European Economic Area. Comprehensive data protection. EEA Joint Committee Decision

GDPR in the EEAEEA Joint Committee Decision No 154/2018 incorporating Regulation (EU) 2016/679 into the EEA Agreement

In force

§1Summary

Synopsis

Brings the GDPR into the EEA Agreement so that it applies in the three EEA EFTA states with adaptations. Their DPAs take part in the EDPB, and personal data flows freely between the EU and the EEA EFTA states.

Key themes

EEA
GDPR incorporation
EFTA
EDPB participation

Unique features

The EEA EFTA DPAs participate in the EDPB but have no vote on certain decisions; EFTA Court jurisdiction applies.

SaaS relevance

A SaaS provider serving Norway, Iceland or Liechtenstein is subject to the GDPR in those countries, and transfers within the EEA need no extra safeguards.

§2Obligations

Extraterritorial: Yes
Breach notification: As GDPR
DPO: Conditional
Cross-border transfers: Treated as within the EEA
Maximum penalty: As GDPR

§3Dates

Key dates

Adopted 6 July 2018
In force 20 July 2018
GDPR applies in Iceland, Liechtenstein and Norway from 2018-07-20

§4Text and authority

Text

Authoritative text eur-lex.europa.eu

Authority

National DPAs of Iceland, Liechtenstein and Norway (EDPB members without voting rights on some matters); EFTA Surveillance Authority

§5Where it applies

Also applies in

§6Sources and verification

Sources consulted

Verification

High confidence.

The EUR-Lex OJ link (dec/2018/1022) came from search results and I did not open it.