For the GDPR-curious: WTF is the Article 29 Working Party?

Here’s one that often emerges in GDPR discussions: the Article 29 Working Party.

WTF is the Article 29 Working Party?
It’s a group made up of all the national regulators from each country in the European Union, which has 28 members including the U.K. until Brexit kicks in.

Why does it matter?
These are the regulators that will be in charge of dishing out the much-feared fines to businesses that breach the terms of the GDPR — so those that haven’t gained the appropriate level of consumer consent for data use. So, it’s quite a big deal.

Who is in this party?
The regulator from each of the EU member states; one representative from the European Commission, which has compiled the GDPR; and a representative from the European Data Protection Supervisor. They meet every month or so to discuss developments.

What do they do? 
The group provides independent advice to the European Commission on all things related to data protection. Data protection laws are complex, and each market within the EU has different dynamics, so the group aims to harmonize and streamline the implementation of the law. The goal is to ensure that businesses in, say, France, won’t be dealt with more strictly than businesses in Greece if they have similar GDPR compliance issues. The group has also helped write guidance around the GDPR for their respective countries. The U.K. regulator, the Information Commissioner’s Office, has helped draft all the compliance guidelines for British businesses, for example.

Why is it called Article 29?
Articles are like clauses. This group is called Article 29 because it is named after the Article 29 section in the EU Data Protection Directive (which the GDPR will replace on May 25).

Will this group change after GDPR enforcement?
Yes. In fact, it will become the European Data Protection Board on May 25, the day of GDPR enforcement. The members of the group will remain the same, but they’ll get more legal weight than they have now to push through decisions.

How so?
“They [Article 29 Working Party] issue nonbinding opinions, which provide guidance and therefore carry weight and credibility,” said Yves Schwarzbart, head of policy and regulatory affairs at the U.K. Internet Advertising Bureau. “Their opinions are also taken into consideration by EU courts if necessary, but that doesn’t mean courts always follow their opinions.” But the new board will have the legal power to make final decisions on issues such as disputes within the group, should regulators from different countries disagree with each other, according to Nick Stringer, co-founder of consultancy Entropy and former head of regulatory affairs at the U.K. IAB.

There will also be different levels of fining power. For example, given Facebook’s European hub is in Ireland, it will be the Irish regulator within the group that is in charge of all Facebook’s data protection activities across Europe, according to Stringer. If Facebook was found to violate the GDPR, for example, the Irish regulator would issue any fines, rather than the ICO.

Will the new Data Protection Board include the UK?
That’s not yet clear, thanks to Brexit. For now, the ICO will be part of the board, given Brexit has not yet been executed. Whether it will remain so depends on Britain’s relationship with the EU after Brexit talks.

The GDPR will have long-lasting effects on how all companies collect and use data to sell products or services in Europe or use it for advertising and analytics purposes. Download our guide to the GDPR here.