Privacy & Information Security Law Blog

On February 24, 2023, following public consultation, the European Data Protection Board (EDPB) published the following three sets of adopted guidelines:

1. Guidelines on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V GDPR (05/2021) (final version);
2. Guidelines on certification as a tool for transfers (07/2022) (final version); and
3. Guidelines on deceptive design patterns in social media platform interfaces (03/2022) (final version).

Guidelines on the Interplay Between the Application of Article 3 and the Provisions on International Transfers as per Chapter V GDPR

Guidelines 05/2021 seek to clarify the interplay between the territorial scope of the GDPR, as defined in Article 3, and the provisions on international transfers in Chapter V. As the EDPB notes, the GDPR does not define what constitutes a “transfer of personal data to a third country or to an international organization”. The EDPB therefore identified the following three criteria which, if all met, confirm that a processing operation is an international transfer for the purpose of Chapter V:

1. A controller or a processor (“exporter”) is subject to the GDPR for the given processing;
2. The exporter discloses by transmission or otherwise makes personal data, subject to this processing, available to another controller, joint controller or processor (“importer”); and
3. The importer is in a third country, irrespective of whether or not this importer is subject to the GDPR for the given processing in accordance with Article 3, or is an international organization.

Following public consultation, the original Guidelines were updated and clarified in certain respects. The most significant update was regarding the responsibilities of the controller when the exporter is a processor.  In addition, further examples were included in the adopted Guidelines to provide better understanding.

Guidelines on Certification as a Tool for Transfers

Guidelines 07/2022 provide guidance as to the application of Article 46(2)(f) of the GDPR on transfers of personal data to third countries or to international organizations on the basis of certification. The Guidelines are composed of four parts, each focusing on specific aspects regarding certification as a tool for transfers, and contain an annex which includes examples of supplementary measures, in line with those listed in Recommendations 01/2020, relevant in the context of the use of certification as a transfer tool. The Guidelines were updated to reflect comments received during public consultation.

Guidelines on Deceptive Design Patterns in Social Media Platform Interfaces

Guidelines 03/2022 offer practical recommendations to designers and users of social media platforms on how to assess and avoid deceptive design patterns that violate the GDPR. Deceptive design patterns are, for the purposes of the Guidelines, interfaces and user journeys implemented on social media platforms that attempt to influence users into making unintended, unwilling and potentially harmful decisions, often toward a decision that is against the users’ best interests and in favor of the social media platforms interests, regarding the processing of their personal data. The Guidelines provide examples of deceptive design pattern types, present best practices for different use cases and contain specific recommendations for designers of user interfaces that aim to facilitate the effective implementation of the GDPR. Following public consultation, the original Guidelines were updated to reflect feedback received, including replacing the term “dark pattern” with “deceptive design patters” in the title.