Council Decision (EU) 2018/893 of 18 June 2018 on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning the amendment of Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 containing the list provided for in Article 101 to the EEA Agreement (General Data Protection Regulation) (Text with EEA relevance.)
Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
The position to be adopted, on behalf of the Union, within the EEA Joint Committee on the proposed amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 containing the list provided for in Article 101 to the EEA Agreement, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.
The text of point 5e (Directive 95/46/EC of the European Parliament and of the Council) of Annex XI to the EEA Agreement shall be replaced by the following: ‘ 32016 R 0679 : Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ L 119, 4.5.2016, p. 1 ). The provisions of the Regulation shall, for the purposes of this Agreement, be read with the following adaptations: (a) The supervisory authorities of the EFTA States shall participate in the activities of the European Data Protection Board, hereinafter referred to as “the Board”. To that effect, they shall, but for the right to vote and to stand for election as chair or deputy chairs of the Board, have the same rights and obligations as supervisory authorities of the EU Member States in the Board, unless otherwise provided in this Agreement. The positions of the supervisory authorities of the EFTA States shall be recorded separately by the Board. The rules of procedures of the Board shall give full effect to the participation of the supervisory authorities of the EFTA States and the EFTA Surveillance Authority with the exception of voting rights and to stand for election as chair or deputy chairs of the Board. (b) Notwithstanding the provisions of Protocol 1 to this Agreement, and unless otherwise provided for in this Agreement, the terms “Member State(s)” and “supervisory authorities” shall be understood to include, in addition to their meaning in the Regulation, the EFTA States and their supervisory authorities, respectively. (c) References to Union law or Union data protection provisions shall be understood as referring to the EEA Agreement or data protection provisions contained therein, respectively. (d) In Articles 13(1)(f) and 14(1)(f), as regards the EFTA States, the words “applicable pursuant to the EEA Agreement” shall be inserted after the words “adequacy decision by the Commission”. (e) In Article 45, as regards the EFTA States, the following shall be inserted after paragraph 1: “1a. Pending a decision by the EEA Joint Committee to incorporate into the EEA Agreement an implementing act adopted pursuant to paragraphs 3 or 5 of this Article an EFTA State may decide to apply the measures contained therein. Each EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority, before the entry into force of any implementing act adopted pursuant to paragraphs 3 or 5 of this Article, whether, pending a decision by the EEA Joint Committee to incorporate the implementing act into the EEA Agreement, it will apply the measures contained therein at the same time as the EU Member States or not. In the absence of a decision to the contrary, each EFTA State shall apply the measures contained in an implementing act adopted pursuant to paragraphs 3 or 5 of this Article at the same time as the EU Member States. Notwithstanding Article 102 of the Agreement, if an agreement on the incorporation into the EEA Agreement of an implementing act adopted pursuant to paragraphs 3 or 5 of this Article cannot be reached in the EEA Joint Committee within twelve months of the entry into force of that implementing act, any EFTA State may discontinue the application of such measures and shall inform the Commission and the EFTA Surveillance Authority thereof without delay. The other Contracting Parties to the EEA Agreement shall, by way of derogation from Article 1(3), restrict or prohibit the free flow of personal data to an EFTA State which does not apply the measures contained in an implementing act adopted pursuant to paragraph 5 of this Article in the same way as these measures prevent the transfer of personal data to a third country or an international organisation.”. (f) Whenever the EU enters into consultations with third countries or international organisations with the aim of adopting an adequacy decision pursuant to Article 45, the EFTA States shall be kept duly informed. In cases where the third country or the international organisation undertakes specific obligations regarding the processing of personal data from the member states, the EU will take into account the situation of EFTA States and discuss with third countries or international organisation possible mechanisms for subsequent possible application by the EFTA States. (g) In Article 46(2)(d) the following shall be added: “The supervisory authorities of the EFTA States shall have the same right as EU supervisory authorities to submit standard data protection clauses to the Commission for approval pursuant to the examination procedure referred to in Article 93(2).”. (h) In Article 46, as regards the EFTA States, the following paragraph shall be inserted after paragraph 2: “2a. Pending a decision by the EEA Joint Committee to incorporate into the EEA Agreement an implementing act, the appropriate safeguards referred to in paragraph 1 may be provided for by standard data protection clauses referred to in points (c) and (d) of Article 46(2) where an EFTA State applies the measures contained therein. Each EFTA State shall decide and inform the Commission and the EFTA Surveillance Authority, before the entry into force of implementing acts adopted pursuant to points (c) and (d) of Article 46(2), whether it, pending a decision by the EEA Joint Committee to incorporate the implementing act into the EEA Agreement, will apply the measures contained therein at the same time as the EU Member States or not. In the absence of a decision to the contrary, each EFTA State shall apply the measures contained in an implementing act adopted pursuant to points (c) and (d) of Article 46(2) at the same time as the EU Member States. Notwithstanding Article 102 of the Agreement, if an agreement on the incorporation into the EEA Agreement of an implementing act adopted pursuant to points (c) and (d) of Article 46(2) cannot be reached in the EEA Joint Committee within twelve months of the entry into force of that implementing act, any EFTA State may discontinue the application of such measures and shall inform the Commission and the EFTA Surveillance Authority thereof without delay.”. (i) In Article 58(4), as regards the EFTA States, the words “in accordance with the Charter” shall not apply. (j) In Article 59, the words “, to the EFTA Surveillance Authority” shall be inserted after the words “to the Commission”. (k) The EFTA Surveillance Authority shall have the right to participate in the meetings of the Board without voting right. The EFTA Surveillance Authority shall designate a representative. (l) Where it is relevant to the exercise of its functions under Article 109 of this Agreement, the EFTA Surveillance Authority shall have the right to request advice or opinions from, and to communicate matters to, the Board pursuant to Articles 63, 64(2), 65(1)(c) and 70(1)(e). In Articles 63, 64(2), 65(1)(c), and 70(1)(e), the words “and, where relevant, the EFTA Surveillance Authority” shall be added after the words “the Commission”. (m) The Chair of the Board, or the secretariat, shall communicate to the EFTA Surveillance Authority the activities of the Board, where relevant pursuant to Articles 64(5)(a) and (b), 65(5), and 75(6)(b). In Articles 64(5)(a) and (b), 65(5), and 75(6)(b), the words “and, where relevant, the EFTA Surveillance Authority” shall be added after the words “the Commission”. Where it is relevant to the exercise of its functions under Article 109 of this Agreement, the EFTA Surveillance Authority shall have the right to receive information from a supervisory authority of one of EFTA States concerned pursuant to Article 66(1). In Article 66(1) the words “and, where relevant, the EFTA Surveillance Authority” shall be added after the words “the Commission”. (n) In Article 71(1), the words “, to the Standing Committee of the EFTA States, to the EFTA Surveillance Authority” shall be inserted after the words “to the Council”. (o) In Article 73(1), the following sentence shall be added: “The EFTA States' members of the Board shall not be eligible to be elected as chair or deputy chairs.”.’.
This Decision shall enter into force on the date of its adoption.
The text of point 13 (Working Party on the Protection of Individuals with regard to the Processing of Personal Data) of Protocol 37 to the EEA Agreement shall be deleted.
The texts of Regulation (EU) 2016/679 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union , shall be authentic.
This Decision shall enter into force on the day following the last notification under Article 103(1) of the EEA Agreement ( *1 ) .
This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union .
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.