GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

Suitable Recitals

(123) Cooperation of the supervisory authorities with each other and with the Commission;(132) Awareness-raising activities and specific measures;(133) Mutual assistance and provisional measures.

COMMENTARY:

Under the Directive, the Member States were already required to help each other to fulfill their tasks and ensure full compliance with the data protection rules. So, Article 28 (6) of the Directive provides for the supervisory authorities to mutually cooperate to the extent necessary for the performance of their duties, in particular by exchanging all useful information. It may request assistance by other concerned supervisory authorities under Article 61 GDPR, and especially for purposes of carrying out investigations or monitoring the implementation of measures taken, may conduct joint operations in accordance with Article 62 GDPR.

The mutual assistance procedure of Article 61 GDPR is supposed to contribute to consistent implementation and application of the GDPR. It especially concerns information requests and supervisory measures, for instance requests to carry out prior authorizations and consultations, inspections and investigations. Under Article 61(3) GDPR the use of information exchanged is expressly limited to the purpose for which it was requested. The requested supervisory authority has to submit the

information without undue delay, but no later than a month after the request according to Article 61(2) GDPR.

The requested supervisory authority may refuse requests only under Article 61(4) GDPR when it is not competent Ratione Materiae (subject matter jurisdiction) or the measures requested violate provisions of the GDPR, Union or national law which binds the requested supervisory authority. Any refusal to submit information has to be substantiated with reasons according to Article 61(5) GDPR. If the requested supervisory authority fails to act within the prescribed period, Article 60(8) GDPR authorizes the requesting supervisory authority to take provisional measures in its Member State.

Art. 62 GDPR Joint operations of supervisory authorities

The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.

Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. The supervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate.

A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority’s authorisation, confer powers, including investigative powers on the seconding supervisory authority’s members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority’s members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. The seconding supervisory authority’s members or staff shall be subject to the Member State law of the host supervisory authority.

Where, in accordance with paragraph 1, staff of a seconding supervisory authority operate in another Member State, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating.

The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. The Member State of the seconding supervisory authority whose staff has caused

damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf.

Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4.

Where a joint operation is intended and a supervisory authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55. In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66(2).

Suitable Recitals

(126) Joint decisions; (134) Participation in joint operations.

COMMENTARY:

Pursuant to Article 28 (6) of the Directive, each authority may be requested to exercise its powers by an authority of another Member State. However, the implementation of joint operations by several control authorities was not covered by the Directive.

Joint operations.

The joint operations mechanism under Article 62 GDPR extends to investigations and enforcement measures and gives the supervisory authority of any Member State concerned a right to participate in such operations. Supervisory authorities are either invited by the competent supervisory authority or can request to participate according to Article 62(2) GDPR. If such a request is not granted within one month Article 62(7) GDPR provides that the other supervisory authorities may take provisional measures. In that case, as under Article 60(8) GDPR for the mutual assistance procedure, the urgency mechanism of Article 66 GDPR is then triggered. In a joint operation a supervisory authority may, in accordance with national law, grant investigative powers on a seconding supervisory authority or, if allowed by national law, authorize the seconding supervisory authority to exercise its powers as provided by Article 62(3) GDPR. Both modi are subject to the guidance and presence of members or staff of the host supervisory authority and subjects the supervisory authorities own members or staff to the national law of the host Member State. In turn, the host supervisory authority assumes responsibility for the actions of the supervisory authority acting in its Member State under Article 62(4) GDPR.

Section 2: Consistency

Art. 63 GDPR Consistency mechanism

In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.

Suitable Recitals

Consistency mechanism.

COMMENTARY:

Consistency Mechanism. The Board is at the heart of the consistency mechanism set out in Articles 63 et seq. GDPR. In order to ensure consistent interpretation and application of the GDPR, the Board may issue non-binding opinions under Article 64 GDPR and binding decisions in accordance with Article 65 GDPR.

Art. 64 GDPR Opinion of the Board

The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

Aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);

Concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

Aims to approve the requirements for accreditation of a body pursuant to Article 41(3), of a certification body pursuant to Article 43(3) or the criteria for certification referred to in Article 42(5);

Aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);

Aims to authorise contractual clauses referred to in point (a) of Article 46(3); or

Aims to approve binding corporate rules within the meaning of Article 47.

Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.

In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple

majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision.

Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned.

The Chair of the Board shall, without undue, delay inform by electronic means:

The members of the Board and the Commission of any relevant information, which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and

the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.

The competent supervisory authority referred to in paragraph 1 shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3.

The competent supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.

Where the competent supervisory authority referred to in paragraph 1 informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply.

Suitable Recitals

Binding decisions and opinions of the Board.

COMMENTARY:

While Article 64(1) GDPR provides a list of activities of the supervisory authorities where the Board gives an opinion – such as the list defining when a Data Protection Impact Assessments has to be carried out under Article 35(4) GDPR, standard protection clauses under Articles 46(2)(d) and 28(8) GDPR among others – it may also be approached by supervisory authorities, the chair of the Board or the Commission to examine any matter of general application or affecting more than one Member State under its second paragraph. This particularly concerns cases where a supervisory authority does not comply with its obligation to provide mutual

assistance under Article 61 GDPR or engage in joint operations as prescribed in Article 62 GDPR and detailed above. The opinions of the Board have to be issued within eight weeks, which may be extended by another six weeks depending on the complexity of the issues according to Article 64(3)

Art. 65 GDPR Dispute resolution by the Board

In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:

Where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;

Where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;

Where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.

The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them.

Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the vote of its Chair.

The supervisory authorities concerned shall not