Article 65: Dispute resolution by the Board - GDPR

1. In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:

(a) where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority or the lead authority has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;
(b) where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;
(c) where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In such cases, any supervisory authority concerned or the Commission may communicate the matter to the Board.

2. The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject-matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them.

3. Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall be adopted by the vote of its Chair.

4. The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during the periods referred to in paragraphs 2 and 3.

5. The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6.

6. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this Article. The final decision shall attach the decision referred to in paragraph 1 of this Article.

Understanding This Article

Article 65 gives the European Data Protection Board its most powerful tool: binding decisions that supervisory authorities must follow. While most of the consistency mechanism operates through cooperation and consensus (Article 60) or advisory opinions (Article 64), Article 65 provides enforcement when cooperation breaks down or authorities refuse to follow the consensus process.

Paragraph 1(a) addresses the most common dispute scenario: in cross-border cases, when the lead authority and concerned authorities can't agree despite the Article 60 cooperation procedure. After a concerned authority raises a "relevant and reasoned objection" under Article 60(4), if the lead authority rejects it or the two sides can't reach consensus, the matter escalates to the Board. The Board's binding decision resolves the dispute, covering all matters in the objection including whether GDPR was violated and what sanctions are appropriate.

This mechanism prevents deadlock where authorities disagree on fundamental questions. For example, if the Irish DPC (lead authority for many tech companies) concludes processing is lawful while French, German, and Italian authorities (concerned authorities) argue it violates GDPR, the Board breaks the impasse with a binding decision. This prevents companies from benefiting from potentially lenient lead authorities while preventing concerned authorities from blocking all enforcement.

Paragraph 1(b) addresses competence disputes: if authorities disagree about which one is the lead authority (e.g., which location is the "main establishment"), the Board decides. This prevents companies from manipulating the one-stop-shop by claiming establishments are main establishments when they're not.

Paragraph 1(c) enforces the Article 64 opinion process: if an authority should have requested a Board opinion but didn't, or received an opinion but ignored it, any concerned authority or the Commission can refer the matter to the Board for a binding decision. This prevents authorities from circumventing the consistency mechanism.

The one-month timeline (paragraph 2) ensures binding decisions issue quickly. Two-thirds majority requirement ensures broad support for binding decisions, avoiding narrow partisan splits. Paragraph 3's fallback (simple majority after two months, with Chair breaking ties) prevents indefinite deadlock while encouraging compromise.

Paragraph 6 requires lead authorities to adopt final decisions implementing the Board's binding decision within one month. The lead authority doesn't simply copy the Board decision—it adopts a formal enforcement decision based on it, which is then subject to judicial review in national courts. This preserves judicial oversight while ensuring consistency.

Key Points

Board issues binding decisions to resolve disputes between authorities

Covers objections in cross-border cases, competence disputes, and ignored opinions

Decisions adopted within one month (extendable to two months)

Requires two-thirds majority, or simple majority after two months

Chair's vote breaks ties if Board is evenly split

Decisions binding on all supervisory authorities involved

Ensures consistency can be enforced, not just recommended

Understanding This Article

Key Points

Related Recitals

Related Articles in Chapter 7

Popular Articles