Article 62: Joint operations of supervisory authorities - GDPR

1. The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.

2. Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. The supervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate.

3. A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority's authorisation, confer powers, including investigative powers on the seconding supervisory authority's members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority's members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. The seconding supervisory authority's members or staff shall be subject to the Member State law of the host supervisory authority.

4. Where, in accordance with paragraph 3, staff of a seconding supervisory authority operate in another Member State, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating.

5. The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. The Member State of the host supervisory authority whose staff has caused damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf.

6. Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4.

7. Where a joint operation is intended and a supervisory authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55. In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66.

Understanding This Article

Article 62 enables joint operations—coordinated investigations and enforcement actions where staff from multiple supervisory authorities work together across borders. This is crucial for investigating complex cross-border processing that no single authority could effectively examine alone.

Joint operations are particularly valuable for large multinational organizations with processing operations spanning multiple Member States. Rather than each authority conducting separate investigations (duplicating effort, potentially reaching inconsistent conclusions), authorities can pool resources and expertise. Joint operations might involve coordinated on-site inspections at a company's establishments in several countries, simultaneous document requests across jurisdictions, or collaborative analysis of complex technical processing operations.

Paragraph 2 establishes participation rights: authorities in Member States with establishments or where data subjects are substantially affected can participate. The lead authority (or competent authority under Article 56(4)) must invite relevant authorities and respond promptly to participation requests. This ensures affected Member States aren't excluded from investigations concerning their data subjects.

Paragraph 3 addresses the practical challenge of cross-border enforcement powers. Generally, a supervisory authority's powers only apply in its own Member State. For effective joint operations, paragraph 3 allows host authorities to confer investigative powers on seconded staff, or (if host Member State law permits) allow seconded staff to exercise powers under their home law. However, seconded staff must operate under host authority guidance and follow host Member State law, ensuring respect for local legal procedures and protections.

Paragraphs 4-6 establish clear liability rules, critical for encouraging joint operations without fear of complex inter-state liability disputes. The host Member State assumes responsibility for seconded staff's actions and compensates any damage they cause. If that damage occurs in another Member State, the countries settle accounts between themselves, not involving affected third parties in inter-governmental reimbursement disputes. This streamlined approach removes liability barriers to cooperation.

Paragraph 7's escalation mechanism parallels Article 61(8): if an authority doesn't respond to joint operation invitations within one month, others can take provisional measures and invoke the Board's urgency procedures, potentially resulting in binding decisions requiring participation.

Key Points

Supervisory authorities can conduct joint investigations and enforcement actions

Relevant authorities have right to participate in joint operations

Staff from one authority can be seconded to operate in another Member State

Seconded staff exercise powers under host authority's guidance and law

Host Member State assumes responsibility and liability for seconded staff's actions

Facilitates coordinated enforcement for cross-border processing operations

Understanding This Article

Key Points

Related Recitals

Related Articles in Chapter 7

Popular Articles