Article 65 FAQ

Article 65 FAQ How does cross - border cooperation work under the GDPR? The G eneral D ata P rotection R egulation (GDPR) requires the Supervisory Authorities (SAs) of the European Economic Area (EEA) to cooperate closely - under the umbrella of the European Data Protection Board (EDPB) - to ensure the consistent application of the GDPR and the protection of individuals’ data protection rights across the EEA. One of their tasks is to coordinate decision - making in cross - border data processing cases. A processing is cross - border when :  data processing takes place in more than one c ountry;  or it substantially affects or it is likely to substantially affect individuals in more than one country. Under the so - called one - stop - shop mechanism (Art. 60 GDP R), the Lead Supervisory Authority (LSA) acts as the main point of contact for the controller or processor for a given processing, while the Concerned Supervisory Authorities (CSAs) act as the main point of contact for individuals in the territory of their Member State. The LSA is the authority in charge of leading the cooperation process. It will share relevant information with the CSAs, carry out the investigations, prepare the draft decision relating to the case, and cooperate with the other CSAs in an e ndeavour to reach consensus on this draft decision. What is the dispute resolution mechanism of Art . 65 GDPR? When a Lead Supervisory Authority ( LSA ) issues a draft decision, it consults the C oncerned Supervisory Authorities (C SAs ), which can express their disagreement with the draft decision by submitting relevant and reasoned objections (RRO) within a period of four weeks (Art. 60 (4) GDPR). When none of the CSAs object s , the LSA may proceed to adopt the decision. In case at le ast one of the CSAs has expressed a n RRO , and if the LSA intends to follow the objection, it shall submit a revised draft decision to all the CSAs. The CSAs then have a period of two weeks (Art. 60 (5) GDPR) to express their RRO s to the revised draft decis ion. However, if the LSA does not intend to follow the objection(s) , since no consensus can be reached, the consistency mechanism is triggered. This means that the LSA is obliged to refer the case to the European Data Protection Board (EDPB) and the disp ute resolution role of the EDPB is activated (Art. 65(1)(a) GDPR). The dispute resolution mechanism can be triggered in two further cases:  there is a disagreement as to which authority is the LSA (Art. 65(1)(b) GDPR) ;  an SA does not seek the opinion of the EDPB as obliged under 64(1) GDPR or does not follow such an opinion (Art . 64(1) and (2) GDPR) (Art. 65(1)(c) GDPR). W hat is the purpose of the dispute resolution mechanism of Art. 65(1) (a) and (b) GDPR ? The d ispute resolution mechanism triggered under Art . 65(1)(a) and (b) GDPR contribut es to the good functioning of the cooperation mechanism by addressing any disagreements Concerned Supervisory Authorities ( CSAs ) may have in a given case or if there are conflicting views as to which authority is the Lead Supervisory Authority ( LSA ) . The EDPB will act as a dispute resolution body . It must adopt a decision to address the conflict between the involved SAs , which is binding on the m (Art. 65 GDPR) . The decision is adopted by a two - thirds majority of the members of the Board , and in case a decision cannot be adopted within 2 months, the decision is adopted within the next 2 weeks by a simple majority. In wh ich cases is the dispute resoluti on mechanism of Art. 65(1)(c) GDPR triggered? While Art. 65 (a) and (b) relate to the one - stop - mechanism , Art . 65(1)(c) GDPR concerns obligations of S upervisory Authorities (SAs) s stemming from the consistency mechanism. More specifically, every competent SA has the duty to request an opinion from the EDPB before adopting national measures pursuant to article 64(1) GDPR. Such measures include lists of processing operations for which a Data Protection Impact Assessment (DPI A) is required, or the approval of a new set of standard clauses . In addition, under Art. 64(2) GDPR, any SA may also request an EDPB consistency opinion on any matter of general application or producing effects in more than one Member State. If an SA does not request the opinion of the EDPB for the cases listed under Art. 64(1) GDPR or does not follow the EDPB opinion issued under Art. 64 GDPR, any SA and the European Commission can launch the dispute resolution procedure of Art . 65(1)(c) GDPR about the matter. The dispute resolution mechanism of Art. 65 GDPR has been triggered - what happens next? Within one month from the referral of the subject matter, the EDPB must adopt a decision by a two - thirds majority. The one - month deadline to adop t this binding decision can be extended by another month, if the case is complex. When the EDPB is not able to reach a decision within the abovementioned period, the decision must be adopted by a simple majority within two additional weeks. Should the memb ers of the EDPB be split, the decision will be adopted by the vote of the EDPB Chair. The EDPB has adopted its binding decision : when is it notified to the relevant national S upervisory A uthorities (SAs) and in which language ? Once the EDPB has adopted a binding decision, the EDPB Chair notifies the binding decision to the relevant national SAs without undue delay. Prior to the notif ication , the binding decision is translated into the languages of the relevant national SAs th at have to adopt a final decision or take measures at national level on the basis of the binding decision 1 . Translation and proofreading can take a few weeks . In any case, t he English version of the decision is the only authentic language version. What is the next step for the relevant Supervisory Authoritie s (SAs) ? Once the relevant SAs have been notified of the binding decision, a decision has to be adopted at national level to implement the content of the binding decision. This decision will be adopted without undue delay and at the latest one month after the EDPB has notified its decision. For cross - border cases where no consensus was found (Art. 65(1)(a) GDPR ), the final decision will be addressed to the controller or processor and, where relevant , to the complainant. When will the EDPB’s decision be published in those cases where it settles conflicting views on a draft decision or where it decides on the L ead S upervisory A uthority (LSA) ? Once th e LSA or, in some cases the C oncerned Supervisory Authority (CSA) , with which the complaint was lodged has notified the EDPB of the date its final decision was communicated to the controller or processor and, where relevant, to the complainant, the EDPB will publish its own decision on its website . C an a Supervisory Authority (SA) challenge an Art. 65 GDPR decision by the EDPB? As addressees of the EDPB decisions, the relevant SAs that wish to challenge the se decisions can bring an action for annulment before the European Court of Justice (CJEU) within two months of being notified. 1 Please see paragraphs 6 and 7 of Art . 11 of the EDPB Rules of Procedure. In exceptional cases, other CSAs can request, providing the reasons, an urgent translation in their official EU language(s) no later than at the moment of a doption of the binding decision.