Information Commissioner announces GDPR guidance timelines

The Information Commissioner, Elizabeth Denham, today revealed that the next round of GDPR guidance will be released in February, with Article 29 Working Party guidance to come before the end of 2016.

One of the GDPR’s main aims is to harmonise data protection law across EU member states. This means that interpretations of the Regulation need to be shared. Failing to do so will mean divergent interpretations by regulators and a lack of consistency. As a result, guidance at an EU level is very important.

Speaking to the National Association of Data Protection and Freedom of Information Officers (NADPO) today, the Information Commissioner told delegates they could expect GDPR at an EU and UK level before the end of the first quarter of 2017.

The ICO and Article 29 Working Party – which will become the European Data Protection Board – will publish guidance in a number of key areas.

The first pieces to be published will be on data protection officers, data portability and how to identify an organisation’s main establishment and lead supervisory authority.

The Article 29 Working Party then intends to publish its next tranche of guidance by February 2017 and it will be on the idea of data protection impact assessments.

However, not all guidance will be produced working with the Article 29 Working Party as there are areas the ICO ‘wants to develop its own line of thinking’.

By Christmas 2016 the ICO will publish a report into big data and ICO GDPR guidance for profiling and consent should be finalised by the end of January 2017.

Guidance on the GDPR will arrive later than expected, leaving a tight timetable for businesses to make major changes to their systems and operations. The ICO must ensure that the timely release of guidance is a number one priority in 2017.