Council Decision (EU) 2018/893 of 18 June 2018 on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning the amendment of Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 containing the list provided for in Article 101 to the EEA Agreement (General Data Protection Regulation) (Text with EEA relevance.)

The position to be adopted, on behalf of the Union, within the EEA Joint Committee on the proposed amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 containing the list provided for in Article 101 to the EEA Agreement, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.

This Decision shall enter into force on the date of its adoption.

“1a Pending a decision by the EEA Joint Committee to incorporate into the EEA Agreement an implementing act adopted pursuant to paragraphs 3 or 5 of this Article an EFTA State may decide to apply the measures contained therein. Each EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority, before the entry into force of any implementing act adopted pursuant to paragraphs 3 or 5 of this Article, whether, pending a decision by the EEA Joint Committee to incorporate the implementing act into the EEA Agreement, it will apply the measures contained therein at the same time as the EU Member States or not. In the absence of a decision to the contrary, each EFTA State shall apply the measures contained in an implementing act adopted pursuant to paragraphs 3 or 5 of this Article at the same time as the EU Member States. Notwithstanding Article 102 of the Agreement, if an agreement on the incorporation into the EEA Agreement of an implementing act adopted pursuant to paragraphs 3 or 5 of this Article cannot be reached in the EEA Joint Committee within twelve months of the entry into force of that implementing act, any EFTA State may discontinue the application of such measures and shall inform the Commission and the EFTA Surveillance Authority thereof without delay. The other Contracting Parties to the EEA Agreement shall, by way of derogation from Article 1(3), restrict or prohibit the free flow of personal data to an EFTA State which does not apply the measures contained in an implementing act adopted pursuant to paragraph 5 of this Article in the same way as these measures prevent the transfer of personal data to a third country or an international organisation.”.

“2a Pending a decision by the EEA Joint Committee to incorporate into the EEA Agreement an implementing act, the appropriate safeguards referred to in paragraph 1 may be provided for by standard data protection clauses referred to in points (c) and (d) of Article 46(2) where an EFTA State applies the measures contained therein. Each EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority, before the entry into force of implementing acts adopted pursuant to points (c) and (d) of Article 46(2), whether it, pending a decision by the EEA Joint Committee to incorporate the implementing act into the EEA Agreement, will apply the measures contained therein at the same time as the EU Member States or not. In the absence of a decision to the contrary, each EFTA State shall apply the measures contained in an implementing act adopted pursuant to points (c) and (d) of Article 46(2) at the same time as the EU Member States. Notwithstanding Article 102 of the Agreement, if an agreement on the incorporation into the EEA Agreement of an implementing act adopted pursuant to points (c) and (d) of Article 46(2) cannot be reached in the EEA Joint Committee within twelve months of the entry into force of that implementing act, any EFTA State may discontinue the application of such measures and shall inform the Commission and the EFTA Surveillance Authority thereof without delay.”.

The text of point 13 (Working Party on the Protection of Individuals with regard to the Processing of Personal Data) of Protocol 37 to the EEA Agreement shall be deleted.

The texts of Regulation (EU) 2016/679 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.

This Decision shall enter into force on the day following the last notification under Article 103(1) of the EEA Agreement .

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.