One-Stop-Shop Leaflet

eu Editor: Secretariat of the European Data Protection Board, Rue Montoyer 30, 1047 Brussels. The EDPB: Guaranteeing the same rights for all How does the EDPB ensure harmonised data protection rights across 30 countries? The EDPB has three main tasks: • provide general guidance on the interpretation and application of EU data protection law; • advise the European Commission on new legislation when it is of particular importance for the individuals’ data protection rights and freedoms; and • adopt consistency decisions and opinions on some national supervisory authorities’ draft decisions having cross-border impact. The European Data Protection Board (EDPB) is an independent EU body with a goal to bring about a consistent application of EU data protection law. The EDPB brings together the national Supervisory Authorities of all EU Member States and Iceland, Liechtenstein and Norway 1 , and the data protection supervisor of the EU institutions (EDPS).

The European Commission also has the right to participate in its works. In doing so, the EDPB helps to make sure that everyone in Europe enjoys the same data protection rights, no matter where they live. 1. As the GDPR has relevance also in those 3 countries, it covers the “EEA”. Each time we refer to the “EU”, it must be understood as “EEA”, therefore also covering those 3 countries. General Guidance The EDPB issues guidelines and recommendations to promote a common understanding of European data protection laws. The EDPB clarifies data protection provisions, and gives a uniform interpretation of rights and obligations. Advisory Role to European Commission The EDPB advises the European Commission on any issue related to the protection of personal data and newly proposed legislation with an important impact on data protection rights and obligations. By doing so, the EDPB makes sure that new EU legislation upholds the highest standards of data protection.

Consistency & One-Stop-Shop Under the GDPR, enforcement is the responsibility of the national supervisory authorities (SAs). Each EU Member State has its own independent supervisory authority, which oversees the application of the GDPR, including the handling of complaints. For data processing taking place in multiple EU countries, the GDPR provides a system of cooperation between the competent SAs, within which they cooperate in order to reach consensus. This one-stop-shop mechanism is designed to reduce the administrative burden for organisations and make it simpler for individuals to exercise their rights from their home base. In case the Competent SAs do not reach consensus, the EDPB will adopt a binding decision to settle the dispute. g. on a new set of standard contracts or on codes of conducts). The EDPB can also issue consistency opinions on any matter of general application of the GDPR, or any issue having an effect in more than one member state.

This work aims to ensure the consistency of the work of the national regulators. How the One-Stop-Shop works for you Gianna, Pietro and Marco believe a private company has breached their data protection rights (and the rights of many other EU individuals) in a major way by sharing their personal data with third parties without any legal basis for doing so. The group of individuals wish to complain about the company, however, they are all based across Italy, and the company’s main establishment is located in Stockholm, Sweden. Thankfully, the GDPR offers them the possibility to lodge a complaint with the Italian Data Protection Supervisory Authority. Through the one-stop-shop, the Italian SA (“Concerned Supervisory Authority”) can request the Swedish SA to investigate the complaint. As it is confirmed that many other individuals all across Europe are affected by the actions of the Swedish company, the Swedish SA takes up the role of “Lead Supervisory Authority”.

The Swedish SA will cooperate with the Italian SA and every other competent authority. The Swedish SA will then come to a decision against the company. The Italian SA informs Gianna, Pietro and Marco in their own language of the decision that was issued by the Swedish SA. However, if instead, the authorities concluded that the company did not breach the GDPR, the Italian SA will adopt a decision to dismiss or reject the complaint. If Gianna, Pietro and Marco disagree, they can – thanks to the one-stop-shop – challenge the decision reached by the Supervisory Authorities in front of a court in their Member State and thereby in their native language. Lastly, in case that the authorities cannot agree on an appropriate course of action - the Swedish SA will submit the matter to the EDPB. There, after the issue has been further analysed, the EDPB will vote to reach a binding decision that settles the dispute between the authorities. The one-stop-shop helps individuals to stand up for their rights, no matter where they live in Europe.