This chapter establishes mechanisms for cooperation between supervisory authorities and ensures consistent application of the GDPR across the EU. It introduces the European Data Protection Board (EDPB), the one-stop-shop mechanism, mutual assistance procedures, joint operations, and the consistency mechanism. This chapter is crucial for managing cross-border data processing and ensuring uniform GDPR enforcement throughout the European Union.
Overview
Chapter VII: Cooperation and Consistency
Chapter VII establishes the framework for cooperation between supervisory authorities across the EU and introduces mechanisms to ensure consistent application of the GDPR. This is essential for addressing the challenges of cross-border data processing in the digital single market.
Section 1: Cooperation (Articles 60-62):
One-Stop-Shop Mechanism (Article 60):
For cross-border processing, the lead supervisory authority (where the controller or processor has its main establishment) acts as the single interlocutor for the controller or processor. The lead authority cooperates with other concerned supervisory authorities and strives to reach consensus. If consensus cannot be reached, the consistency mechanism applies. This mechanism simplifies compliance for organizations operating across multiple EU countries.
Mutual Assistance (Article 61):
Supervisory authorities must provide each other with relevant information and mutual assistance to implement and apply the GDPR consistently. Assistance includes information requests, supervisory measures, and joint operations. Requested authorities must respond without undue delay and within one month.
Joint Operations (Article 62):
Supervisory authorities may conduct joint operations including joint investigations and enforcement measures. Staff from other authorities may exercise their powers under the direction of the host authority's staff.
Section 2: Consistency (Articles 63-67):
Consistency Mechanism (Article 63):
To ensure consistent application of the GDPR, supervisory authorities must cooperate with each other and the Commission through the consistency mechanism in specific cases, such as when dealing with cross-border processing disputes, draft decisions on matters affecting multiple Member States, or when seeking opinions from the European Data Protection Board.
Opinion of the EDPB (Article 64):
The EDPB shall issue an opinion where a supervisory authority intends to adopt measures concerning:
- Adequacy of third country protection levels
- Approval of standard contractual clauses
- Authorization of contractual clauses for transfers
- Approval of codes of conduct
- Accreditation criteria for certification bodies
- Data protection seals and marks
- Draft list of processing operations requiring DPIA
- Matters on which national authorities disagree
Dispute Resolution (Article 65):
The EDPB shall issue binding decisions to resolve disputes between supervisory authorities, particularly in cross-border cases where authorities disagree on which authority is competent or which course of action to take.
Urgency Procedure (Article 66):
In exceptional circumstances where urgent action is needed to protect data subjects' rights and freedoms, a supervisory authority may adopt provisional measures with specified geographical scope and maximum duration of three months.
Section 3: European Data Protection Board (Articles 68-76):
Establishment and Independence (Articles 68-69):
The European Data Protection Board (EDPB) is established as a body of the European Union with legal personality. It is composed of the head of one supervisory authority from each Member State and the European Data Protection Supervisor. The EDPB acts independently when performing its tasks or exercising its powers.
Tasks of the EDPB (Article 70):
- Monitor and ensure consistent application of the GDPR
- Advise the Commission on data protection matters
- Issue guidelines, recommendations, and best practices on GDPR interpretation
- Review practical application of guidelines and recommendations
- Issue opinions on supervisory authorities' draft decisions
- Resolve disputes between supervisory authorities
- Promote cooperation and effective bilateral and multilateral exchange of information
- Promote common training programs and personnel exchanges
- Promote knowledge exchange and cooperation on legislation with third countries and international organizations
- Issue opinions on codes of conduct and certification criteria
- Maintain a public register of decisions by supervisory authorities
- Adopt binding decisions in dispute resolution
Powers and Procedures (Articles 71-76):
The EDPB may provide advice to the Commission and national parliaments, request information from supervisory authorities, issue binding decisions in disputes, and adopt opinions, guidelines, recommendations, and best practices. It operates through plenary sessions and adopts decisions by simple majority of its members. The EDPB adopts its own rules of procedure and is supported by a secretariat provided by the European Data Protection Supervisor.
Significance:
This chapter creates a sophisticated system of cooperation that balances national supervisory authority competence with the need for EU-wide consistency. The one-stop-shop mechanism reduces complexity for businesses, while the EDPB ensures uniform GDPR interpretation and application. The consistency mechanism and dispute resolution procedures prevent fragmentation of data protection standards across the EU, essential for the functioning of the digital single market.