Article 64: Opinion of the Board - GDPR

1. The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

(a) aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);
(b) concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;
(c) aims to approve the criteria for accreditation of a body pursuant to Article 41(3) or a certification body pursuant to Article 43(3);
(d) aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);
(e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or
(f) aims to approve binding corporate rules within the meaning of Article 47.

2. Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.

3. In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision.

4. Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned.

5. The Chair of the Board shall, without undue delay, inform by electronic means: (a) the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and (b) the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.

6. The competent supervisory authority shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3.

7. The supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.

8. Where the supervisory authority concerned informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, the decision shall be subject to the procedure referred to in Article 65(1).

Understanding This Article

Article 64 operationalizes the consistency mechanism for proactive measures—regulatory tools that will be used across multiple Member States and therefore require consistent standards. Unlike Article 60 which handles case-specific cross-border enforcement, Article 64 addresses regulatory infrastructure: standard contractual clauses, binding corporate rules, certification criteria, codes of conduct, and DPIA lists.

The six categories in paragraph 1 all involve regulatory tools with EU-wide reach. For example, if the German authority approves Standard Contractual Clauses, organizations throughout the EU might use them for international transfers. If those clauses were inadequate or inconsistent with other authorities' clauses, it would create legal uncertainty and compliance complexity. The EDPB opinion process ensures these tools meet consistent, rigorous standards.

Similarly, if the French authority approves a code of conduct that companies use to demonstrate compliance across Europe, the EDPB ensures the code actually provides sufficient safeguards and isn't just a "greenwashing" document. If the Irish authority approves certification criteria, the EDPB ensures those criteria are robust enough that other authorities will respect certifications issued under them.

The eight-week timeline (extendable by six weeks for complex matters) balances thorough review with avoiding excessive delays. Paragraph 6 prohibits adopting the decision during the review period—authorities must wait for the Board's input. This ensures the opinion is meaningful, not just an afterthought authorities ignore.

Paragraph 7 requires authorities to "take utmost account" of the Board's opinion—a strong obligation, though not absolute. Authorities must carefully consider the opinion and provide substantial reasons for any deviations. If an authority plans to ignore the opinion, paragraph 8 triggers Article 65's binding decision procedure, giving the Board final say in disputes.

Paragraph 2's catch-all provision allows the Board, any authority, or the Commission to request opinions on matters of general application or multi-state effects, even beyond the six listed categories. This ensures emerging issues (like novel AI applications or new technologies) can be addressed through the consistency mechanism even if not explicitly listed.

Key Points

Board must issue opinions on measures with EU-wide implications

Covers DPIA lists, codes of conduct, certification criteria, SCCs, and BCRs

Board opinions issued within 8 weeks (extendable by 6 weeks)

Authority must wait for opinion before adopting decision

Authority must take utmost account of Board opinion

Refusal to follow opinion triggers dispute resolution (Article 65)

Ensures consistency for regulatory tools used across multiple Member States

Understanding This Article

Key Points

Related Recitals

Related Articles in Chapter 7

Popular Articles