Article 60 GDPR: Difference between revisions

From GDPRhub
Line 212: Line 212:


== Relevant Recitals==
== Relevant Recitals==
''You can help us fill this section!''
124
 
125
 
130


== Commentary ==
== Commentary ==
The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this article in an endeavour to reach consensus. The wording of the provision indicates that a lead supervisory authority has already been identified under Article 56 and that all the requirements set forth therein are met.


=== The Lead Supervisory Authority cooperates with the other Authorities Concerned ===
=== (1) The lead supervisory authority shall cooperate with the other supervisory authorities concerned ===
The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this article in an endeavour to reach consensus. The wording of the provision indicates that a lead supervisory authority has already been identified under Article 56 and that all the requirements set forth therein are met.  
Article 60(1) requires the lead authority (“LSA”) to cooperate with the other authorities concerned. As soon as the LSA learns of its responsibility under Article 56(1), it must take the initiative and identify the other supervisory authorities concerned (“CSA”).
 
Under Article 60, the “lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other”. However, information exchange shall not constitute the only type of cooperation. Instead, all types of cooperation that are “''in accordance with this article''” are not only permitted but encouraged.  


==== Cooperation ====
Finally, the ''duty to cooperate'' is not one-sided but naturally applies also the other authorities concerned.<ref>''Dix'' in Kühling, Buchner, GDPR BDSG, Article 60 GDPR, Margin number 6 (Beck 3rd edition 2020)</ref>
Article 60(1) obliges the lead authority to cooperate with the other authorities concerned. As soon as it learns of its responsibility under Article 56(1), the lead authority must take the initiative and, as far as it can, investigate which other supervisory authorities in the Member States could be concerned. Article 60 provides for means and specific guidelines on how the cooperation should take place. However, this catalog is not exhaustive; rather, all types of cooperation that are “''in accordance with this article''” are not only permitted but encouraged. Finally, the ''duty to cooperate'' is not one-sided, but naturally applies also the other authorities concerned. <ref>''Dix'' in Kühling, Buchner, GDPR BDSG, Article 60 GDPR, Margin number 6 (Beck 3rd edition 2020)</ref>


==== Consensus ====
==== Consensus ====
The lead authority is obliged to seek ''consensus'' with the other authorities concerned. The black-letter of the law seems to put this obligation specifically on the LSA and not on the other authorities concerned. <ref>''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (1st edition 2019)</ref> Above all, this requires that the supervisory authorities concerned are given sufficient opportunity to present their own legal positions in the procedure pursuant to Article 60(3) GDPR and that their positions are incorporated into the final assessment by the lead supervisory authority.<ref>''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (1st edition 2019)</ref> The above seems to be confirmed by Recital 125 which specifies that "''the supervisory authority should closely involve and coordinate the supervisory authorities concerned in the decision-making process''".
The lead authority is obliged to reach a ''consensus'' with the other authorities concerned.<ref>The letter of the law seems to put this obligation specifically on the LSA rather than single CSAs. See ''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (1st edition 2019)</ref> Supervisory authorities concerned shall therefore be given adequate information and sufficient opportunity to present their legal positions (Article 60(3) GDPR), which, as long as possible, shall be incorporated into the LSA’s final assessment. <ref>''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (1st edition 2019)</ref>The above seems confirmed by Recital 125, which specifies that “''the supervisory authority should closely involve and coordinate the supervisory authorities concerned in the decision-making process''”.
 
==== Information exchange ====
The GDPR seems to put a particular focus on the information exchange obligation. Effective Union-wide enforcement requires that all supervisory authorities concerned, including the LSA, receive and share all relevant information on cross-border data processing as promptly as possible. The above stays true even when the identity of the lead supervisory authority is still unclear: the required exchange of information must take place in any case (see Article 61 and Article 62).


===== Information exchange =====
=== (2) The lead supervisory authority may request cooperation ===
The obligation to cooperate is particularly specified in an ''obligation to provide information to one another''. Effective Union-wide enforcement of the Regulation requires that all supervisory authorities concerned, including the LSA, receive and share all relevant information on cross-border data processing as promptly as possible. The above stays true even when the identity of the lead supervisory authority is still unclear: the required exchange of information must take place in any case.  
According to Paragraph 2, the lead supervisory authority may request other supervisory authorities to provide mutual assistance pursuant to Article 61 and conduct joint operations pursuant to Article 62. In fact, before issuing a binding decision, it may (and usually will) be necessary for the lead and the other supervisory authorities concerned to first exercise investigative powers in their territory towards the main branch and the other branches of the controller or processor. Cooperation is also crucial in later procedural steps for “monitoring the implementation of a measure concerning a controller or processor established in another Member State”.<ref>''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 8 (1st edition 2019)</ref>


=== Administrative assistance ===
=== (3) Draft decision and relevant reasoned objection ===
According to Paragraph 2, the lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62. This is especially important in later procedural steps. Before issuing a binding decision, it may be necessary for the lead and the other supervisory authorities concerned to first exercise investigative powers in their own territory towards the main branch and the other branches of the controller or processor.<ref>''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 8 (1st edition 2019)</ref>
Paragraph 3 sets out the practical background of the cooperation mechanism. The lead supervisory authority communicates the relevant information on the matter to the other supervisory authorities concerned and, without delay, provide them with a draft decision for their opinion, which shall be taken into “due account”. In other words, under Article 60(1), the LSA must adequately address the positions of the other supervisory authorities and integrate them into the decision-making process.<ref>Paragraphs 3 to 10 contain a completely new, relatively complex two-phases decision-making procedure. The first (or preparatory) phase regulates how information, draft decisions and objections are exchanged among authorities (Paragraphs 3 to 6). The second phase, which consists of the actual decision-making stage (including enforcement), is regulated by following Paragraphs 6 to 10. ''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 9 (1st edition 2019)</ref>


=== Procedure ===
==== CSA’s objection ====
Paragraphs 3 to 10 contain a completely new, relatively complex decision-making procedure. This can be divided into two phases: a preparatory phase in which information, drafts and objections are exchanged (Paragraphs 3 to 6) and the actual decision-making stage (Paragraphs 6 to 9). Finally, Paragraph 10 regulates the implementation by those responsible and contract processors.<ref>''Polenz'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 9 (1st edition 2019)</ref>
Under Article 4(24) GDPR, any CSA can submit an “''objection to a draft decision''” which must be “'''''relevant and reasoned'''''” and focus on “''as to whether there is an '''infringement of this Regulation''', or whether '''envisaged action''' in relation to the controller or processor complies with this Regulation, which clearly demonstrates the '''significance of the risks''' posed by the draft decision as regards the '''fundamental rights and freedoms''' of data subjects and, where applicable, the '''free flow of personal data''' within the Union''”.<ref>The EDPB provided guidance for the notion of the terms “''relevant and reasoned''”, including what should be considered when assessing whether an objection “''clearly demonstrates the significance of the risks posed by the draft decision''” (Article 4(24) GDPR). See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020) ([https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-092020-relevant-and-reasoned_en available here])</ref>


The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views. In other words, in accordance with Article 60(1), the LSA must adequately address the positions of the other supervisory authorities and integrate them into the decision-making process which eventually results in a draft decision on the case.
An objection submitted by a CSA should indicate each part of the draft decision that is considered deficient, erroneous or lacking some necessary elements, either by referring to specific articles/paragraphs or by other clear indication and showing why such issues are to be deemed “relevant” as further explained below. Therefore, the objection aims, first of all, at pointing out how and why according to the CSA the draft decision does not appropriately address the situation of infringement of the GDPR and/or does not envision appropriate action towards the controller or processor. The proposals for amendments put forward by the objection should aim to remedy these errors.


According to Article 60(3) and (4) GDPR, the LSA is required to submit a draft decision to the CSAs,which then may raise a relevant and reasoned objection within a specific time frame (four weeks). Upon receipt of a relevant and reasoned objection, the LSA has two options open to it. If it does not follow the relevant and reasoned objection or is of the opinion that the objection is not reasoned or relevant, it shall submit the matter to the Board within the consistency mechanism. If the LSA, on the contrary, follows the objection and issues the revised draft decision, the CSAs may express a relevant and reasoned objection on the revised draft decision within a period of two weeks.
===== Relevant =====
For the objection to be considered as “relevant”, there must be a direct connection between the objection and the draft decision at issue. More specifically, the objection needs to concern either whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR. An objection should only be considered relevant if it relates to the specific legal and factual content of the draft decision. Raising only abstract or broad comments or objections cannot be considered relevant in this context.<ref>See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020)</ref>


When the LSA does not follow an objection or rejects it as not relevant or reasoned and therefore submits the matter to the Board according to Article 65(1)(a)GDPR, it then becomes incumbent upon the Board to adopt a binding decision on whether the objection is “''relevant and reasoned''” and if so, on all the matters which are the subject of the objection.  
===== Reasoned =====
In order for the objection to be “reasoned”, it needs to include clarifications and arguments as to why an amendment of the decision is proposed(i.e. the alleged legal / factual mistakes of the draft decision). It also needs to demonstrate how the change would lead to a different conclusion as to whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR.


==== CSAs' Objection ====
The CSA should provide sound reasoning for its objection, particularly by reference to legal arguments (relying on EU law and/or relevant national law and including, e.g. legal provisions, guidelines, case law) or factual arguments, where applicable. The CSA should present the fact(s) allegedly leading to a different conclusion regarding the infringement of the GDPR by the controller/processor or the aspect of the decision that, in their view, is deficient/erroneous.
Under Article 4(24) GDPR, any CSA can submit an "''objection to a draft decision''" which must be “'''''relevant and reasoned'''''” and focus on "''as to whether there is an '''infringement of this Regulation''', or whether '''envisaged action''' in relation to the controller or processor complies with this Regulation, which clearly demonstrates the '''significance of the risks''' posed by the draft decision as regards the '''fundamental rights and freedoms''' of data subjects and, where applicable, the '''free flow of personal data''' within the Union''”.<ref>The EDPB provided guidance with respect to the notion of the terms “''relevant and reasoned''”, including what should be considered when assessing whether an objection “''clearly demonstrates the significance of the risks posed by the draft decision''” (Article 4(24) GDPR). See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020) ([https://edpb.europa.eu/sites/default/files/consultation/edpb_guidelines_202009_relevant_and_reasoned_obj_en.pdf available here])</ref>


===== Relevant and reasoned =====
In order for an objection to be adequately reasoned, it should be coherent, clear, precise and detailed in explaining the reasons for objection. It should set forth, clearly and precisely, the essential facts on which the CSA based its assessment and the link between the envisaged consequences of the draft decision (if it was to be issued ‘as is’)and the significance of the anticipated risks. Moreover, the CSA should indicate which parts of the draft decision they disagree with. In cases where the objection is based on the opinion that the LSA failed to investigate an essential fact of the case entirely, or an additional violation of the GDPR, it would be sufficient for the CSA to present such arguments in a conclusive and substantiated manner. <ref>See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020)</ref>
An objection submitted by a CSA should indicate each part of the draft decision that is considered deficient, erroneous or lacking some necessary elements, either by referring to specific articles/paragraphs or by other clear indication, and showing why such issues are to be deemed “relevant” as further explained below. Therefore, the objection aims, first of all, at pointing out how and why according to the CSA the draft decision does not appropriately address the situation of infringement of the GDPR and/or does not envision appropriate action towards the controller or processor. The proposals for amendments put forward by the objection should aim to remedy these errors.
 
===== Infringement of the GDPR =====
The CSA’s objections to the draft decision must be justified and motivated through reference to evidence and facts that support the objection, by having regard to the facts and evidence (the ‘relevant information’ referred to in Article 60.3) provided by the LSA. These requirements should apply to each specific infringement and to each specific provision in question (e.g.if the draft decision says that the controller infringed Articles 6, 7, and 14 GDPR, and the CSA disagrees on whether there is an infringement of Article7 and 14 and considers that there is an infringement of Article 13 GDPR).


====== Relevant ======
In some circumstances, the objection could go as far as identifying gaps in the draft decision justifying the need for further investigation by the LSA. For instance, if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised by the complainant or resulting from an infringement reported by a CSA, a relevant and reasoned objection may be raised based on the failure of the LSA to handle the complaint properly and in safeguarding the rights of the data subject.<ref>See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020)</ref>
In order for the objection to be considered as “relevant”, there must be adirect connection betweenthe objection and the draft decision at issue6.More specifically,the objection needs toconcerneitherwhetherthere  is  aninfringement  of the GDPRorwhethertheenvisaged  action  in  relation  to  thecontroller or processor complies with theGDPR. An objection should only be consideredrelevant if it relates to the specific legal and factual content ofthe  draft  decision.Raising  only  abstract  orbroad  comments  or  objections  cannot  be  consideredrelevant in this context.


====== Reasoned ======
===== Other requirements =====
In order for the objection to be “reasoned”7,it needs to include clarificationsandargumentsas towhyan  amendment  of  the  decision  is  proposed(i.e.  theallegedlegal  /  factualmistakes  of  the  draftdecision).  It  also  needs to demonstratehowthe change  would lead  to  a  different  conclusionas  to whether  there  is  an  infringement  of  the GDPR  orwhetherthe  envisaged  action  in relation  to  thecontroller or processorcomplieswith the GDPR.  
For the other requirements foreseen in Article 4(24) GDPR please see the relevant provision in the Commentary.


TheCSA  should  provide  sound  reasoning  for  its  objection,in  particular,  by  reference  tolegalarguments(relying  on  EU  law  and/or relevant national  lawand  including  e.g.  legal  provisions,guidelines,  case  law)orfactual  arguments,where  applicable.  The  CSA  should  present  the fact(s)allegedly  leading  to  a   different  conclusionregardingthe  infringement  of  the  GDPR   by  thecontroller/processor, or the aspect of the decisionthat, in their view, is deficient/erroneous.
=== (4) Objection is rejected ===
Following the submission of the draft decision, the concerned supervisory authorities (CSAs) may raise a relevant and reasoned objection within four weeks. If the LSA does not follow the relevant and reasoned objection or believes that the objection is not reasoned or relevant, the matter is referred to the attention of the EDPB which will decide it following Article 63 and Article 65(1)(a) GDPR. It then becomes incumbent upon the Board to adopt a binding decision on whether the objection is “''relevant and reasoned''” and, in general, if it meets the requirements outlined in Article 4(24) GDPR.


In order for an objection to be adequately reasoned, it should becoherent,clear, precise and detailedin explaining the reasons for objection.It should set forth,clearly andprecisely, theessential factsonwhich the CSA based its assessment,and thelink between the envisaged consequences of the draftdecision(if it was to be issued ‘as is’)and the significance of the anticipated risks.Moreover,theCSAshouldclearly  indicate  which  parts  of  thedraft  decisionthey  disagreewith.In  cases  where  theobjection is based on the opinion that the LSA failed to fully investigate an important fact of the case,or an additional violation of the GDPR, it would be sufficient for the CSA to present such arguments ina conclusive and substantiatedmanner
=== (5) Objection is accepted ===
Where the lead supervisory authority intends to follow one or more relevant and reasoned objections made by one or more CSAs, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion as foreseen in Paragraph 4. However, in this case, the CSAs only have two weeks to express their opinion.


===== Infringement of the GDPR =====
=== (6) Agreement on the draft decision ===
theCSA’sobjections tothe draft decisionmust be justified and motivatedthrough reference to evidence andfactsthat support the objection,by having regard to thefacts andevidence(the   ‘relevant  information’  referred to   in   Article  60.3)  provided  by  the LSA.  Theserequirements should apply to each specific infringement and to each specific provision in question (e.g.if the draft decision says that the controller infringedArticles6, 7, and 14 GDPR, and the CSA disagreesonwhether there is an infringement ofArticle7 and 14 and considers that there is an infringement ofArticle13 GDPR).
Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to agree with that draft decision and shall be bound by it. In this case, the decision becomes final.


In some circumstances, the objection could go as far as identifying gaps in the draft decision justifyingthe need for further investigation by the LSA.For instance, if the investigation carried out by the LSAunjustifiably  fails  tocover  some  of the issues  raised  by  the  complainantor  resulting  from  aninfringement reported by a CSA, a relevant and reasoned objection may be raised based on the failureof the LSA to properly handle the complaint and in safeguarding the rights of the data subject.
=== (7) Notification of the final decision ===
The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.  


===== Compliance of the envisaged action =====
=== (8) Dismissal ===
By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof. This provision facilitates the data subject who might intend to file an appeal before a national court.


===== Significance of the risks =====
=== (9) Partial dismissal ===
Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter.


====== Fundamental rights and freedom ======
On the one hand, the LSA adopts the decision for the part concerning actions about the controller, notifies it to the main establishment or single establishment of the controller or processor on the territory of its Member State and informs the complainant.


====== Free flow of personal data ======
On the other hand, the supervisory authority of the complainant adopts the decision for the part concerning dismissal or rejection, notifies it to the complainant and informs the controller or processor.


=== Final decision ===
=== (10) Enforcement ===
The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.
After being notified of the decision of the LSA according to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance for all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.


==== Dismissal ====
=== (11) Urgency procedure ===
By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.
Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.


==== Partial dismissal ====
==== Exceptional circumstances ====
Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof.
''You can help us fill this section!''


=== Enforcement ===
==== Urgent need ====
After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.
''You can help us fill this section!''


=== Urgency procedure ===
=== (12) Forms of communication: electronic means and standardised format ===
The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.
The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.


Revision as of 13:29, 21 July 2021

← Article 60 - Cooperation between the lead supervisory authority and the other supervisory authorities concerned →
Gdpricon.png
Chapter 1: General provisions

Article 1: Subject-matter and objectives
Article 2: Material scope
Article 3: Territorial scope
Article 4: Definitions

Chapter 2: Principles

Article 5: Principles relating to processing of personal data
Article 6: Lawfulness of processing
Article 7: Conditions for consent
Article 8: Conditions applicable to child’s consent in relation to information society services
Article 9: Processing of special categories of personal data
Article 10: Processing of personal data relating to criminal convictions and offences
Article 11: Processing which does not require identification

Chapter 3: Rights of the data subject

Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject
Article 13: Information to be provided where personal data are collected from the data subject
Article 14: Information to be provided where personal data have not been obtained from the data subject
Article 15: Right of access by the data subject
Article 16: Right to rectification
Article 17: Right to erasure (‘right to be forgotten’)
Article 18: Right to restriction of processing
Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing
Article 20: Right to data portability
Article 21: Right to object
Article 22: Automated individual decision-making, including profiling
Article 23: Restrictions

Chapter 4: Controller and processor

Article 24: Responsibility of the controller
Article 25: Data protection by design and by default
Article 26: Joint controllers
Article 27: Representatives of controllers or processors not established in the Union
Article 28: Processor
Article 29: Processing under the authority of the controller or processor
Article 30: Records of processing activities
Article 31: Cooperation with the supervisory authority
Article 32: Security of processing
Article 33: Notification of a personal data breach to the supervisory authority
Article 34: Communication of a personal data breach to the data subject
Article 35: Data protection impact assessment
Article 36: Prior consultation
Article 37: Designation of the data protection officer
Article 38: Position of the data protection officer
Article 39: Tasks of the data protection officer
Article 40: Codes of conduct
Article 41: Monitoring of approved codes of conduct
Article 42: Certification
Article 43: Certification bodies

Chapter 5: Transfers of personal data

Article 44: General principle for transfers
Article 45: Transfers on the basis of an adequacy decision
Article 46: Transfers subject to appropriate safeguards
Article 47: Binding corporate rules
Article 48: Transfers or disclosures not authorised by Union law
Article 49: Derogations for specific situations
Article 50: International cooperation for the protection of personal data

Chapter 6: Supervisory authorities

Article 51: Supervisory authority
Article 52: Independence
Article 53: General conditions for the members of the supervisory authority
Article 54: Rules on the establishment of the supervisory authority
Article 55: Competence
Article 56: Competence of the lead supervisory authority
Article 57: Tasks
Article 58: Powers
Article 59: Activity reports

Chapter 7: Cooperation and consistency

Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned
Article 61: Mutual assistance
Article 62: Joint operations of supervisory authorities
Article 63: Consistency mechanism
Article 64: Opinion of the Board
Article 65: Dispute resolution by the Board
Article 66: Urgency procedure
Article 67: Exchange of information
Article 68: European Data Protection Board
Article 69: Independence
Article 70: Tasks of the Board
Article 71: Reports
Article 72: Procedure
Article 73: Chair
Article 74: Tasks of the Chair
Article 75: Secretariat
Article 76: Confidentiality

Chapter 8: Remedies, liability and penalties

Article 77: Right to lodge a complaint with a supervisory authority
Article 78: Right to an effective judicial remedy against a supervisory authority
Article 79: Right to an effective judicial remedy against a controller or processor
Article 80: Representation of data subjects
Article 81: Suspension of proceedings
Article 82: Right to compensation and liability
Article 83: General conditions for imposing administrative fines
Article 84: Penalties

Chapter 9: Specific processing situations

Article 85: Processing and freedom of expression and information
Article 86: Processing and public access to official documents
Article 87: Processing of the national identification number
Article 88: Processing in the context of employment
Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
Article 90: Obligations of secrecy
Article 91: Existing data protection rules of churches and religious associations

Chapter 10: Delegated and implementing acts

Article 92: Exercise of the delegation
Article 93: Committee procedure

Chapter 11: Final provisions

Article 94: Repeal of Directive 95: /46: /EC
Article 95: Relationship with Directive 20: 02: /58: /EC
Article 96: Relationship with previously concluded Agreements
Article 97: Commission reports
Article 98: Review of other Union legal acts on data protection
Article 99: Entry into force and application

Legal Text


Article 60 - Cooperation between the lead supervisory authority and the other supervisory authorities concerned


1. The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.

2. The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.

3. The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.

4. Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.

5. Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.

6. Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.

7. The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.

8. By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.

9. Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof.

10. After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.

11. Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.

12. The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.

Relevant Recitals

124

125

130

Commentary

The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this article in an endeavour to reach consensus. The wording of the provision indicates that a lead supervisory authority has already been identified under Article 56 and that all the requirements set forth therein are met.

(1) The lead supervisory authority shall cooperate with the other supervisory authorities concerned

Article 60(1) requires the lead authority (“LSA”) to cooperate with the other authorities concerned. As soon as the LSA learns of its responsibility under Article 56(1), it must take the initiative and identify the other supervisory authorities concerned (“CSA”).

Under Article 60, the “lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other”. However, information exchange shall not constitute the only type of cooperation. Instead, all types of cooperation that are “in accordance with this article” are not only permitted but encouraged.

Finally, the duty to cooperate is not one-sided but naturally applies also the other authorities concerned.[1]

Consensus

The lead authority is obliged to reach a consensus with the other authorities concerned.[2] Supervisory authorities concerned shall therefore be given adequate information and sufficient opportunity to present their legal positions (Article 60(3) GDPR), which, as long as possible, shall be incorporated into the LSA’s final assessment. [3]The above seems confirmed by Recital 125, which specifies that “the supervisory authority should closely involve and coordinate the supervisory authorities concerned in the decision-making process”.

Information exchange

The GDPR seems to put a particular focus on the information exchange obligation. Effective Union-wide enforcement requires that all supervisory authorities concerned, including the LSA, receive and share all relevant information on cross-border data processing as promptly as possible. The above stays true even when the identity of the lead supervisory authority is still unclear: the required exchange of information must take place in any case (see Article 61 and Article 62).

(2) The lead supervisory authority may request cooperation

According to Paragraph 2, the lead supervisory authority may request other supervisory authorities to provide mutual assistance pursuant to Article 61 and conduct joint operations pursuant to Article 62. In fact, before issuing a binding decision, it may (and usually will) be necessary for the lead and the other supervisory authorities concerned to first exercise investigative powers in their territory towards the main branch and the other branches of the controller or processor. Cooperation is also crucial in later procedural steps for “monitoring the implementation of a measure concerning a controller or processor established in another Member State”.[4]

(3) Draft decision and relevant reasoned objection

Paragraph 3 sets out the practical background of the cooperation mechanism. The lead supervisory authority communicates the relevant information on the matter to the other supervisory authorities concerned and, without delay, provide them with a draft decision for their opinion, which shall be taken into “due account”. In other words, under Article 60(1), the LSA must adequately address the positions of the other supervisory authorities and integrate them into the decision-making process.[5]

CSA’s objection

Under Article 4(24) GDPR, any CSA can submit an “objection to a draft decision” which must be “relevant and reasoned” and focus on “as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union”.[6]

An objection submitted by a CSA should indicate each part of the draft decision that is considered deficient, erroneous or lacking some necessary elements, either by referring to specific articles/paragraphs or by other clear indication and showing why such issues are to be deemed “relevant” as further explained below. Therefore, the objection aims, first of all, at pointing out how and why according to the CSA the draft decision does not appropriately address the situation of infringement of the GDPR and/or does not envision appropriate action towards the controller or processor. The proposals for amendments put forward by the objection should aim to remedy these errors.

Relevant

For the objection to be considered as “relevant”, there must be a direct connection between the objection and the draft decision at issue. More specifically, the objection needs to concern either whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR. An objection should only be considered relevant if it relates to the specific legal and factual content of the draft decision. Raising only abstract or broad comments or objections cannot be considered relevant in this context.[7]

Reasoned

In order for the objection to be “reasoned”, it needs to include clarifications and arguments as to why an amendment of the decision is proposed(i.e. the alleged legal / factual mistakes of the draft decision). It also needs to demonstrate how the change would lead to a different conclusion as to whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR.

The CSA should provide sound reasoning for its objection, particularly by reference to legal arguments (relying on EU law and/or relevant national law and including, e.g. legal provisions, guidelines, case law) or factual arguments, where applicable. The CSA should present the fact(s) allegedly leading to a different conclusion regarding the infringement of the GDPR by the controller/processor or the aspect of the decision that, in their view, is deficient/erroneous.

In order for an objection to be adequately reasoned, it should be coherent, clear, precise and detailed in explaining the reasons for objection. It should set forth, clearly and precisely, the essential facts on which the CSA based its assessment and the link between the envisaged consequences of the draft decision (if it was to be issued ‘as is’)and the significance of the anticipated risks. Moreover, the CSA should indicate which parts of the draft decision they disagree with. In cases where the objection is based on the opinion that the LSA failed to investigate an essential fact of the case entirely, or an additional violation of the GDPR, it would be sufficient for the CSA to present such arguments in a conclusive and substantiated manner. [8]

Infringement of the GDPR

The CSA’s objections to the draft decision must be justified and motivated through reference to evidence and facts that support the objection, by having regard to the facts and evidence (the ‘relevant information’ referred to in Article 60.3) provided by the LSA. These requirements should apply to each specific infringement and to each specific provision in question (e.g.if the draft decision says that the controller infringed Articles 6, 7, and 14 GDPR, and the CSA disagrees on whether there is an infringement of Article7 and 14 and considers that there is an infringement of Article 13 GDPR).

In some circumstances, the objection could go as far as identifying gaps in the draft decision justifying the need for further investigation by the LSA. For instance, if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised by the complainant or resulting from an infringement reported by a CSA, a relevant and reasoned objection may be raised based on the failure of the LSA to handle the complaint properly and in safeguarding the rights of the data subject.[9]

Other requirements

For the other requirements foreseen in Article 4(24) GDPR please see the relevant provision in the Commentary.

(4) Objection is rejected

Following the submission of the draft decision, the concerned supervisory authorities (CSAs) may raise a relevant and reasoned objection within four weeks. If the LSA does not follow the relevant and reasoned objection or believes that the objection is not reasoned or relevant, the matter is referred to the attention of the EDPB which will decide it following Article 63 and Article 65(1)(a) GDPR. It then becomes incumbent upon the Board to adopt a binding decision on whether the objection is “relevant and reasoned” and, in general, if it meets the requirements outlined in Article 4(24) GDPR.

(5) Objection is accepted

Where the lead supervisory authority intends to follow one or more relevant and reasoned objections made by one or more CSAs, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion as foreseen in Paragraph 4. However, in this case, the CSAs only have two weeks to express their opinion.

(6) Agreement on the draft decision

Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to agree with that draft decision and shall be bound by it. In this case, the decision becomes final.

(7) Notification of the final decision

The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.

(8) Dismissal

By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof. This provision facilitates the data subject who might intend to file an appeal before a national court.

(9) Partial dismissal

Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter.

On the one hand, the LSA adopts the decision for the part concerning actions about the controller, notifies it to the main establishment or single establishment of the controller or processor on the territory of its Member State and informs the complainant.

On the other hand, the supervisory authority of the complainant adopts the decision for the part concerning dismissal or rejection, notifies it to the complainant and informs the controller or processor.

(10) Enforcement

After being notified of the decision of the LSA according to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance for all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.

(11) Urgency procedure

Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.

Exceptional circumstances

You can help us fill this section!

Urgent need

You can help us fill this section!

(12) Forms of communication: electronic means and standardised format

The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.

Decisions

→ You can find all related decisions in Category:Article 60 GDPR

References

  1. ↑ Dix in Kühling, Buchner, GDPR BDSG, Article 60 GDPR, Margin number 6 (Beck 3rd edition 2020)
  2. ↑ The letter of the law seems to put this obligation specifically on the LSA rather than single CSAs. See Polenz in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (1st edition 2019)
  3. ↑ Polenz in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (1st edition 2019)
  4. ↑ Polenz in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 8 (1st edition 2019)
  5. ↑ Paragraphs 3 to 10 contain a completely new, relatively complex two-phases decision-making procedure. The first (or preparatory) phase regulates how information, draft decisions and objections are exchanged among authorities (Paragraphs 3 to 6). The second phase, which consists of the actual decision-making stage (including enforcement), is regulated by following Paragraphs 6 to 10. Polenz in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 9 (1st edition 2019)
  6. ↑ The EDPB provided guidance for the notion of the terms “relevant and reasoned”, including what should be considered when assessing whether an objection “clearly demonstrates the significance of the risks posed by the draft decision” (Article 4(24) GDPR). See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020) (available here)
  7. ↑ See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020)
  8. ↑ See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020)
  9. ↑ See, EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679 (8.10.2020)
Retrieved from "https://gdprhub.eu/index.php?title=Article_60_GDPR&oldid=17480"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki