Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Guidelines on the application of Article 60 GDPR

European Data Protection Board

View source

Nov 21, 2025 edpb-guidelines-on-the-application-of-article-651a-gdpr

Content

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Version 2.1

Adopted on 24 May 2023

Version history

Version 1.0	13 April 2021	Adoption of the Guidelines for public consultation
Version 2.0	24 May 2023	Adoption of the Guidelines after public consultation
Version 2.1	15 July 2024	Editorial corrections

Executive summary

Article 65(1)(a) GDPR is a dispute resolution mechanism meant to ensure the correct and consistent application of the GDPR in cases involving cross-border processing of personal data. It aims to resolve conflicting views among the LSA(s) and CSA(s) on the merits of the case, in particular whether there is an infringement of the GDPR or not, in order to ensure the correct and consistent application of the GDPR in individual cases. These Guidelines clarify the application of the dispute resolution procedure under Article 65(1)(a) GDPR.

Article 65(1)(a) GDPR requires the EDPB issues a binding decision whenever a Lead Supervisory Authority (LSA) issues a draft decision and receives objections from Concerned Supervisory Authorities (CSAs) that either it does not follow or it deems to be not relevant and reasoned.

These Guidelines clarify the applicable legal framework and main stages of the procedure, in accordance with the relevant provisions of the Charter of Fundamental Rights of the European Union, the GDPR and EDPB Rules of Procedure. The Guidelines also clarify the competence of the EDPB when adopting a legally binding decision on the basis of Article 65(1)(a) GDPR. In accordance with Article 65(1)(a) GDPR, the EDPB binding decision shall concern all the matters which are the subject of the relevant and reasoned objection. Consequently, the EDPB will first assess whether the objection(s) raised meet the 'relevant and reasoned' standard set in Article 4(24) GDP R. Only for the objections meeting this threshold, the EDPB will take a position on the merits of the substantial issues raised. The Guidelines analyse examples of objections signalling disagreements between the LSA and CSA(s) on specific matters and clarify the EDPB's competence in each case.

The Guidelines also clarify the applicable procedural safeguards and remedies, in accordance with the relevant provisions of the Charter of Fundamental Rights of the European Union, the GDPR and EDPB Rules of Procedure. In particular, these Guidelines address the right to be heard, the right of access to the file, the duty for the EDPB to provide reasoning for its decisions, as well as a description of the available judicial remedies.

These Guidelines do not concern dispute resolution by the EDPB in cases where: (1) there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment (Article 65(1)(b) GDPR); or (2) a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64 (Article 65(1)(c) GDPR).

	5.3.2	During the assessment of completeness of the file ......................................................25
6	Access to the file............................................................................................................................26	Access to the file............................................................................................................................26
7	The duty to give reasons................................................................................................................28	The duty to give reasons................................................................................................................28
8	Judicial remedies ...........................................................................................................................29	Judicial remedies ...........................................................................................................................29
8.1	Supervisory authorities..........................................................................................................30
8.2	Controller, processor, complainant, or other entity .............................................................31	Controller, processor, complainant, or other entity .............................................................31

1 INTRODUCTION AND SCOPE

Article 65(1)(a) GDPR requires the EDPB to issue a legally binding decision whenever a Lead Supervisory Authority (LSA) issues a draft decision within the meaning of Article 60(3) GDPR and decides not to follow a relevant and reasoned objection expressed by a Concerned Supervisory Authority (CSA) or is of the opinion that the objection is not relevant or reasoned 1 .
Article 65(1)(a) GDPR is a dispute resolution mechanism meant to ensure the correct and consistent application of the GDPR in cases involving cross-border processing of personal data 2 . It aims to resolve conflicting views among the LSA(s) and CSA(s) on the merits of the case, in particular whether there is an infringement of the GDPR or not, in order to ensure the correct and consistent application of the GDPR in individual cases 3 .
Under the so-called ' one-stop-shop mechanism ' , which applies to cross-border processing of personal data, the LSA acts as the sole interlocutor for the controller or processor for the processing at issue 4 . The LSA is responsible for carrying out the necessary investigations, communicating the relevant information to all CSAs and preparing a draft decision 5 . Prior to the adoption of the draft decision, the LSA is required to cooperate with the CSAs in an endeavour to reach consensus and the LSA and CSAs to exchange all relevant information 6 .
Once a draft decision has been prepared, the LSA shall submit this draft decision to all CSAs for their opinion and take due account of their views 7 . Within four weeks after having been consulted, a CSA can express a ' relevant and reasoned objection ' to the draft decision 8 . When no CSA objects, the LSA may proceed to adopt the decision. If any CSA expresses an objection, the LSA must decide whether it will follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned. If the LSA does not intend to follow the objection(s) or considers the objection(s) are not relevant and reasoned, the LSA is obliged to refer the case to the EDPB for dispute resolution 9 .

2 The cooperation and consistency mechanism is applicable to 'individual cases' regardless of whether the case concerns a complaint or ex officio inquiry/investigation.

3 Recital (136) and Article 65(1)(a) GDPR.

7 Article 60(3) GDPR.

8 Article 60(4) GDPR.

The EDPB will then act as a dispute resolution body and adopt a legally binding decision . The LSA, and in some situations the CSA with which the complaint was lodged 10 , must adopt its final decision on the basis of the EDPB decision. The final decision of the competent supervisory authority will be addressed to the controller or processor and, where relevant, to the complainant.
These Guidelines clarify the application of Article 65(1)(a) GDPR. In particular, they clarify the application of the relevant provisions of the GDPR and Rules of Procedure, delineate the main stages of the procedure and clarify the competence of the EDPB when adopting a legally binding decision on the basis of Article 65(1)(a) GDPR. The Guidelines also include a description of the applicable procedural safeguards and remedies .
The present Guidelines do not concern dispute resolution by the EDPB in cases where:

there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment (Article 65(1)(b) GDPR);
a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64 (Article 65(1)(c) GDPR).

2 LEGAL FRAMEWORK AND RULES OF PROCEDURE

2.1 Right to good administration

The EDPB is subject to the Charter of fundamental rights of the European Union (CFEU), including Article 41 (right to good administration). This is also reflected in Article 11(1) EDPB Rules of Procedure 11 , which confirms that the EDPB must respect the right to good administration as set out by Article 41 CFEU.
Article 41 CFEU grants every person the right to have his or her affairs handled impartially, fairly and within a reasonable time by the institutions, bodies, offices and agencies of the Union. This includes the right of every person:

to be heard before any individual measure, which would affect him or her adversely is taken; and
to have access to his or her file, while respecting the legitimate interests of confidentiality and of professional and business secrecy.

The right to good administration also includes the obligation of the administration to give reasons for its decisions.

during which they can express their relevant and reasoned objections to the revised draft decision (Article 60(5) GDPR). See also RRO GLS, paragraphs 2-3.

2.2 GDPR

Article 65(1) GDPR identifies three different situations in which the EDPB acts as a dispute resolution body. The main rules applicable to the dispute resolution procedures are set out in Article 65(2)-(6) GDPR.
In case of a dispute resolution on the basis of Article 65(1)(a) GDPR, regard must also be given to Article 60 GDPR, which applies to the cooperation between the LSA and CSA in individual cases involving cross-border processing and specifies in which cases the LSA submit the matter to the EDPB for dispute resolution. While these Guidelines focus primarily on the application of Article 65(1)(a) GDPR, reference will also be made to the provisions of Article 60 GDPR insofar as they are relevant to clarify the main stages of the procedure and competence of the EDPB under Article 65(1)(a) GDPR 12 .

2.3 EDPB Rules of procedure (RoP)

Article 11 RoP further clarifies the rules applicable in cases where the EDPB is called upon to take a binding decision, including in the context of the dispute resolution procedure. Article 11(2) RoP contains rules that apply specifically to the dispute resolution procedure of Article 65(1)(a) GDPR.
While not the focus of these Guidelines, regard will also be had to Article 22 (Voting), Article 32 (Access to documents), Article 33 (Confidentiality of discussions) and Article 40 (Calculation of time limits) of the RoP, as appropriate.

3 MAIN STAGES OF THE PROCEDURE (OVERVIEW)

3.1 Conditions for adopting a binding decision

The general conditions for the adoption of a binding decision by the EDPB are set forth in Article 60(4)(5) and Article 65(1)(a) GDPR.
The EDPB shall be competent to issue binding decisions on the basis of Article 65(1)(a) GDPR when the following conditions are met:

the submission of a draft decision within the meaning of Article 60(3) by the LSA to the CSAs;
at least one CSA has raised (one or more) objection(s) to the (revised) draft decision of the LSA within the deadline provided by Article 60(4)-(5) GDPR; and
the LSA has decided to not follow the objection(s) on the draft decision or rejected it (them) as not relevant or reasoned.

When these conditions are met, the EDPB shall be competent to adopt a binding decision on the basis of Article 65(1)(a) GDPR, which shall concern all the matters which are the subject of the relevant and reasoned objection(s), in particular whether there is an infringement of the GDPR 13 .
A mere 'comment' expressed by a CSA in relation to a draft decision does not amount to an objection within the meaning of Article 4(24) GDPR. The existence of comments shall therefore not give rise to

the obligation to trigger the Article 65(1)(a) procedure if the LSA decides not to give any effect to the comment. Moreover, any comment expressed does not constitute as such a matter to be decided by the EDPB as part of its binding decision. The LSA is required, however, to take due account of the views expressed by all CSAs 14 and, in cases where the conditions of Article 56(2) are met, take utmost account of the views expressed by the CSA with whom the complaint has been lodged when preparing the draft decision and take due account of the views expressed by all CSAs 15 .

3.2 Assessment of the completeness of the file

Article 11(2) RoP provides that the Chair and the LSA are responsible for deciding whether the file is complete 16 . The assessment of the completeness of the file is an important step in the procedure, designed to ensure that all conditions for adopting a binding decision are met and that the EDPB has all the information necessary for doing so 17 . The assessment of completeness of the file also serves as the starting point for the legal deadlines mentioned in Article 65(2)-(3) GDPR 18 . Finally, the assessment of completeness of the file also seeks to ensure compliance with the right to be heard contained in Article 41 CFEU.
When submitting the matter to the EDPB for dispute resolution, the LSA shall include:

a) the draft decision or revised draft decision subject to the objection(s);
b) a summary of the relevant facts and grounds;

c) the objection(s) made by the supervisory authority(/-ies) concerned in accordance with Article 60 (4) (and where relevant Article 60(5) GDPR);

d) an indication as to whether the LSA does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned ;

e) documentation proving the timing and format of the provision of the (revised) draft decision and of the objection(s) by the concerned supervisory authority (/-ies) 19 ; and f) in accordance with Article 41 of the European Charter on Fundamental Rights, the written observations the LSA collected from the persons that might be adversely affected by the Board ́ s decision , together with confirmation and evidence of which documents submitted to the Board were provided to them when they were invited to exercise their right to be heard or a clear identification of the elements for which it is not the case 20 .

The wording of Article 60(4) GDPR and Article 11(2) RoP makes clear that the LSA is responsible for ensuring that the file is complete and submitting all relevant information to the EDPB. Where necessary, however, the Secretariat may request from the LSA and/or CSAs additional information

14 Article 60(3) GDPR.

15 Article 56(4) and Article 60(1) GDPR.

16 The Secretariat carries out the analysis on the completeness of the file on behalf of the Chair.

17 When necessary, the documents submitted by the competent authority will be translated into English by the EDPB Secretariat.

20 Article 11(2) RoP. See also section 5.

within a specific timeframe 21 . The ability to request additional information should be interpreted in light of the objective of ensuring that the EDPB is provided with all information necessary to take a binding decision concerning all the matters which are the subject of the relevant and reasoned objection(s), in particular whether there is an infringement of the GDPR.

Example 1 :

A draft decision includes several references to internal documentation of the controller. Even though the LSA's (disputed) finding of an infringement is evidenced in its draft decision with reference to the contents of this documentation, the LSA does not include a copy thereof when submitting the matter to the EDPB for dispute resolution. The Secretariat may request the LSA to provide a copy of the documentation that is referenced within a specific timeframe if needed to help decide the subject matter of the relevant and reasoned objection(s).

The ability to request additional information at a later stage does not diminish the responsibility of the LSA to provide all relevant information from the outset when submitting the matter to the EDPB. As the responsibility for ensuring that the file is complete lies with the LSA, the requesting of additional information from the LSA and/or CSA should in principle only be necessary in exceptional circumstances. Moreover, as the LSA and CSA are obliged to exchange all relevant information in the course of the cooperation procedure, the relevant information should already have been provided to CSAs prior to launching the dispute resolution procedure. If all information necessary to take a binding decision on the objections raised is also transmitted by the LSA when referring the subject matter to the EDPB, it will not be necessary for the Secretariat to request additional information before declaring the file complete.

It should be noted that a request for additional information merely seeks to ensure the completeness of the file. It does not imply any judgement regarding the merit of the objections raised, nor does it alter in any way the subject matter referred to the EDPB. Once the file is deemed complete and the subject matter is referred to the EDPB, in exceptional circumstances, additional information may also be requested at a later stage in the procedure (i.e. once the subject matter has been referred to the Board) if necessary to remedy any omissions. This will be subject to a decision by the EDPB 22 .
When necessary, the documents submitted by the LSA and/or CSA will be translated into English by the Secretariat 23 . The translation may also be limited to the specific parts which are likely to be relevant to help decide the subject matter of the relevant and reasoned objection(s). The LSA and/or CSA will have to agree on the translation 24 .

Example 2:

In its draft decision, the LSA concludes that only one of the infringements of the GDPR alleged by the complainant materialised. The CSA considers in its relevant and reasoned objection that the other infringements alleged by the complainant were also committed while the draft decision does not fully explain the factual elements necessary to conclude the infringements did not occur. Therefore, the Secretariat requests the LSA to provide a copy of the necessary parts of the investigation report within

21 Article 11(2) RoP.

24 Article 11(2) RoP.

a specific timeframe 25 . If the translation of these parts is necessary, it will be translated into English by the Secretariat and the LSA will have to agree on the translation.

Once the Chair and the LSA have decided that the file is complete (and the competent supervisory authority agreed on any required English translations), the Secretariat on behalf of the Chair will refer the subject-matter to the members of the EDPB without undue delay 26 .
If the LSA fails to provide the information listed above within the set timeframe 27 , the Chair will ask the Secretariat to refer the subject-matter to the EDPB. The EDPB will then assess, on a case-by-case basis, whether it can proceed to adopt its decision on the basis of the information already provided, or whether it is necessary to first obtain the information requested (e.g., confirmation and evidence of which documents submitted to the Board were provided to them when they were invited to exercise their right to be heard or a clear identification of the elements for which it is not the case) before adopting a decision.

Relationship with the right to be heard

The assessment of completeness of the file also seeks to ensure compliance with the right to be heard contained in Article 41 CFEU. Article 11(2) RoP provides that the EDPB shall take into account only the documents which were provided by the LSA and the other CSA(s) before the matter is referred to the Board. Any person who might be adversely affected should therefore in principle already have been invited to exercise their right to be heard 28 . Where necessary, the Board will take further actions ensuring the right to be heard of the affected persons in relation to the elements within the documents that are part of the file that will be considered by the EDPB in making its decision 29 .
Once the file has been declared complete, LSA and CSA(s) are in principle not able to submit any additional information concerning the subject matter of the dispute (unless requested by the Secretariat with a view of remedying an omission in accordance with Article 11(2) RoP 30 ). Only in exceptional circumstances can the Board decide to consider further documents that it deems necessary. For example, the LSA cannot introduce new elements of fact supporting its decision not to follow one or more objections which were not previously communicated before the matter was referred to the EDPB 31 . Moreover, all information relevant to the assessment of the objections raised should already be exchanged between the LSA and CSA prior to the initiation of the Article 65(1)(a) procedure in an endeavour to reach consensus (as in doing so it may also help avoid the need for trigger the dispute resolution mechanism).

25 Article 11(2) RoP.

26 Article 11(2) RoP.

27 Such a time-frame should be decided on a case-by-case basis, taking into account the nature and volume of the documents requested. The Secretariat should consult with the LSA (or where applicable, CSA) to seek their views as to what constitutes an appropriate timeframe.

30 See paragraph 20 above.

Once the file has been declared complete and the subject matter has been referred to the EDPB, the EDPB must issue a binding decision in relation to each objection raised, unless the CSA who raised a particular objection decides to withdraw it. As the withdrawal of the objection signifies the end of the dispute between the LSA and CSA, it is no longer necessary for the EDPB to resolve the matter 32 . Similarly, the LSA may be able to withdraw a referral to the EDPB on the basis of Article 60(4) GDPR in cases where it later decides that it would like to follow each of the objections raised. The withdrawal of either an objection or referral should occur only in very exceptional cases, however, as the obligation for LSA and CSAs to seek consensus under Article 60 GDPR requires that the dispute resolution mechanism will only be triggered in cases of persistent disagreement and where reaching consensus was not possible.

3.3 Establishment of deadline(s)

The default legal deadline for the EDPB to adopt a binding decision is one month after the Chair and the competent supervisory authority have decided that the file is complete 33 . The deadline may be extended by a further month on account of the complexity of the subject-matter 34 . If the EDPB has not been able to adopt a decision, upon expiry of such an extension, it shall do so within two weeks following the expiration of the extension 35 .

3.3.1 Calculation

The calculation of the deadline for the adoption of the binding decision must be done on the basis of Regulation 1182/71 36 . According to Article 3(2)(c) of Regulation 1182/71,

' a period expressed in weeks, months or years shall start at the beginning of the first hour of the first day of the period, and shall end with the expiry of the last hour of whichever day in the last week, month or year is the same day of the week, or falls on the same date, as the day from which the period runs ' .

The Court of Justice has confirmed that, for instance, if an event which is the point from which a period of a week starts to run happens on a Monday, the period will end on the following Monday, which will be the dies ad quem (deadline expiration date). 37 Likewise, if the time limit is expressed in months and the triggering event occurs on the 20th March, the period will end on the 20th April.

The start date ( ' dies a quo ' ) in the application of Article 65(1)(a) GDPR consists of the day when the Chair and the competent supervisory authority have decided that the file is complete and the subject matter is referred to the EDPB by the Secretariat via the information and communication system mentioned in Article 17 of the EDPB Rules of Procedure.

34 Article 65(2) GDPR.

Since the GDPR does not express periods in working days, the time limits concerned include public holidays, Sundays and Saturdays 38 . However, when the last day of a period is a public holiday, Sunday or Saturday, the period shall end with the expiry of the last hour of the following working day 39 , thus the deadline expiration date ( ' dies ad quem ' ) shall be the following working day.

3.3.2 Decision to extend by one month

Article 65(2) GDPR allows the first one-month deadline to be extended by a further month, taking into account the complexity of the subject-matter. The extension needs to be decided by the Chair of the EDPB, either on its own initiative or at the request of at least one third of the members of the EDPB 40 . The extension decision must be taken prior to the expiration of the one month deadline.

3.3.3 Extension by two weeks

The binding decision must in principle be adopted by two-thirds majority at the latest two months after the file has been considered complete and the subject-matter has been referred to the EDPB. However, if the EDPB has not been able to adopt a decision within the extended timeframe because the required majority is not reached, the EDPB shall then adopt the decision within two weeks following the expiration of the second month by simple majority of its members 41 .
During the two additional weeks, modifications can be made to the draft EDPB binding decision that was previously submitted for adoption by two-thirds majority if necessary to achieve the simple majority. In other words, the draft EDPB binding decision may be adapted and adjusted in case the two-thirds majority is not reached.

3.4 Preparation of the draft EDPB binding decision

According to Article 11(5) RoP, the binding decisions ' shall be prepared and drafted by the secretariat and, upon decision of the Chair, together with a rapporteur and expert subgroups members ' 42 . Therefore, the EDPB Secretariat should act as lead rapporteur and the Chair should decide on the involvement of an expert subgroup and of co-rapporteurs.
As soon as the LSA has submitted the matter to the EDPB for dispute resolution, the Secretariat should start the assessment of the completeness of the file. During this assessment, the Chair is invited to decide on the possible involvement of co-rapporteurs and will invite EDPB members to express an interest to become co-rapporteurs (unless the Chair decides not to involve co-rapporteurs for this case) 43 . In order to ensure fairness and impartiality, the (group of) co-rapporteur(s) should not include delegations from either the LSA or CSAs that submitted objections in relation to the draft decision 44 .

38 Article 3(3) of Regulation 1182/71.

39 Article 3(4) of Regulation 1182/71.

40 Article 11(4) RoP.

Finally, it should be noted that the Chair may also decide to involve the members of one or more other expert subgroups, depending on the needs of the case.
As indicated earlier, Article 11(2) RoP states that the EDPB shall take into account only the documents which were provided by the LSA and the other CSA(s) once the matter is referred to the EDPB. This means that the LSA or CSA(s) cannot during the drafting stage introduce new elements of fact supporting their respective positions.
In accordance with Article 76(1) GDPR, discussions of the Board and of expert subgroups shall be confidential when they concern the consistency mechanism 45 . Moreover, an obligation of professional secrecy is also imposed on the staff of all EEA national supervisory authorities 46 , the EDPS and the EDPB Secretariat 47 . This means that the duty of confidentiality and professional secrecy, which is of paramount importance, shall be respected by the EDPB and its members also in relation to Article 65(1)(a) dispute resolution cases. This concerns both the discussions and the documents exchanged.

3.5 Adoption of the EDPB binding decision

All majorities referred to by the GDPR (or by the RoP) refer to the total number of members of the EDPB entitled to vote, regardless of whether they are present or not 48 .
While not having the right to vote, EFTA EEA supervisory authorities (i.e. Iceland, Liechtenstein and Norway) shall have the right to express their positions on all items discussed and/or voted 49 .
In accordance with Article 68(6) GDPR, the EDPS shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of the GDPR. Where that is the case, the EDPS is entitled to vote on the decision as a whole.
Every EDPB member entitled to vote who is not represented at a plenary meeting can delegate its voting rights to another member of the Board entitled to vote and attending the plenary meeting 50 .
The majority required for the adoption of a binding decision under Article 65(1)(a) GDPR is two-thirds of the EDPB members entitled to vote 51 . Where the EDPB has been unable to adopt a decision by twothirds majority, the EDPB shall adopt its decision within the following two weeks by simple majority. Where the members of the Board are split, the decision shall by adopted by the vote of the Chair 52 .

3.6 Notification to the supervisory authorities concerned

Once the EDPB has adopted its binding decision, the Chair of the EDPB shall notify the decision to all the supervisory authorities concerned without undue delay 53 . Therefore, all the CSAs in the case need to be notified of the binding decision.

45 Article 33 RoP.

46 Article 54 (2) GDPR.

47 Article 56 of Regulation (EU) 2018/1725.

48 Article 22(3) RoP.

52 Article 65(3) GDPR.

53 Article 65(5) GDPR.

The notification will be performed by the Secretariat on behalf of the Chair via the information and communication system mentioned in Article 17 RoP 54 . The notification of the binding decision is performed via the notification of the decision in English, which is the only authentic language of the decision 55 . The supervisory authorities concerned will be deemed to be fully acquainted with the decision as notified 56 .

3.7 Final Decision of the supervisory authority(ies)

Within one month after the notification of the EDPB decision to the supervisory authorities, the LSA and/or CSA (as the case may be 57 ) must adopt a final decision 58 . Each final decision must be adopted 'on the basis of' the decision of the EDPB. Moreover, the final decision(s) must refer to the decision by the EDPB and must specify that this decision will be published on the EDPB website. The final decision(s) of the LSA and/or CSA shall also ' attach ' the decision of the EDPB 59 .

3.7.1 'On the basis of'

The requirement of adopting a final decision 'on the basis of' the EDPB decision reflects the fact that the EDPB's decision is legally binding upon the LSA (and/or eventually the CSA(s) in case of need to adopt a final decision toward the data subjects 60 ) as addressee(s) of the decision 61 .
The aim of the binding decision is to resolve conflicting views among the LSA(s) and CSA(s) on the merits of the case, in particular whether there is an infringement of the GDPR, in order to ensure the correct and consistent application of the GDPR in individual cases 62 .
The final decision must be adopted on the basis of the EDPB's decision and must, therefore, give full effect to the binding direction(s) as set out in the EDPB's decision. For example, if the EDPB has determined that there has indeed been an infringement of the GDPR, the LSA or CSA may not determine otherwise. In the same vein, if the EDPB has determined that envisaged action in relation to the controller or processor does not comply with the GDPR, the LSA or CSA must adapt their course of action accordingly 63 .

54 Article 11.6 RoP.

55 Article 11.6 RoP.

58 Article 65(6) GDPR.

59 The requirement that the final decision « attach » the EDPB decision does not mean that the EDPB decision must be annexed to the final decision within a single document (it is sufficient that the EDPB decision is communicated to the controller or processor together with the final decision).

60 See Article 60(8) and (9) GDPR.

61 Recital (136) and (143) GDPR.

62 Recital (136) and Article 65(1)(a) GDPR.

3.7.2 Decision(s) by LSA and/or CSA

The final decision of the LSA and, as the case may be, the CSA with whom the complaint has been lodged, shall be adopted under the terms of Article 60(7), (8) and (9) GDPR 64 .
The point of departure is that the LSA will be required to adopt and notify its final decision to the main establishment or single establishment of the controller or processor and inform the other supervisory authorities concerned as well as the EDPB of its final decision (including a summary of the relevant facts and grounds) 65 . One important derogation to this requirement concerns the situation where a complaint has been dismissed or rejected.
In cases where a complaint has been dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof 66 .
In case of need to take a decision to only partially dismiss a complaint, the LSA shall adopt the decision for the part concerning actions in relation to the controller or the processor, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof 67 .
Each natural or legal person has the right to an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person, in line with Article 78 GDPR 68 .

3.7.3 Information to the EDPB

The LSA or, as the case may be, the CSA with which the complaint has been lodged, is required to inform the EDPB of the date when its final decision is notified respectively to the controller or the processor and to the data subject 69 .

3.8 Publication of the EDPB binding decision

In accordance with Article 65(5) GDPR, the publication of the EDPB binding decision on the website of the Board shall occur ' without undue delay ' after the LSA has notified the final national decision to the controller/processor and/or the CSA has notified the data subject (in case of a dismissal of a complaint). Whenever possible, 'without undue delay' should be interpreted as suggesting that the publication of the EDPB binding decision should happen on the same day where the final national decision is notified to the controller/processor/complainant.
In order to allow the EDPB to publish its binding decision 'without undue delay' after the notification of the final national decision, Article 65(6) GDPR requires the competent supervisory authority to inform the Board of the date when its final decision is notified respectively to the controller or processor and to the data subject. To avoid undue delays, each competent supervisory authority

64 Article 65(6) GDPR.

65 Article 60(7) GDPR.

66 Article 60(8) GDPR.

67 Article 60(9) GDPR.

69 Article 65(6) GDPR.

should inform the Secretariat of the date on which notification of the national decision is expected to take place, preferably at least one day in advance.

Article 339 TFEU requires the members and staff of the EU institutions not to disclose information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their cost components 70 . As a consequence, some portions of the EDPB binding decision may need to be redacted in order to avoid disclosure of information covered by professional secrecy. The Secretariat will evaluate the need to redact such elements on the basis of EU law and the case law of the CJEU 71 .
The EDPB will also publish the final national decision(s) in its register 72 , taking into consideration possible restrictions under national law of the competent supervisory authority concerning the publication of its decisions. Where such restrictions apply, the SAs should inform the Secretariat of any such restrictions.

4 COMPETENCE OF THE EDPB

The aim of the consistency mechanism, including Article 65(1)(a) GDPR, is to contribute to the consistent application of the GDPR throughout the Union. Recital (136) clearly indicates that the competence of the EDPB to issue a binding decision in case of conflicting views among LSA and CSAs in the context of the cooperation mechanism relates to the merits of the case , in particular whether there is an infringement of the GDPR 73 .
According to Article 65(1)(a) GDPR, the EDPB binding decision shall concern all the matters which are the subject of the relevant and reasoned objection . Therefore, the EDPB will assess only issues included in the objections that have been raised in relation to the draft or revised draft decision of the LSA. The EDPB will not reassess the whole case nor will it address issues that might be raised in the course of the Article 65 procedure but were not the subject of the reasoned and relevant objections submitted prior to the submission of the dispute to the EDPB.
The dispute between the LSA and the CSA(s) may concern either the fact that the LSA does not follow one or more relevant and reasoned objections or that the LSA is of the opinion that one or more

objections is not relevant or reasoned. The EDPB will assess, in relation to each objection raised, whether the objection meets the requirements of Article 4(24) GDPR and, if so, address the merits of the objection in the binding decision.

4.1 Assessment of whether the objections are relevant and reasoned

In its Guidelines on relevant and reasoned objections, the EDPB has clarified the conditions that must be met in order for an objection to be considered 'relevant and reasoned' within the meaning of Article 4(24) GDPR 74 .
When a LSA refers a dispute to the EDPB for resolution in accordance with Article 60(4) and 63 GDPR, the EDPB must first assess whether the objection(s) raised in fact meet the conditions of being relevant and reasoned 75 .
The EDPB recalls that in order for an objection to be considered as 'relevant', there must be a direct connection between the objection and the substance of the draft decision at issue. More specifically, the objection needs to concern either whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR 76 .
In order for an objection to be 'reasoned', it should be coherent, clear, precise and detailed in explaining the reasons for the objection. It should set forth, clearly and precisely, the essential elements on which the CSA based its assessment, and the link between the envisaged consequences of the draft decision (if it was to be issued as it is) and the significance of the anticipated risks for data subjects' fundamental rights and freedoms and, where appli cable, for the free flow of personal data within the Union 77 .
When assessing whether the objections in fact meet the conditions of being relevant and reasoned, the assessment carried out by the EDPB will be both substantial and formal . In other words, the EDPB will take into account the specific wording used by the CSA within each of the objections raised and whether each element of Article 4(24) GDPR is explicitly mentioned in relation to each specific objection; thus requiring an explicit reference to the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects 78 .
In its binding decision, the EDPB will not take any position on the merits of any substantial issues raised by objections that do not meet the conditions of Article 4(24) GDPR. If an objection does not meet the conditions of Article 4(24) GDPR, the binding decision of the EDPB remains without any prejudice to any assessments the EDPB may be called upon to make in other cases, including with the same parties, taking into account the contents of the relevant draft decision and the objections raised by the CSAs.

74 RRO GLS, paragraphs 12-21.

76 RRO GLS, paragraph 12. An objection raised fulfils the criterion of being 'relevant' when, if followed, it would entail a change leading to a different conclusion as to whether there is an infringement of the GDPR or as to whether the envisaged action in relation to the controller or processor, as proposed by the LSA, complies with the GDPR. RRO GLS, paragraph 13.

78 See also RRO GLS, paragraphs 7 and 37.

4.2 Matters subject of the relevant and reasoned objection

In its Guidelines on relevant and reasoned objections, the EDPB also clarified the possible subject matter (substance) of a relevant and reasoned objection 79 . Those Guidelines describe a number of examples of objections that may meet the requirements of Article 4(24) GDPR. These examples relate to possible disagreements between the LSA and CSA on the following matters:
the existence of a given infringement of the GDPR;
the existence of additional or alternative infringements of the GDPR;
gaps in the draft decision justifying the need for further investigation;
insufficient factual information or reasoning;
procedural aspects; and
the specific action envisaged by the draft decision.

4.2.1 Existence of a given infringement of the GDPR

A first example of a possible relevant and reasoned objection involves the disagreement between the LSA and CSA as to whether or not a given provision of the GDPR has been infringed 80 . Such a disagreement may arise where the draft decision adopted by the LSA either:

explicitly confirms the existence of an infringement of a specific article of the GDPR, but the CSA considers that this article of the GDPR has not been infringed 81 ;
explicitly confirms that a particular article of the GDPR has not been infringed, whereas the CSA considers that the article in question has been infringed.

In accordance with Article 65(1)(a) GDPR, the EDPB shall take a binding decision concerning all the matters which are the subject of the relevant and reasoned objections, ' in particular whether there is an infringement of the GDPR ' . The EDPB must make a binding decision which shall whenever possible, taking into account the elements of the file and the right to be heard, provide a final conclusion on the application of the GDPR in relation to the case at hand. In other words, the EDPB shall assess the merits of the arguments raised by the CSA in the objection against those of the LSA and make a final determination as to whether or not the given infringement of the GDPR took place or not. The EDPB will instruct the LSA to alter a finding of an infringement or to include one whenever necessary. In such cases, the LSA will then be obliged to implement the change in its final decision, taking into account the binding decision of the EDPB in relation to the objection raised.

4.2.2 Additional or alternative infringements of the GDPR

A second example of a possible relevant and reasoned objection involves disagreement between the LSA and CSA as to the conclusions to be drawn from the findings of the investigation. For instance, the objection may state that the findings amount to the infringement of a provision of the GDPR other than (and/or in addition to) those already analysed by the draft decision 82 .
As previously indicated, the EDPB must make a binding decision which shall whenever possible, taking into account the elements of the file and the respondent's right to be heard, provide a final conclusion

79 RRO GLS, paragraphs 22-48.

80 RRO GLS, paragraphs 24-25.

81 The RRO GLS include the following example : The CSA argues that LSA did not take into consideration the fact that the household exemption is not applicable to some of the processing operations conducted by a controller and involving the use of CCTV, hence that there is no infringement of the GDPR.

82 RRO GLS, paragraph 26.

on the application of the GDPR in relation to the case at hand. This can potentially include a determination of the existence of additional (or alternative) infringements, provided that the file contains sufficient factual elements to substantiate the alleged infringement and the persons who would be adversely affected have been or can be heard in relation to the objections alleging the existence of an additional or alternative infringement 83 .

Example 3:

The draft decision of a LSA states that the controller failed to comply with the duty to inform pursuant to Article 14 GDPR (information to be provided where personal data have not been obtained from the data subject). The draft decision states that the controller should have provided the information in paragraphs 14(1) and 14(2)(a) and (e) GDPR and finds no other infringements of Article 14. One of the CSAs considers that the controller should have provided all the information referred to in Article 14(2)(b) and (f) GDPR, as the default position is that all such information set out in that subarticle should be provided to the data subject unless one or more categories of the information does not exist or is not applicable. 84 Provided the objection raised by the CSA meets the requirements of Article 4(24), and taking into account the elements of the file and the right to be heard, the EDPB will decide whether or not the controller additionally infringed Article 14(2)(b) and (f) GDPR, in addition to Article 14(1) and Art. 14(2)(a) and (e) GDPR.

If the EDPB determines, following a relevant and reasoned objection to this effect, that additional and/or alternative provisions of the GDPR have been infringed, the LSA will be obliged to reflect this in its final decision, taking into account the binding decision of the EDPB in relation to the objection raised.
It may be possible, in exceptional cases, that the file submitted to the EDPB does not contain sufficient factual elements to allow the EDPB to make a final conclusion regarding the existence of the infringement identified by the relevant and reasoned objection. In most cases, however, the information exchanged during the cooperation procedure should be sufficient to enable the CSA to substantiate its objection in such a way that the EDPB shall be able make a final determination whether or not there has been an infringement of the GDPR 85 . Furthermore, when the LSA submits the matter to the Secretariat to obtain a binding decision on the basis of Article 65(1)(a) GDPR, the Secretariat may also request the LSA and/or CSA to provide additional information that is necessary to ensure the file is complete 86 .

4.2.3 Gaps in the draft decision justifying the need for further investigation by the LSA

A third example of a possible relevant and reasoned objection involves disagreement between the LSA and CSA as to whether the draft decision has sufficiently investigated the relevant infringements of the GDPR 87 .

Example 4:

The LSA, upon receiving a complaint, considers that not all of the allegations of infringements contained in the complaint merit investigation. In its draft decision, the LSA only addresses those

86 See section 3.2 above.

87 RRO GLS, paragraph 27.

aspects of the complaint which it decided to investigate without any statement regarding the other alleged infringements of the GDPR. The CSA considers that the LSA in its investigation unjustifiably failed to address a number of alleged infringements raised by the complainant and submits a relevant and reasoned objection based on the failure of the LSA to properly handle the complaint to safeguard the rights of the data subject.

Article 57(1)(f) GDPR imposes a duty upon supervisory authorities to handle each and every complaint submitted to them and to investigate the subject matter of the complaint ' to the extent appropriate ' . The term 'to the extent appropriate' provides the competent supervisory authority with a margin of discretion as regards the extent or depth of the investigation needed. However, this discretionary power must be exercised with all due diligence 88 and in accordance with the relevant provisions of the GDPR implying mutual cooperation.
If the EDPB, on the basis of a relevant and reasoned objection, determines that the LSA has unjustifiably failed to investigate or in any other way address some of the issues raised by the complaint, the EDPB can issue a binding decision specifying the need for LSA to handle the matter further and to investigate -to the extent appropriate -the remaining subject matter of the complaint. To the extent that the draft decision allows it, the LSA should in principle first seek to finalise its draft decision as regards those matters that do not require further investigation within the deadline specified by Article 65(6).
For those matters requiring further investigation, it may be necessary for the LSA to open a new case file. In case a new case file is opened to address the remaining issues, the LSA is required to comply with all cooperation provisions under the GDPR. This may lead to submitting a new draft decision in accordance with A60(3) GDPR which addresses the outstanding alleged infringement. In situations where it is not possible for the LSA to follow this course of action (e.g., when there is inextricable link bet ween the matter requiring further investigation and the other parts of the LSA's draft decision that are to be finalised), it may be necessary for the LSA to first investigate the matter further and prepare an updated draft decision.
In any event, the LSA shall be required to further address the matter and keep the members of the EDPB informed of the steps taken. Moreover, the CSAs can seek to use the cooperation and consistency mechanisms provided for in the GDPR in case the LSA does not fulfil its obligations flowing from the Article 65 decision (i.e addressing the remaining issues to be resolved) 89 .

4.2.4 Insufficient factual information or reasoning

A fourth example of a possible relevant and reasoned objection involves disagreement between the LSA and CSA as to whether sufficient factual elements and/or reasoning have been included in the draft decision 90 . For instance, a CSA might consider that the conclusion by the LSA included the draft

90 RRO GLS, paragraph 29.

decision is not adequately supported by the assessment carried out and the evidence presented 91 . In such a case the EDPB shall also be competent to issue a binding decision, provided the objection raised meets the whole threshold of Article 4(24) GDPR, including a link between the allegedly insufficient analysis and the existence of an infringement or the envisaged action 92 .

In a situation where the draft decision of the LSA contains insufficient factual elements or reasoning, there are essentially two possible scenarios.
In the first scenario, the file on the basis of which the EDPB shall make its decision already contains sufficient information that would allow to address the lack of sufficient factual elements or reasoning in the draft decision. In such cases, the EDPB shall, within the scope of the relevant and reasoned objection, determine to what extent the LSA should amend its draft decision in order to remedy the insufficiency of reasoning, by making reference to the relevant elements included in the file.

Example 5:

The draft decision of the LSA establishes an infringement of the GDPR based on findings of fact supported by documentary evidence which were provided in the file to the EDPB. A number of CSAs submit relevant and reasoned objections outlining that the link between the documentary evidence and the finding of infringement is not sufficiently reasoned in the draft decision. The EDPB decision finds that the objection(s) are relevant and reasoned and indicates the correct legal interpretation and reasoning that the LSA should incorporate in its final decision.

In the second scenario, the file on the basis of which the EDPB shall make its decision does not contain sufficient factual elements to address the insufficiency of factual elements or reasoning.

Example 6:

The draft decision of the LSA finds that there is no infringement of Article 6(1)(a) GDPR and that the processing in question is lawful on the basis of the data subject's consent. However, neither the draft decision nor any other document in the file provides any further materials or analysis as to whether the conditions of Article 7 GDPR have been met. The draft decision simply states that the processing has been lawfully based on consent, without providing further reasoning or evidence. A CSA raises an objection against this lack of reasoning, arguing that the absence of this analysis gives rise to uncertainty surrounding the finding of no infringement in this case.

If the EDPB determines that the file on the basis of which the EDPB shall make its decision does not contain sufficient factual elements that would allow to remedy the insufficiency of reasoning, the EDPB can issue a binding decision specifying the need for LSA to investigate or address the matter further with a view of obtaining sufficient factual information, in line with what is specified in paragraphs 79-81 above.

4.2.5 Procedural aspects

A fifth example of a possible relevant and reasoned objection involves a disagreement between the LSA and CSA as to whether the procedural requirements imposed by the GDPR have been properly respected and this affects the conclusion reached in the draft decision 93 .

91 Ibid .

92 RRO GLS, paragraph 29.

93 RRO GLS, paragraph 30.

The EDPB recalls that the aim of the dispute resolution mechanism of Article 65(1)(a) GDPR is to resolve conflicting views on the merits of the case 94 . It is not intended to resolve possible disputes regarding procedural requirements or duties of cooperation 95 .
An objection involving a disagreement concerning procedural requirements will only be considered relevant and reasoned if the objection also puts forward arguments clarifying the different conclusion that the LSA should have reached in its draft decision. In its decision, the EDPB will resolve the dispute surrounding the conclusions reached in the draft decision.
If the procedural deficiencies leave the EDPB unable to resolve the dispute surrounding the conclusions reached by the draft decision (e.g. due to a lack of sufficient factual elements), the EDPB will recall the importance of the duty of cooperation and issue a binding decision specifying the need for LSA to investigate or address the matter further, in line with what is specified in paragraphs 79-81 above and ensuring full compliance with the procedural requirements in the GDPR which were not met.

4.2.6 Action envisaged

A sixth example of a possible relevant and reasoned objection involves disagreement between the LSA and CSA as to whether the envisaged action in relation to the controller or processor complies with the GDPR 96 .
The EDPB recalls that Recital (150) GDPR states that the consistency mechanism may also be used to promote a consistent application of administrative fines. As a result, if the assessment of the EDPB within this context identifies shortcomings in the reasoning leading to the imposition of the fine at stake, the LSA will be instructed to re-assess the fine and remedy the identified shortcomings 97 .
Fines are by no means the only action a supervisory authority can envisage. A relevant and reasoned objection may therefore also relate to other envisaged actions, taking into account the range of powers listed in Article 58(2) GDPR. Each envisaged measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case 98 . In this context, it should be recalled that the decision to reject or dismiss a complaint, in whole or in part, also constitutes an envisaged action capable of being subject of a relevant and reasoned objection.

If the EDPB, on the basis of a relevant and reasoned objection, determines that the envisaged action included in the draft decision does not comply with the GDPR, it shall instruct the LSA to re-assess the envisaged action and change the draft decision in accordance with the binding decision of the EDPB.

5 THE RIGHT TO BE HEARD

5.1 Applicability

The right to be heard before an administration takes a measure that would adversely affect a person is enshrined in Article 41 CFEU and has long been recognised as a general principle of EU law 99 . The

94 See above at paragraph 61.

96 See also RRO GLS, paragraphs 32 et seq.

97 RRO GLS, paragraph 34.

98 Recital (129) GDPR.

right to be heard is also included in Article 16 of the European Code of Good Administrative Behaviour and reflected in Article 11 RoP.

Article 41 CFEU is addressed not to the Member States but solely to the institutions, bodies, offices and agencies of the European Union 100 . Nevertheless, the right to be heard has also been recognised as ' inherent in respect for the rights of the defence, which is a general principle of EU law ' 101 and therefore also applies when Member States adopt decisions which come within the scope of EU law 102 .
The right to be heard applies to administrative proceedings of which the outcome is likely to affect the (legal or natural) person 's interests . It also applies in situations where the administration of EU law is divided or shared between EU and the Member States (socalled 'composite procedures ' 103 ). Article 41(2)(a) CFEU is framed in terms of individual measures that would adversely affect the person, with no specific requirement that the contested measure should be initiated against that person 104 .
Article 65(2) GDPR provides that the EDPB 's decision ' shall be [...] addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them '. Article 65(2) GDPR reflects the fact that the binding decision of the EDPB aims to resolve a dispute that has emerged among two or more national supervisory authorities. In accordance with the procedure under Article 60 GDPR, LSA will have shared its legal analysis in the draft decision and in relation the objections raised during the cooperation procedure. The CSA(s) likewise will have shared its (their) objection(s) in relation to the draft decision, including any materials to substantiate their objection. In addition, both the LSA and CSAs can share their views in the course of the preparation and adoption of the EDPB decision 105 .
Article 65(2) GDPR also confirms that the EDPB decision does not address directly any party other than the LSA and CSAs. Nevertheless, the decision adopted by the EDPB at European level shall be binding on the LSA or, as the case may be, the CSA with which the complaint has been lodged and is therefore decisive for the outcome of the procedure at national level. It therefore also may affect the interests of persons who were part of the procedure that gave rise to the draft decision.
As a result, any of these persons which would be adversely affected by the decision, in particular the controller(s) and/or processor(s) who are addressed by the draft decision of the LSA, as well as any other person which would be adversely affected by the decision, must be afforded the right to be

heard in relation to the subject matter which is brought before the EDPB pursuant to Articles 60(4), 63 and 65(1)(a) GDPR.

5.2 Purpose

The right to be heard is described by the Court as guaranteeing ' every person the opportunity to make known his views effectively during an administrative procedure and before the adoption of any decision liable to affect his interests adversely ' 106 . As clarified by the CJEU, the purpose of the rule, that the addressee of an adverse decision must be placed in a position to submit his observations before that decision is taken, is to put the competent authority in a position effectively to take all relevant information into account. In order to ensure that the person concerned is in fact protected, the purpose of that rule is, inter alia, to enable that person to correct an error or submit such information relating to his or her personal circumstances as will argue in favour of the adoption or non-adoption of the decision, or in favour of it having a specific content 107 .
The right to respond is also part of the right to be heard since an 'administrative procedure requires that the person concerned should be able [...] to put his own case and properly make his views known on the relevant circumstances and, where necessary, on the documents taken into account by the Community institutions' 108 . Except in cases where legislation expressly provides for the possibility of an oral hearing, such as in the competition proceedings, the right to be heard does not necessarily require an oral hearing 109 .

5.3 Timing

5.3.1 At national level and prior to referral to the EDPB

Before the EDPB is given the task of issuing a binding decision, every supervisory authority is under and obligation to respect the right to be heard in the context of its national procedure, as a general principle of EU law 110 . Indeed, every supervisory authority needs to ' respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken ' 111 . The right to be heard applies regardless of whether the case is cross-border in nature or not.
Even in the absence of specific provisions under national law, the LSA should, in advance of triggering Article 65(1)(a) GDPR, ensure that procedure conducted at national level takes into account the requirements of the right to be heard as a general principle of EU law.

5.3.2 During the assessment of completeness of the file

When the LSA submits the matter to the Secretariat with a view of obtaining a binding decision of the EDPB under Article 65(1)(a) GDPR, the Secretariat should assess which persons would possibly be adversely affected by the EDPB decision in the sense of Article 41 of the Charter. It should also assess whether each of those persons was offered the opportunity to exercise its right to be heard.

107 Judgment in Glencore , paragraph 41 and 52.

110 See paragraph 94 above.

111 Recital (129) GDPR.

It is not sufficient that the LSA has heard the persons who might be adversely affected in the course of the national procedure prior to the adoption of its draft decision within the meaning of Article 60(3) GDPR. Before the EDPB will be in a position to resolve the dispute, the right to be heard must also be afforded in relation to any objections raised in relation to the draft decision, in particular where the LSA chooses not to follow the objection (or considers it as not being relevant and/or reasoned).
When submitting the matter to the Secretariat, the LSA is expected to demonstrate how the right to be heard has been afforded to persons benefitting from this right in the course of the national procedure leading to the draft decision. As regards the documents shared when submitting the matter to the Secretariat, the LSA should specifically mention whether or not these documents (or the relevant contents thereof 112 ) were subject to the right to be heard and with regard to which persons 113 . Replies or summaries of the hearing(s) should be provided as well.
The accommodation of the right to be heard is an essential element of the procedure, in the absence of which the subject matter of the dispute cannot be settled by the EDPB. As a result, the gathering and verification of the relevant information is carried out in the context of the check on the completeness of the file, before the subject matter is referred to the EDPB. Only after all the relevant verifications have been made by the Secretariat, the Chair shall be in the position to declare the file complete 114 .
If there are relevant documents or information that have not been subject to the right to be heard, the Chair may instruct the Secretariat to ask the supervisory authorities (LSA / CSA) to take the necessary actions to enable any party that could be affected to be heard. If necessary, the Chair may instruct the Secretariat to take measures to directly ensure the right to be heard at the EDPB level. In both instances, the persons who would be adversely affected shall be invited to exercise the right to be heard on the relevant documents or information within a specific timeframe, taking into account the complexity of the subject matter (as well as possible needs for translation).

6 ACCESS TO THE FILE

The right to good administration includes the right of every person to have access to the file, while respecting the legitimate interests of confidentiality and of professional and business secrecy 115 .
Access to the documents and information that form the basis of an administrative decision is closely connected with the right to be heard 116 . In accordance with that principle, 'the addressees of decisions

114 See also section 3.2 above.

which significantly affect their interests must be placed in a position in which they can effectively make known their views as regards the information on which the authorities intend to base their decision ' 117 .

The right of access to the file of the EDPB as part of the right to good administration is distinct from the general right of access to documents held by the European institutions, bodies, offices and agencies pursuant to Regulation (EC) No 1049/2001 118 , Article 15(3) TFEU or Article 42 of the Charter 119 . The right of access to the file and the right of access to documents are subject to different criteria and exceptions and pursue different purposes.
The right of access to the file extends to the documents shared with the EDPB to resolve the dispute in accordance with Article 65(1)(a) procedure, save where they involve business secrets of other undertakings, confidential information, as assessed by the EDPB on a case by case basis.
The right of access to the file shall not extend to confidential information and internal documents of the EDPB or the SAs (e.g. email correspondence or preparatory documents). In particular, the right of access shall not extend to exchanges between the EDPB and its members once the procedure has been launched 120 .

119 Article 32 RoP.

120 See also Article 33 RoP.

7 THE DUTY TO GIVE REASONS

The right to good administration contained in Article 41 CFEU also includes the obligation of the administration to give reasons for its decisions 121 .
The duty to give reasons entails informing the addressee of the decision of the factual and legal grounds on which it is based, thereby enabling the person to decide whether to seek judicial review and facilitate the exercise of that review by the courts 122 .
The EDPB must articulate, in a clear and unequivocal fashion the reasoning underlying in its decision in such a way as to enable the persons affected to ascertain the reasons for its decision. While the EDPB does not need to state all legal and factual reasons leading to its decision, it must explain those which were of decisive importance 123 . In the same vein, the EDPB is also not obliged to adopt an explicit position on all the arguments raised. It is sufficient for the decision to set out, in a clear and unambiguous manner, the principal issues of law and of fact upon which it is based and which are necessary in order that the reasoning which has led the EDPB to its decision may be understood. What ultimately matters is that the statement of reasons by the EDPB enables all persons affected by the decision to ascertain whether the relevant provisions have been applied correctly.
The EDPB must in its statement of reasons set out all the relevant grounds and motives for the adoption of its decision -including those that originate from the national level. This means that insofar as the facts set out in the draft decision or related documents are decisive for the decision of the EDPB, then the EDPB should include them in its statement of reasons 124 .
In relation to objections where the EDPB simply agrees with the reasons contained in the draft decision by the LSA or the decision of the LSA not to follow the relevant and reasoned objection (or to consider them not relevant or reasoned), the EDPB may fulfil its duty to state reasons by simply referring back to the position of the LSA, provided the affected persons were informed of those positions of the LSA and given the opportunity to be heard in relating to those positions 125 .
In light of the aforementioned considerations, the binding decision adopted by the EDPB on the basis of Article 65(1)(a) GDPR should in principle include a summary of dispute as well as an assessment of whether the conditions for adopting a binding decision are met. For each objection raised, the EDPB will then in principle 126 :

summarise main elements of the draft decision which are related to the subject matter of the objection;

121 Article 41(2)c CFEU.

125 Ibid .

126 The draft binding decision of the EDPB should in principle synthesize the main elements of facts preceding the dispute, together with a summary of the main arguments put forth, unless the specific wording used is essential for a proper discussion/understanding of the issue at stake.

summarise the main elements of the objection raised;
summarise the position of the LSA or CSA in relation to the objection raised; and
summarise the position of the persons who may be adversely affected in relation to the objection.

Once the relevant elements have been set out, the EDPB will assess, in relation to each objection raised, whether the EDPB meets requirements of Article (24) GDPR and, if so, address the merits of the objection in the binding decision 127 .

The operative parts of the decision should be clearly identified as such and included at the end of the decision, rendering explicit to what extent the competent authority is required/not required to amend its draft decision before finalisation.

8 JUDICIAL REMEDIES

Article 47 of the Charter guarantees the right to an effective remedy and to a fair trial. This is linked to the need to ensure the compatibility of the acts of the EU institutions with the European Union legal order, which is a task generally entrusted to the Court of Justice and to the courts of the European Union.
Good administrative behaviour entails informing persons affected by the measure of the available appeal mechanism 128 . The EDPB decision will refer to the possibilities open to appeal it (i.e. to seek annulment), whereas the competent supervisory authority will refer to the appeal mechanisms available at national level. The competent supervisory authority may in its final decision also choose make reference to the possibilities to seek annulment of the decision of the EDPB on the basis of which the final decision was adopted, as clarified by Recital (143) GDPR (in addition to providing information regarding possible appeal mechanisms at national level in relation to its final decision).
While Recital (143) refers to the possibility of persons directly and individually concerned by a decision of the EDPB bringing an action for annulment before the CJEU, the position on standing will ultimately be assessed by the CJEU in light of the conditions provided for in Article 263 TFEU 129 .
An action for annulment before the Court of Justice does not suspend the effects of the decision of the EDPB 130 . The competent SAs will therefore still have to comply with the decision of the EDPB adopted on the basis of Article 65(1)(a) GDPR, notwithstanding the appeal. This is without prejudice to the right to effective judicial remedy by the controller or processor at national level in accordance with Article 78 GDPR.

8.1 Supervisory authorities

Article 65(2) GDPR makes clear that decisions adopted by the EDPB on the basis of Article 65(1)(a) GDPR are binding upon the lead supervisory authority and all the concerned supervisory authorities. National SAs must adopt their final decision on the basis of the EDPB decision. Article 65(2) also makes clear the decision is an act 'addressed to' the LSA and the CSAs - it does not directly address any third parties 131 .
According to Recital (143) GDPR, as addressees of the decisions of the Board, the concerned supervisory authorities which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. This means, inter alia , that the supervisory authorities acting before the Court of Justice against a binding decision of the EDPB would need to do so relying on one of the listed grounds for annulment contained in Article 263 TFEU.
Although only the LSA and some CSAs (pursuant to Article 60(8) and (9) GDPR) shall adopt their national decision on the basis of the EDPB binding decision, the decision is addressed to all the CSAs involved in the cross-border case. Article 65(2) GDPR mentions all the CSAs as addressees of the decision and the final national decision is the product of a co-decision making process which is strongly affected by the decision of the EDPB. As a consequence, all the supervisory authorities that are concerned in a given cross-border case (see Article 4(22) GDPR) are 'addressed' by the decision and therefore entitled to bring action for annulment of the EDPB decision.
Although the supervisory authorities concerned, as Members of the EDPB, gain knowledge of the content of the EDPB binding decision in the occasion of its adoption pursuant to Article 65(2) GDPR, the time limitation for them to bring action will start when the decision is notified to them by the EDPB Secretariat, acting on behalf of the Chair 132 and using the internal information and communication system 133 .

131 See also paragraph 97 above.

133 See Article 17 EDPB RoP.

8.2 Controller, processor, complainant, or other entity

Entities other than the addressees may be entitled to act before the Court of Justice for the annulment of the EDPB binding decision if the decision is of direct and individual concern to them, under the conditions set in Article 263 TFEU 134 .
Recital (143) explicitly mentions that controllers, processors, or complainants may be directly and individually concerned by an EDPB binding decision. These requirements are, however, interpreted restrictively by the Court of Justice and therefore a case-by-case analysis is necessary 135 .
Without prejudice to the right under Article 263 TFEU, each natural or legal person also has an effective judicial remedy before the competent national court against those final decisions taken by supervisory authorities, which produces legal effects concerning that person 136 . This right has to be exercised in accordance to the applicable national legislation. Article 78(4) GDPR specifies that where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
Where a decision of a supervisory authority implementing an Article 65 GDPR decision of the EDPB is challenged before a national court and the validity of the decision of the EDPB is at issue, the national court does not have the power to declare the EDPB's Art icle 65 GDPR decision invalid. Where it considers the decision invalid, it must refer the question of validity to the Court of Justice in accordance with Article 267 TFEU 137 .
However, a national court may not refer a question on the validity of a decision of the EDPB when the requesting natural or legal person was under the legal conditions to bring an action for annulment of that decision before the CJEU (in particular if it was directly and individually concerned), but had not done so within the two-month period laid down in Article 263 TFEU. Therefore, when the directly and individually concerned persons decide to not bring an action for annulment of the EDPB binding decision, this will prevent them from challenging the validity of the EDPB binding decision in front of national courts.

134 Recital (143) GDPR.

Footnotes

On the concept of relevant an reasoned objection see European Data Protection Board, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, Version 2.0, 9 March 2021 (hereafter, 'RRO Guidelines'), https://edpb.europa.eu/sites/edpb/files/files/file1/edpb guidelines 202009 rro final en.pdf.
Article 56(6) GDPR. In cases involving data subject complaint(s), each CSA acts as the main point of contact for the data subject(s) in the territory of its Member State. See Article 60(7)-(9), Article 65(6) and article 77(2) GDPR. See also Recitals (130) and (141) GDPR.
See Article 60(3) GDPR. In accordance with Article 60(2) GDPR, the LSA may request at any time the other CSA to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62 GDPR.
This duty of cooperation applies to every stage of the procedure, starting with the inception of the case and extending to the whole decision-making process, see Article 60(1) GDPR and RRO Guidelines, paragraph 1. As part of the cooperation procedure, the LSA and CSAs are also required to exchange all relevant information with each other (Article 60(1) GDPR).
Articles 60(4), 63 and 65(1)(a) GDPR. If the LSA intends to follow the objection(s) that are deemed relevant and reasoned, it shall submit a revised draft decision to all the CSAs. The CSAs then have a period of two weeks
This will apply in particular if the complaint is totally or partially dismissed (Article 60 (8)-(9) GDPR). See further at paragraph 51 and following.
EDPB Rules of Procedure, adopted on 25 May 2018, as last modified and adopted on 8 October 2020, available at https://edpb.europa.eu/sites/edpb/files/files/file1/edpb rop version 7 adopted 20201008 en.pdf (hereafter 'RoP').
For additional guidance regarding Article 60 GDPR, see Guidelines 02/2022 on the application of Article 60 GDPR, 14 March 2022, available at https://edpb.europa.eu/system/files/202203/guidelines 202202 on the application of article 60 gdpr en.pdf.
See Section 4 for further details concerning the competence of the EDPB in accordance with Article 65(1)(a) GDPR.
See Article 11(4) RoP and see further Section 3.3.
The aim of providing this information is to allow the Secretariat to verify the objection has been provided in writing and within the legal deadline. The timing and format of the provision of the (revised) draft decision and of the objection(s) can be proven, for example, via the relevant and reasoned objections report from the information and communication system mentioned in Article 17 of the RoP.
Article 11(2) RoP provides that in exceptional circumstances, the EDPB can decide to consider further documents it deems necessary. As a result, the additional information may be requested by the Secretariat/Chair but the EDPB will have to decide if it will consider or not the additional info received.
The competent authority must express its agreement with the translation provided (Article 11(2) RoP).
See in particular Article 11(2) RoP: '[ ...] together with confirmation and evidence of which documents submitted to the Board were provided to them when they were invited to exercise their right to be heard or a clear identification of the elements for which it is not the case. '
See Section 5 for additional information regarding the exercise of the right to be heard.
Indeed, the wording of Article 11(2)d RoP confirms that when launching the procedure, the LSA should give an 'indication' as to whether it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned (i.e. simply an indication as to whether it follows or not the objections). As a result, no new elements may be submitted going beyond those of which the CSAs were informed prior to the submission to the Board.
In cases where the withdrawal concerns the only objection which the LSA has decided not to follow or considered as not relevant and reasoned, the EDPB shall no longer be required to issue a binding decision in accordance with Article 65(1)(a) GDPR.
Article 65(2) GDPR in conjunction with Article 11(4) RoP.
Article 65(3) GDPR. See also paragraph 32.
Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits, O.J. 8.6.197, L 124/1. Article 40 RoP confirms that ' In order to calculate the periods and time limits expressed in the GDPR and in these Rules of Procedure, Regulation 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits shall apply '.
See the Judgment in Maatschap Toeters , MC Verberk v. Productschap Vee en Vlees , C-171/03, ECLI:EU:C:2004:714, paragraph 33.
See Article 65(3) GDPR. Regarding the calculation of the majority and voting rights of EDPB members see further Section 3.5 (Adoption of the EDPB binding decision).
See also Article 75(6)(g) GDPR, which provides that the Secretariat shall be responsible in particular for the preparation, drafting and publication of decisions on the settlement of disputes between supervisory authorities.
If the call for expression of interests to serve as co-rapporteur is made prior to the assessment that the file is complete, care should be taken not to disclose any elements of the file until after the assessment has been made and the subject matter has been referred to the EDPB.
See also the Judgment in Dr. August Wolff GmbH & Co. KG Arzneimittel , Case C-680/16 P, 27 March 2019, ECLI:EU:C:2019:257, paragraphs 29-41.
See the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 amending Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement [2018/1022], See also Recital (7) and Article 4(1) RoP.
The Chair and the secretariat shall be notified of any delegation of voting rights. Article 22(5)5 RoP.
Article 65(2) GDPR in conjunction with Article 22(3) RoP.
Article 11.6 RoP. Urgent translations may be provided to authorities required to adopt a decision or take measures at national level on the basis of the EDPB binding decision in another EU language. Other supervisory authorities concerned can exceptionally request an urgent translation providing the reasons for such request. As the authentic language of the EDPB decision is English, the EDPB is not responsible for any use of the translations provided (Article 11.7 RoP).
In case of partial or complete dismissal of a complaint, see Article 60(8) and (9) GDPR.
See Section 4 (Competence of the EDPB), in particular section 4.2 (Matters subject of the relevant and reasoned objection).
See also Recital (143) GDPR. See further Section 8 (Judicial remedies).
An obligation of professional secrecy is also imposed on the staff of the EU institutions by the Staff Regulations and on the staff of the EDPS, including the EDPB Secretariat, also by Article 56 of Regulation (EU) 2018/1725. An obligation of professional secrecy is also imposed by Article 54 (2) GDPR on the members and staff of each supervisory authority.
See, for instance, Judgments in Bank Austria Creditanstalt , T-198/03, 30 May 2006, ECLI:EU:T:2006:136; in Evonik Degussa , T-341/12, 28 January 2015, ECLI:EU:T:2015:51; in Akzo Nobel NV , T-345/12, 28 January 2015, ECLI:EU:T:2015:50; in MasterCard, Inc. , T-516/11, 9 September 2014, EU:T:2014:759; in Stichting Greenpeace Nederland , T-545/11 RENV, 21 November 2018, ECLI:EU:T:2018:817; in Amicus Therapeutics UK Ltd , T-33/17, 25 September 2018, ECLI:EU:T:2018:595; in Pergan Hilfsstoffe für industrielle Prozesse GmbH , Case T-474/04 , 12 October 2007, [2007] ECR II-4225.
Article 70(1)(y) GDPR requires the EDPB to maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism. See https://edpb.europa.eu/our-work-tools/consistency-findings/register-for-decisions.
Recital (136) stipulates that " [...] The Board should also be empowered to adopt legally binding decisions where there are disputes between supervisory authorities. For that purpose, it should issue, in principle by a two-thirds majority of its members, legally binding decisions in clearly specified cases where there are conflicting views among supervisory authorities, in particular in the cooperation mechanism between the lead supervisory authority and supervisory authorities concerned on the merits of the case, in particular whether there is an infringement of this Regulation. '
As clarified earlier, the LSA shall submit the matter to the EDPB either if it does not follow the relevant and reasoned objection or if it is of the opinion that the objection is not relevant or reasoned. See section 3.1 above.
RRO GLS, paragraph 19. See also RRO GLS, paragraph 16. (' In order for the objection to be 'reasoned', it needs to include clarifications and arguments as to why an amendment of the decision is proposed (i.e. the legal / factual mistakes of the LSA's draft decision). It also needs to demonstrate how the change would lead to a different conclusion as to whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR. ').
See section 5 regarding the right to be heard.
See also Article 29 Working Party Guidelines on transparency under Regulation 2016/679, 29 November 2017, WP260 rev.01, 11 April 2018, paragraph 46.
Where appropriate, the CSA and LSA can make use of Article 61 and 62 GDPR with a view of obtaining the necessary information prior to the issuance of the draft decision.
Judgment in Schrems , C-362/14, 6 October 2015, ECLI:EU:C:2015:650, paragraph 63.
The EDPB recalls the possibility for CSAs make use, where appropriate, of the ability to request mutual assistance pursuant to Article 61 GDPR (which also allow CSAs, in case the LSA fails to comply, to adopt a provisional measure in accordance with Article 66) or requests for an opinion pursuant to Article 64(2) GDPR (which is explicitly deemed by the legislator as particularly appropriate where a SA does not comply with its obligations for mutual assistance under Article 61 GDPR). The latter procedure may, eventually, produce a binding decision of the EDPB in accordance with Article 65(1)(c) GDPR. See also Advocate General Bobek, Opinion in Facebook Ireland Limited , C-645/19, ECLI:EU:C:2021:5, paragraphs 115-121. Additionally, the EDPB may also, in its binding decision under Article 65(1)(a) GDPR, invite the CSA to request the LSA to further investigate via an Article 61 Mutual Assistance request.
In this regard, the EDPB recalls Articles 61, 64(2), 65(1)(c) and 66 of the GDPR.
See e.g. Judgment in France v. Commission , C-301/87, 14 February 1980, paragraph 29.
See e.g. Judgment in Cicala , C-482/10, 21 December 2011, ECLI:EU:C:2011:868, paragraph 28.
See e.g. Judgment in Mukarubega , C-166/13, 5 November 2014, ECLI:EU:C:2014:2336, paragraph 45.
Ibid. , paragraph 46. See also Judgments in Glencore Agriculture Hungary Kft. , C-189/18, 16 October 2019, ECLI:EU:C:2019:861, paragraph 39 (' [....] The authorities of the Member States are subject to that obligation when they take decisions which come within the scope of EU law, even though the EU law applicable does not expressly provide for such a procedural requirement ') and in Teodor Ispas , Case C-298/16, 9 November 2017, ECLI:EU:C:2017:843, paragraph 26. See also the Opinion of Advocate General Bobek in Teodor Ispas , Case C-298/16, 7 September 2017, ECLI:EU:C:2017:650, paragraphs 35-69.
Regarding composite administrative procedures, see e.g. the Opinion of Advocate General Compos SánchezBordana in Silvio Berlusconi , Case C-219/17, 27 June 2018, ECLI:EU:C:2018:502, paragraphs 57-79. See also F. Brito Bastos, 'Beyond Executive Federalism. The Judicial Crafting of the Law of Composite Administrative DecisionMaking', Thesis submitted for assessment with a view to obtaining the degree of Doctor of Laws of the European University Institute, Florence, 13 June 2018, in particular at p. 120-163.
P. Craig, 'Article 41 -Right to Good Administration', in EU Charter of Fundamental Rights : A Commentary , edited by Steve Peers, et al., Bloomsbury Publishing, 2014, p. 1079.
However, according to the RoP, in exceptional circumstances, the EDPB can decide to consider further documents (Article 11(2) in fine RoP).
See e.g. Judgments in M.M ., C-277/11, 22 November 2012, EU:C:2012:744, paragraph 87; Mukarubega , paragraph 46; Glencore Agriculture Hungary, paragraph 39 and the case law cited therein.
See e.g. the Judgment in Technische Universität Munchen, C-269/90, 21 November 1991, paragraph 25.
See Article 12 of Regulation 773/2004 (O.J 27 April 2004, L 123, p. 18). See also the Opinion of Advocate General Wahl in SKW Stahl-Metallurgie GmbH and Holding AG v European Commission , C-154/14, 3 September 2015, ECLI:EU:C:2015:543, paragraphs 45-47.
For purposes of the procedure under Article 65(1)(a) GDPR, the scope of which is limited resolving disputes concerning the objections raised, the right to be heard does not need to extend to elements beyond the subject matter of the dispute.
See Article 11(2)(f) RoP, which specifies that the LSA when submitting the matter to the Secretariat should include, inter alia , '' in accordance with Article 41 of the European Charter on Fundamental Rights, the written observations the LSA collected from the persons that might be adversely affected by the Board ́ s decision, together with confirmation and evidence of which documents submitted to the Board were provided to them when they were invited to exercise their right to be heard or a clear identification of the elements for which it is not the case ' .
Article 41(2)b CFEU. The SA acting on behalf of the EDPB cannot make a general reference to confidentiality to justify a total refusal to disclose documents in its file to persons adversely affected, nor can it give blank pages on the ground that they contained business secrets without providing a more comprehensible non-confidential version, or a summary of the documents.
Opinion of Advocate General Bobek in Teodor Ispas , Case C-298/16, 7 September 2017, ECLI:EU:C:2017:650, paragraphs 117 and following.
Opinion of Advocate General Bobek in Teodor Ispas , Case C-298/16, 7 September 2017, ECLI:EU:C:2017:650, paragraphs 117 and following. See in the same vein also Opinion of Advocate General Bobek in Glencore Agriculture Hungary Kft. , C-189/18, 16 October 2019, ECLI:EU:C:2019:861, paragraph 51
Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43). Article 2(1) of Regulation (EC) No 1049/2001 sets out that any citizen of the EU, and any natural or legal person residing or having its registered office in a Member State, has a right of access to documents of the EU institutions, subject to the principles, conditions and limits defined in that Regulation.
See e.g., Judgment in Métropole Télévision SA , T-206/99, 21 March 2011, paragraph 44. See also P. Craig, 'Article 41 -Right to Good Administration', in EU Charter of Fundamental Rights: A Commentary , edited by Steve Peers, et al., Bloomsbury Publishing, 2014, p. 1085.
See e.g. Judgments of the General Court in L'Air liquide , Cases T-185/06, 16 June 2011, EU:T:2011:275, paragraph 64; in Ryanair Ltd , T-123/09, 28 March 2012, EU:T:2012:164, paragraph 178-179; and in FIH Holding A/S , T-386/14, 15 September 2016, EU:T:2016:474, paragraph 94.
Based on F. Brito Bastos, 'Beyond Executive Federalism. The Judicial Crafting of the Law of Composite Administrative DecisionMaking', Thesis submitted for assessment with a view to obtaining the degree of Doctor of Laws of the European University Institute, Florence, 13 June 2018, p. 176 and following.
It should be noted that the EDPB does not take any position on the merit of any substantial issues raised by objections deemed not to meet the requirements stipulated by Article 4(24) GDPR. Where that is the case, the decision of the EDPB is without any prejudice to any assessments the EDPB may be called upon to make in other cases, including with the same parties, taking into account the contents of the relevant draft decision and the objections raised by the CSAs.
See also Commission 'Code of Good administrative behaviour', Point 3, third indent: 'Where Community law so provides, measures notified to an interested party should clearly state that an appeal is possible and describe how to submit it, (the name and office address of the person or department with whom the appeal must be lodged and the deadline for lodging it).Where appropriate, decisions should refer to the possibility of starting judicial proceedings and/ or of lodging a complaint with the European Ombudsman in accordance with Article 230 or 195 of the Treaty establishing the European Community.' European Ombudsman 'Code of Good administrative behaviour', Article 19 -indication of the possibilities of appeal: 'A decision of the Institution which may adversely affect the rights or interests of a private person shall contain an indication of the appeal possibilities available for challenging the decision. It shall in particular indicate the nature of the remedies, the bodies before which they can be exercised, as well as the time limits for exercising them. Decisions shall in particular refer to the possibility of judicial proceedings and complaints to the European Ombudsman under the conditions specified in, respectively, Articles [263] and Articles [228 TFEU].'
See Order of the General Court of 7 December 2022, WhatsApp Ireland Ltd, T -709/21, ECLI:EU:T:2022:783 in particular at paragraphs 33 and following.
Article 278 TFEU (ex Article 242 TEC) : ' Actions brought before the Court of Justice of the European Union shall not have suspensory effect. The Court may, however, if it considers that circumstances so require, order that application of the contested act be suspended. '
See, e.g. Judgment of the General Court in Access Info Europe v Council , T-233/09, ECLI:EU:T:2011:105, paragraph 28 (' Where the addressee has been notified, it is the date of notification which is to be taken into consideration for the purposes of calculating the time allowed [...] for bringing proceedings, not the date on which cognisance was taken, which comes into play only as an alternative in cases where there is no notification ').
See also the Opinion of Advocate General Bobek in Facebook Ireland Limited , C-645/19, ECLI:EU:C:2021:5, footnote 52 and Order of the General Court of 7 December 2022, WhatsApp Ireland Ltd, T -709/21, ECLI:EU:T:2022:783 in particular at paragraphs 33 and following.
Recital (143) GDPR. This includes the exercise of investigative, corrective, and authorisation powers, or the dismissal or rejection of complaints, but not including non-legally binding measures. 137 Recital (143) GDPR.

	Introduction and scope....................................................................................................................6	Introduction and scope....................................................................................................................6	Introduction and scope....................................................................................................................6
2 Legal
2.1
2.2	Right to good administration...................................................................................................7 GDPR........................................................................................................................................8	Right to good administration...................................................................................................7 GDPR........................................................................................................................................8	Right to good administration...................................................................................................7 GDPR........................................................................................................................................8
2.3	EDPB Rules of procedure (RoP) ...............................................................................................8	EDPB Rules of procedure (RoP) ...............................................................................................8	EDPB Rules of procedure (RoP) ...............................................................................................8
3	Main stages of the procedure (overview) .......................................................................................8	Main stages of the procedure (overview) .......................................................................................8	Main stages of the procedure (overview) .......................................................................................8
3.2 Assessment	Conditions for adopting a binding decision.............................................................................8	Conditions for adopting a binding decision.............................................................................8	Conditions for adopting a binding decision.............................................................................8
3.3	Establishment of deadline(s) .................................................................................................12 Calculation .....................................................................................................................12	Establishment of deadline(s) .................................................................................................12 Calculation .....................................................................................................................12	Establishment of deadline(s) .................................................................................................12 Calculation .....................................................................................................................12
3.3.2
3.3.3	Decision to extend by one month .................................................................................13 Extension by two weeks ................................................................................................13 Preparation of the draft EDPB binding decision....................................................................13	Decision to extend by one month .................................................................................13 Extension by two weeks ................................................................................................13 Preparation of the draft EDPB binding decision....................................................................13	Decision to extend by one month .................................................................................13 Extension by two weeks ................................................................................................13 Preparation of the draft EDPB binding decision....................................................................13
	Adoption of the EDPB binding decision.................................................................................14	Adoption of the EDPB binding decision.................................................................................14	Adoption of the EDPB binding decision.................................................................................14
3.5
3.7	Notification to the supervisory authorities concerned .........................................................14	Notification to the supervisory authorities concerned .........................................................14	Notification to the supervisory authorities concerned .........................................................14
	Final Decision of the supervisory authority(ies)....................................................................15	Final Decision of the supervisory authority(ies)....................................................................15	Final Decision of the supervisory authority(ies)....................................................................15
	3.7.1 'On the basis of' ............................................................................................................15	3.7.1 'On the basis of' ............................................................................................................15	3.7.1 'On the basis of' ............................................................................................................15
3.7.2	Decision(s) by LSA and/or CSA.......................................................................................16	Decision(s) by LSA and/or CSA.......................................................................................16	Decision(s) by LSA and/or CSA.......................................................................................16
3.7.3	Information to the EDPB................................................................................................16	Information to the EDPB................................................................................................16	Information to the EDPB................................................................................................16
	of the EDPB binding decision..............................................................................16	of the EDPB binding decision..............................................................................16	of the EDPB binding decision..............................................................................16
3.8	Publication	Publication	Publication
4.1	Competence of the EDPB...............................................................................................................17	Competence of the EDPB...............................................................................................................17	Competence of the EDPB...............................................................................................................17
	Assessment of whether the objections are relevant and reasoned .....................................18	Assessment of whether the objections are relevant and reasoned .....................................18	Assessment of whether the objections are relevant and reasoned .....................................18
4.2	Matters subject of the relevant and reasoned objection .....................................................19	Matters subject of the relevant and reasoned objection .....................................................19	Matters subject of the relevant and reasoned objection .....................................................19
4.2.1	Existence of a given infringement of the GDPR.............................................................19	Existence of a given infringement of the GDPR.............................................................19	Existence of a given infringement of the GDPR.............................................................19
4.2.2	Additional or alternative infringements of the GDPR ...................................................19	Additional or alternative infringements of the GDPR ...................................................19	Additional or alternative infringements of the GDPR ...................................................19
4.2.3	Gaps in the draft decision justifying the need for further investigation by the LSA.....20 Insufficient factual information or reasoning................................................................21 Procedural aspects.........................................................................................................22	Gaps in the draft decision justifying the need for further investigation by the LSA.....20 Insufficient factual information or reasoning................................................................21 Procedural aspects.........................................................................................................22	Gaps in the draft decision justifying the need for further investigation by the LSA.....20 Insufficient factual information or reasoning................................................................21 Procedural aspects.........................................................................................................22
4.2.4
4.2.6	Action envisaged............................................................................................................23 to be heard ....................................................................................................................23 ...........................................................................................................................23	Action envisaged............................................................................................................23 to be heard ....................................................................................................................23 ...........................................................................................................................23	Action envisaged............................................................................................................23 to be heard ....................................................................................................................23 ...........................................................................................................................23
5 The	Right	Right	Right
5.1	Applicability	Applicability	Applicability
5.2
	Purpose..................................................................................................................................25	Purpose..................................................................................................................................25	Purpose..................................................................................................................................25
	Timing ....................................................................................................................................25	Timing ....................................................................................................................................25	Timing ....................................................................................................................................25
5.3	At national level and prior to referral to the EDPB .......................................................25	At national level and prior to referral to the EDPB .......................................................25	At national level and prior to referral to the EDPB .......................................................25
5.3.1

Content

Guidelines 03/2021 on the application of Article 65(1)(a) GDPR

Version history

Executive summary

Table of contents

1 INTRODUCTION AND SCOPE

2 LEGAL FRAMEWORK AND RULES OF PROCEDURE

2.1 Right to good administration

2.2 GDPR

2.3 EDPB Rules of procedure (RoP)

3 MAIN STAGES OF THE PROCEDURE (OVERVIEW)

3.1 Conditions for adopting a binding decision

3.2 Assessment of the completeness of the file

Example 1 :

Example 2:

Relationship with the right to be heard

3.3 Establishment of deadline(s)

3.3.1 Calculation

3.3.2 Decision to extend by one month

3.3.3 Extension by two weeks

3.4 Preparation of the draft EDPB binding decision

3.5 Adoption of the EDPB binding decision

3.6 Notification to the supervisory authorities concerned

3.7 Final Decision of the supervisory authority(ies)

3.7.1 'On the basis of'

3.7.2 Decision(s) by LSA and/or CSA

3.7.3 Information to the EDPB

3.8 Publication of the EDPB binding decision

4 COMPETENCE OF THE EDPB

4.1 Assessment of whether the objections are relevant and reasoned

4.2 Matters subject of the relevant and reasoned objection

4.2.1 Existence of a given infringement of the GDPR

4.2.2 Additional or alternative infringements of the GDPR

Example 3:

4.2.3 Gaps in the draft decision justifying the need for further investigation by the LSA

Example 4:

4.2.4 Insufficient factual information or reasoning

Example 5:

Example 6:

4.2.5 Procedural aspects

4.2.6 Action envisaged

5 THE RIGHT TO BE HEARD

5.1 Applicability

5.2 Purpose

5.3 Timing

5.3.1 At national level and prior to referral to the EDPB

5.3.2 During the assessment of completeness of the file

6 ACCESS TO THE FILE

7 THE DUTY TO GIVE REASONS

8 JUDICIAL REMEDIES

8.1 Supervisory authorities

8.2 Controller, processor, complainant, or other entity

Footnotes