconference2019.info> Date: Thursday, 8 August 2019 at 08:45 To: Istvan Mate BOROCZ <Istvan.Mate.Borocz(a)vub.be>, Istvan Mate BOROCZ <Istvan.Mate.Borocz(a)vub.be> Cc: "contact(a)privacyconference2019.info" <contact(a)privacyconference2019.info> Subject: 41 ICDPPC official side event/No. 20 ! Resent from: <Istvan.Mate.Borocz(a)vub.be> Dear Colleague, We are pleased to be able to confirm now that your proposed side event has been confirmed as an official 41st ICDPPC side event. A summary of your proposed side event (as will be published in due course on our website at: https://privacyconference2019.info/conference/side-events/) is reflected below: Research Group on Law, Science, Technology & Society (LSTS), Vrije Universiteit Brussel (VUB) Support training activities on the data protection reform (STAR) This event will introduce and discuss the final results of the STAR project (co-funded by the European Union (EU) under its Rights, Equality and Citizenship programme (2014-2020)) which supports training activities of EU Data Protection Authorities (DPAs) and Data Protection Officers (DPOs) on the EU data protection reform, and especially on the General Data Protection Regulation (GDPR). The panel will identify the challenges and best practices around data protection training. The panel will then launch the ready-made, easy-to-customise and easy-to-run training materials, (i.e. 11 Microsoft PowerPoint presentations, training scenarios, further supporting forms as well as a handbook for trainers and users of the materials) targeted for DPAs and DPOs and which are freely and publicly available in a digital form at the project’s website: http://www.project-star.eu/training-materials. During the event speakers will guide the audience through the STAR materials and, in form of a discussion, gather their feedback and experience from training activities thereafter. Tuesday 22 October 2019 16.30 – 18.00 Venue TBD No registration required Speakers: * Paul De Hert, Professor, Vrije Universiteit Brussel (VUB) * István Böröcz, Researcher, Vrije Universiteit Brussel (VUB) * David Barnard-Wills, research manager, Trilateral Research Ltd. (TRI) * Júlia Sziklay, Head of Department, Hungarian National Authority for Data Protection and Freedom of Information (NAIH) * Gábor Kulitsán, freedom of information expert, Hungarian National Authority for Data Protection and Freedom of Information (NAIH) If you have any modification or addition to provide to the above publishable extract of your side event, please do so at your earliest convenience at: contact(a)pivacyconference2019.info<mailto:contact@pivacyconference2019.info>, however not later than 14 August 2019. We remain at your fullest disposal for any question or anything you may need. Kind regards, 41st ICDPPC Organisation Team More info at ICDPPC 2019 website: www.privacyconference2019.info<http://www.privacyconference2019.info> Information and Data Protection Commissioner Landline: +355 42237200 IDP web: www.idp.al<http://www.idp.al/> Address: "Rr. "Abdi Toptani", Nd. 5, Kodi postar 1001, Tirana, Albania" [cid:image001.png@01D558D9.B3C928B0] _________________________________ The information in this message may be confidential. If you are not the intended recipient, you must not forward, print, disclose or use in any way the information this message contains. If you are not the intended recipient, delete all copies of this message and any attachments.

3 3

STAR II_Progress Report (D1.2) and newsletter
by nagy.renata＠naih.hu 19 Aug '19

19 Aug '19

Dear All, Please, find enclosed the draft Progress Report (D1.2) and fill out the missing parts marked with yellow and complete the document (especially regarding WP2 and WP4). Please, send your contributions no later than 14 August (Wednesday). Furthermore a newsletter on the SME hotline is attached. Please, circulate it on the contact lists of the STAR II project. If you would like to add or delete any parts, please, feel free to do so. Thank you very much in advance! Best, Renáta

2 3

STAR draft agenda dpo event brussels
by Istvan Mate BOROCZ 05 Aug '19

05 Aug '19

Dear all, Please find attached the draft agenda for the brussels final event. Please send your comments by next Tuesday (30 july). br i -- István Böröcz, LL.M. Research Group on Law, Science, Technology & Society (LSTS) | Vrije Universiteit Brussel (VUB) Room 4C339, Pleinlaan 2, 1050 Brussels, Belgium http://www.vub.ac.be/LSTS/

3 4

STAR II - Minutes of Today's Meeting
by Leanne Cochrane 25 Jul '19

25 Jul '19

Hi All, It was good talking earlier. Please find attached the notes of today's STAR II consortium partners meeting for your review. I also noted 'actions' at the end. Please feel free to amend/add anything I may have missed. Thanks, Leanne <https://www.linkedin.com/in/trilateral-research-7278b3135/>[https://trilateralresearch.co.uk/wp-content/uploads/2018/12/tri-logo.jpg]<http://www.trilateralresearch.com/> Leanne Cochrane Senior Research Analyst | Policy, Ethics and Emerging Technologies Team leanne.cochrane(a)trilateralresearch.com www.trilateralresearch.com<http://www.trilateralresearch.com> Mobile: +44 (0) 7545 955 242 Skype:@ljcochrane My working hours are Wednesday, Thursday (all day) and Friday (morn)

1 0

STARII: on communication tools
by Lina JASMONTAITE 25 Jul '19

25 Jul '19

Dear all, Following up on our call today, I want to share the description for the CPDP2020 panel. I prepared it together with Rosa from the Smooth project. As said, we (meaning Star II) were kindly asked by the organisers to work with the Smooth project, given that there’s a lot of overlap between the two. Title: The GDPR is easy: (Un)tangling SMEs compliance hurdles SMEs are the backbone of European economy: they employ 2 out of 3 employees and produce 57 cents of every euro of value added. Some Data Protection Authorities (DPAs) suggest that attaining compliance with the GDPR for SMEs is fairly easy. Complying with the GDPR, however, poses distinctive challenges for SMEs – apart from lack of awareness, they rarely can afford professional legal advice. Therefore, SMEs have distinct GDPR related needs and merit special support from public authorities – DPAs. In view of this, the panel will first identify those distinct needs of SMEs and then it will turn to the discussion on ways in which public and private actors could help SMEs to move from a relatively good level of awareness to actual compliance with the GDPR. Bullet points: * What are the perceived distinct GDPR related needs of SMEs? * What kind of assistance could SMEs expect and demand from DPAs? * What traditional and alternative (e.g. AI) solutions facilitating GDPR compliance for SMEs are available on the market? * What’s the perspective of an SME owner? Chair: Lou Juget, ESBA (F) or Nadia Feci , KUL-CiTiP, BE (F) – Smooth project Moderator: John Durcan, Enterprise Ireland, IR (M) - not related to any project Speaker 1: Pietro Francesco Di Lotto, Confartigianato di Vicenza, IT (M) – Smooth project advisory board Speaker 2: DPA – Júlia Sziklay, NAIH, HR (F) – STARII coordinator Speaker 3: Ángel Cuevas UC3M(M) / Francesco Bonchi EUT (M)/ Narseo Vallina IMDEA (M) Smooth project Speaker 4: Jasmina Trajkovski (F) – member of STARII advisory board (not paid) Please note, this is a provisional line up and it still has to be approved by the CPDP organisers. Additionally, in this link<https://vub-my.sharepoint.com/:f:/g/personal/lina_jasmontaite_vub_be/EqSTNz…> I enclosed some articles that I came across and that you may want to review before our next call on 6 September. Let me know if you can’t access it. Best regards, Lina Jasmontaite Doctoral researcher Law, Science, Technology and Society (LSTS) Vrije Universiteit Brussel (VUB) Brussels Privacy Hub (BPH) Room 4B306, Pleinlaan 2, 1050 Brussels, Belgium https://lsts.research.vub.be<https://lsts.research.vub.be/> | www.brusselsprivacyhub.org<http://www.brusselsprivacyhub.org/> [VUB-LSTS_RGB]

1 0

STAR I final event(s)
by Istvan Mate BOROCZ 25 Jul '19

25 Jul '19

Dear all, Apparently the PO suggests to have a final event for DPOs as well if we want to go to ICDPPC. According to the latest telco, we could organize a cca 2 hour long event in Brussels with the participation of DPOs, umbrella organizations, and further institutions (e.g. Belgian DPA, EDPS, etc.). The venue at VUB is available on 16, 17 and 18 October. Would you be ok with organizing both events? One for DPOs in Brussels and the other for DPAs in Tirana the week after. If yes, which are your preferred date concerning the Brussels event? br, i -- István Böröcz, LL.M. Research Group on Law, Science, Technology & Society (LSTS) | Vrije Universiteit Brussel (VUB) Room 4C339, Pleinlaan 2, 1050 Brussels, Belgium http://www.vub.ac.be/LSTS/

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

STAR