Article 66
Urgency procedure
Chapter 7
|
Cooperation and Consistency
|
📖 3 min read
1. In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.
2. Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision.
3. Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act.
4. By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board.
Understanding This Article
Article 66 provides an emergency brake for situations where waiting for normal cooperation and consistency procedures (Articles 60, 63-65) would cause irreparable harm to data subjects. While GDPR emphasizes cooperation and consistency, some situations—ongoing massive data breaches, illegal surveillance, or processing causing imminent harm—require immediate action that can't wait weeks or months for consensus.
Paragraph 1 allows any concerned supervisory authority to adopt provisional measures immediately on its own territory, bypassing the lead authority (Article 56), cooperation procedures (Article 60), and consistency mechanism (Articles 63-65). These measures have legal effect immediately but are time-limited (maximum three months) and territorial (only in the acting authority's Member State). The authority must immediately notify all relevant parties, ensuring transparency despite the expedited process.
"Exceptional circumstances" requiring "urgent need to act" set a high threshold. Routine violations don't qualify—the urgency procedure is for situations where delay would cause serious, irreversible harm. Examples might include ongoing unlawful surveillance of activists, real-time processing of children's data for harmful purposes, massive data breaches where immediate processing suspension is needed, or AI systems causing demonstrable harm requiring immediate shutdown.
Paragraph 2 allows the authority that took provisional measures to request expedited Board opinions or binding decisions if permanent measures are needed. This fast-tracks the consistency mechanism—instead of 8 weeks (Article 64) or 1 month (Article 65), the Board must decide within 2 weeks (paragraph 4).
Paragraph 3 addresses situations where the competent authority fails to act despite urgent need. Another authority can request urgent Board opinions or decisions essentially compelling action. This prevents situations where one authority's inaction allows ongoing harm to data subjects in other Member States.
The urgency procedure reflects tension between cooperation principles and protection imperatives. Generally, GDPR favors consensus through the one-stop-shop and cooperation mechanisms. But when consensus processes would allow ongoing harm, Article 66 permits unilateral action, trusting supervisory authorities to use this power responsibly and only in genuine emergencies.