Personal data protection: the Permanent Commission adopts a modernised framework for the Protection of personal data at EUROCONTROL

In a significant move towards strengthening personal data protection at EUROCONTROL, on 20 March 2024, the Permanent Commission adopted a modernised framework for the protection of personal data, including a modernised Personal Data Protection Regulation and provisions in the service regulations.

The modernised Personal Data Protection Regulation, which entered into force on 1 May 2024, introduces a series of key enhancements to better align EUROCONTROL's framework for the protection of personal data with international standards and best practices.

Among other noteworthy improvements, the modernised Regulation clarifies and extends the rights of data subjects, provides a more robust framework for the lawful processing of personal data and updates existing personal data protection principles. In addition, the newly adopted Regulation clarifies key personal data concepts, including data breaches, privacy by design, and data protection impact assessments.

Central to the modernisation effort is the establishment of the Data Protection Supervisory Board (DPSB), an independent supervisory authority in matters of personal data protection. The DPSB is tasked with monitoring EUROCONTROL's compliance with its personal data protection framework and with the handling of complaints from individuals whose personal data are processed by the Organisation, both staff and externals.

Comprising three external data protection experts, appointed by EUROCONTROL Member States on a rotating basis, the DPSB should commence its oversight duties as soon as its members will be nominated by the Member States, at the latest by early 2025.

As soon as the DPSB is in place, data subjects will be able to lodge a complaint specifically related to data protection matters before the newly created DPSB, ensuring that their grievances are addressed in a timely and transparent manner. The Agency will inform stakeholders through this Newsroom when the Data Protection Supervisory Board has been set up and when the complaint procedure becomes effective.

The first year after the entry into effect of this Regulation is a transitional period during which the Agency will establish the necessary procedures, including setting up the Data Protection Supervisory Board, and bring its data processing activities into conformity with the modernised Regulation.