ICO and EDPS Memorandum of Understanding

Hunton Andrews Kurth’s Privacy and Cybersecurity

Email

212 309 1223 direct

European Data Protection Supervisor and UK ICO Sign Memorandum of Understanding

by: Hunton Andrews Kurth’s Privacy and Cybersecurity of Hunton Andrews Kurth - Privacy and Information Security Law Blog-Hunton Andrews Kurth

Thursday, November 9, 2023

Print Mail Download

i

On November 8, 2023, the UK Information Commissioner’s Office (“ICO”) and the European Data Protection Supervisor (“EDPS”) announced they have signed a Memorandum of Understanding (“MOU”) intended to reinforce their “common mission to uphold individuals’ data protection and privacy rights, and cooperate internationally to achieve this goal”. The MOU sets out broad principles of collaboration between the ICO and EDPS and the legal framework governing the sharing of relevant information and intelligence. The ICO and EDPS consider that, when addressing similar issues, reducing divergencies in their regulatory approaches will benefit public and private organizations, individuals, and other stakeholders in the UK and EU.

In setting out the scope of the application of the MOU, the common interests of the ICO and EDPS to collaborate are listed. These include, for example, to ensure the ICO and EDPS are able to deliver the regulatory cooperation necessary to underpin the data-based society and protect the fundamental rights of individuals in the UK and the EU, and to cooperate with respect to the enforcement of their respective data protection and privacy laws. To do this, the ICO and EDPS may jointly identify one or more areas or initiatives for cooperation; the MOU includes a non-exhaustive list of ways in which the ICO and EDPS may collaborate, such as:

Sharing of experiences and exchange of best practices on data protection policies, education and training programs;
Implementation of joint research projects and joint publications;
Exchange of information (excluding personal data) involving potential or ongoing investigations of organizations in the respective jurisdictions in relation to a contravention of personal data protection legislation;
Secondment of staff; and
Convening bilateral meetings between the ICO and EDPS.

The MOU does not impose any legally binding obligations on either the ICO or EDPS to cooperate with the other, or to share information with the other, but is a statement of intent to do so. The ICO and EDPS will monitor the operation of the MOU.