1/22
Data protection: an important topic for CIT members
The meeting of the Data Protection Working Group took place on 24 March 2022. It was chaired for the first time by the new chairman, Martin Leiter (data protection officer of ÖBB).
The meeting provided the experts an opportunity to exchange views, particularly about issues related to the implementation of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR). The issues discussed included the interaction between data protection and the measures implemented during the COVID pandemic, and the extent to which CIT undertakings could be treated as public sector bodies. The experts also addressed the impact of the Schrems II case on data transfers to non-EU countries.
Besides the GDPR, the experts discussed the revision of Switzerland's Federal Act on Data Protection as well as the ePrivacy Regulation and the Digital Services Act Package.
They also considered the European Data Strategy, which includes a number of initiatives such as the Data Act.
The experts also discussed the amendments proposed by the CIT General Secretariat in the Manual on Data Protection for Transport Undertakings (MDP). The MDP now contains comments on all articles of the GDPR. If these amendments are approved by the CIV Committee, they will enter into force in mid-December 2022.
The CIT GS also intends to draw up a code of conduct on data protection. The benefit of such a code, approved by the relevant supervisory authorities, is that compliance by a controller or processor of personal data can be used as evidence of compliance with the applicable legal obligations. There are currently very few such codes of conduct in existence in Europe. None are known in the transport sector, which means that this project would be a definite "first".
Work on the code will be carried out by a specialist task force. The CIT is inviting all experts from the undertakings to participate in this task force.
The next meeting of the Data Protection Working Group will be held in Bern on 22 March 2023. There will also be another seminar on data protection in 2023.