Dear Gabor, dear all,

Apologies for following up on this email thread only know. I went through the document and provided my comments.

I think you made a good attempt to prepare a guidance for DPAs on good practices in raising personal data compliance/ the GDPR awareness among SMEs. I suggest, however, restructuring the document. I think David and Leanne pointed it out very well that we need to include some kind of good practices and recommendations in this guidance document. At the moment, it includes a description of your experience at NAIH and of the observations from the interviews.

I think the best way to proceed further is to schedule the call and agree upon a way to improve this document.

Could we schedule a skype call for 1 hour 30min on Wed/Thu or Fri next week?

Best regards,

Lina

From: star-bounces@listserv.vub.ac.be <star-bounces@listserv.vub.ac.be> On Behalf Of David Barnard-Wills
Sent: Wednesday, October 23, 2019 12:46 PM
To: 'STAR' <star@listserv.vub.ac.be>
Subject: [star] STAR II - Feedback on DPA guidance draft

Hi Gabor,

Thank you for sending around the draft of the best practice DPA guidance. We have the following comments/thoughts

• The audience for the deliverable will be your fellow DPAS.
• Its audience already has a high level of background contextual knowledge, so we can jump straight in to the best practices – so we can probably cut some of this content down.
• Perhaps the aim of this deliverable should be to 1) introduce best practices in awareness raising that they might not be aware of and 2) provide some evidence base for what has been found to be effective.
• I would suggest keeping the report as brief and accessible as possible.
• We don’t want to duplicate the report on the interviews (d2.1) and the report on the hotline (d3.2).   
• Perhaps we can identify 5-10 best practices for awareness raising for SMES
• Description of the practice
• Followed by why we think its “best”/”good” practice.
• This could include conventional/standard/must have practices – such as a hotline of some description – then then more cutting-edge/innovative/experimental practices – where we don’t have as much evidence for success, but they’re new for an audience.
• E.g. Ireland’s conference with DPOs from large corporations advising SMEs.
• We should be talking about best practices we can be confident of recommending. The readers will want to know why we are confident about our recommendations, or what our rationale for recommending them is (examples will likely be – its had positive feedback from interviews, we found out about it during our information gathering, it worked during the trial of the hotline…. )
• Include other best practices we are aware of, not just activities from STAR II (hotline and awareness raising campaign).
• One (or more) of the best practices should relate to the hotline (setting up, management)
• A potential example is the PHAEDRA II project final recommendations report - http://www.phaedra-project.eu/wp-content/uploads/PHAEDRA2_D41_final_20170114.pdf (particularly, the early  single page with all the best practices together, then short sections setting out the substance of the best practice, and our justification for supporting it).
• We have some specific feedback, notes and suggestions to this effect on the attached word document.

Best wishes,

DBW

Dr David Barnard-Wills

Research Manager (Policy, Ethics and Emerging Technologies)

Trilateral Research Ltd.

1 Knightsbridge Green

London SW1X 7QA

www.trilateralresearch.com

www.twitter.com/dbarnardwills

I’m part time – Working hours: 9.30 to 14.45, Mon, Tues, Thurs, Fri