Article 61 GDPR: Difference between revisions

From GDPRhub
 
(21 intermediate revisions by 5 users not shown)
Line 185: Line 185:


== Legal Text ==
== Legal Text ==
<br /><center>'''Article 61 - Mutual Assistance'''</center><br />
<br /><center>'''Article 61 - Mutual assistance'''</center>


<span id="1">1.  Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.</span>
<span id="1">1.  Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.</span>
Line 210: Line 210:


==Relevant Recitals==
==Relevant Recitals==
<span id="r119">
{{Recital/119 GDPR}}{{Recital/123 GDPR}}{{Recital/133 GDPR}}
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 119:''' title </div>
<div class="mw-collapsible-content">
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.
</div></div>
 
<span id="r123">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 123:''' title </div>
<div class="mw-collapsible-content">
The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application throughout the Union, in order to protect natural persons in relation to the processing of their personal data and to facilitate the free flow of personal data within the internal market. For that purpose, the supervisory authorities should cooperate with each other and with the Commission, without the need for any agreement between Member States on the provision of mutual assistance or on such cooperation.
</div></div>
 
<span id="r133">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 133:''' title </div>
<div class="mw-collapsible-content">
The supervisory authorities should assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of this Regulation in the internal market. A supervisory authority requesting mutual assistance may adopt a provisional measure if it receives no response to a request for mutual assistance within one month of the receipt of that request by the other supervisory authority
</div></div>


== Commentary ==
== Commentary ==


'''Commentary Article 61'''
Article 61(1) GDPR regulates how independent authorities are to cooperate to enable the uniform application of the GDPR. Supervisory authorities (“''SA''”) must share any relevant information and, where requested, provide mutual assistance in relation to the carrying out of certain investigations or acts of investigation. Article 61(2) GDPR requires SAs to have appropriate organisational and technical measures in place to respond promptly to mutual assistance requests made in accordance with certain standards of clarity (Article 61(3) GDPR). Requests are imperative and, subject to specific exceptions (Article 61(4) and (5) GDPR), must be fulfilled and, as a rule, acknowledged electronically (Article 61(7) GDPR) and free of charge (Article 61(7) GDPR). Finally, where the requested activity is not carried out, the national SA is given the possibility of adopting measures that have legal effects on the territory of its Member State (Article 61(8) GDPR).
 
The subject of administrative assistance under Paragraph 1 can be all types of supervisory measures in support of any supervisory duties and powers. Administrative assistance enables the requesting supervisory authority to access knowledge that it would otherwise not have and could not gain, at least for territorial reasons. <ref>''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Art. 61, Marginal number 7, 1st edition 2019 who clarifies that the requested supervisory authority can be asked, for example, to exercise authorisation under Article 58(3) or to carry out investigations in the form of data protection reviews in accordance with Article 58(1)(b)</ref>
 
=== (1) Mutual assistance to implement and apply the GDPR in a consistent manner ===
Article 61 does not shine for clarity. If, on the one hand, it seems manifest that the ultimate goal of the cooperation is to "implement and apply [the] Regulation in a consistent manner", it is not clear, on the other hand, what are the instruments an authority can use to achieve such goal.
 
In fact, whilst the "Mutual assistance" between authorities seems to be identified as the principal instrument of the task, Article 61(1) also refers to other concepts or tasks. In particular, DPAs "provide each other with relevant information" '''and''' "put in place measures for effective cooperation". By using the conjunction "and", the lawmaker seems to suggest that "information" and" measures" are alternatives to the "Mutual assistance". Probably, as the most sound doctrine states, it is simply a case of poor legislative technique.<ref>''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Art. 61, Marginal number 7, 1st edition 2019</ref>
 
It follows that the attention of the interpreter can focus on the central concept of "Mutual assistance", which can, in turn, be obtained through a series of tools such as "relevant information" and "measures for effective cooperation". Under paragraph 1, in particular, requests for Mutual assistance "shall cover […] information requests and supervisory measures, '''such as''' requests to carry out prior authorisations and consultations, inspections and investigations" [emphasis added].


=== (2) DPAs have to act on the assistance request (Article 61(2)) ===
=== (1) Exchange of information and mutual assistance ===
Following the request for assistance, the authority shall reply without delay and, in any event, no later than one month after receipt of the request. The provision's wording indicates that, in principle, the answer shall not consist of a mere update but rather the outcome of the requested activities. However, it seems entirely foreseeable that the deadline will not be met in some cases, especially if the requested activities involve dealing with third parties or complex investigation operations.<ref>''Körffer'' in Paal, Pauly, Körffer, DS-GVO BDSG, Art. 61, Marginal number 4, 3rd edition 2021</ref>
The ultimate goal of the mutual assistance under Article 61 GDPR is to "''implement and apply'' [the] ''Regulation in a consistent manner''". SAs "''provide each other with relevant information''" and "''mutual assistance''". By using the conjunction "''and''", the lawmaker seems to suggest that "''information''" and "''mutual assistance''" are alternative. Such conclusion should be rejected because "''relevant information''" is only a tool to achieve "''mutual assistance''".<ref>It is therefore a simple case of poor legislative technique. See, ''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 61 GDPR, margin number 7 (C.H. Beck 2019, 1st ed.)</ref> Other activities enabling real cooperation among SAs are "''supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations''".<ref>''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 61 GDPR, margin number 7 (Beck 2019, 1st ed.), who clarifies that the requested SA can be asked, for example, to exercise authorisation under Article 58(3) or to carry out investigations in the form of data protection reviews in accordance with Article 58(1)(b) GDPR.</ref>


=== (3) Requirements and limits of the assistance request ===
=== (2) Duty to act on an assistance request ===
The request for administrative assistance must contain all the information necessary enabling the requested authority to comply with it without delay. The Regulation stipulates that the information includes the purpose and reasons for the request. Therefore, the requested information must be tailored to the subject matter of the request and can only be used in that context. However, scholars suggest that the requirement should not be interpreted in an overly restrictive fashion. For example, the request (and the information it implies) may trigger ex-officio investigations (on both sides).<ref>''Dix'', in Kühling, Buchner, GDPR BDSG, Art. 61, Marginal number 12, 3rd edition 2020</ref>
Article 61(2) GDPR requires SAs to take all necessary measures to respond to requests for mutual assistance made by other SAs. This means, first of all, that the receiving SA is required to have adequate organisational measures in place to process the request internally and to follow it up fully, by any action deemed necessary. The request must also be responded to in a timely manner. In particular, the requested SA shall reply without delay and, in any event, no later than one month after receipt of the request. The wording indicates that, in principle, the answer shall not consist of a mere update but rather the outcome of the requested activities. However, it seems entirely foreseeable that the deadline will not be met in some cases, especially if the requested activities involve dealing with third parties or complex investigation operations.<ref>''Körffer'' in Paal, Pauly, DS-GVO BDSG, Article 61 GDPR, margin number 4 (Beck 2021, 3rd ed.).</ref>


=== (4) Exceptions ===
=== (3) Requirements of an assistance request and limitation of utilization of requested information ===
The requested supervisory authority shall not refuse to comply with the request unless (a) it is not competent for the subject matter of the request or for the measures it is requested to execute, or (b) compliance with the request would infringe the Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.
The request for administrative assistance must contain all the information necessary to enable the requested SA to comply with it without delay. The GDPR stipulates that the information includes the purpose and reasons for the request. Therefore, the requested information must be tailored to the subject matter of the request and can only be used in context of that request. However, scholars suggest that the requirement should not be interpreted in an overly restrictive fashion. For example, the request (and the information it implies) may well trigger ex-officio investigations (on both sides).<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 12 (Beck 2020, 3rd ed.).</ref>


We agree with some authors that letter (b) contains letter (a) because it is the same European law that defines the supervisory authorities' competence and the measures they can take.<ref>''Dix'', in Kühling, Buchner, GDPR BDSG, Art. 61, Marginal number 13, 3rd edition 2020</ref> Therefore, a request for administrative assistance may only be refused if the requested authority is forced to act unlawfully, either under Union or domestic law. However, the domestic law that limits the obligation to provide administrative assistance must, for its part, conform with Union law. In particular, the regulation does not authorise the Member States to create further grounds for refusing administrative assistance.<ref>''Dix'', in Kühling, Buchner, GDPR BDSG, Art. 61, Marginal number 13, 3rd edition 2020</ref>
=== (4) Conditions for a refusal to comply with an assistance request ===
The requested SA shall not refuse to comply with the request unless (a) it is not competent for the subject matter of the request or for the measures it is requested to execute, or (b) compliance with the request would infringe the GDPR or Union or Member State law to which the SA receiving the request is subject. Some authors convincingly argue that letter (b) contains letter (a) because the competence of the SA is regulated either by European or national law.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 13 (Beck 2020, 3rd edition).</ref> Therefore, a request for administrative assistance may only be refused if the requested SA is forced to act unlawfully, either under Union or domestic legislation. However, the domestic law that limits the obligation to provide administrative assistance must, for its part, conform with Union law. In particular, the regulation does not authorise the Member States to create further grounds for refusing administrative assistance.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 13 (Beck 2020, 3rd edition).</ref> In any case, according to paragraph 5 below, the requested SA shall provide reasons for any refusal to comply with a request under paragraph 4.


In any case, according to paragraph 5 below, the requested supervisory authority shall provide reasons for any refusal to comply with a request under paragraph 4.
=== (5) Response by the requested supervisory authority (SA) ===
Article 61(5) GDPR seems to require the requested SA to communicate the results of the request or, if not possible (see paragraph 2 above), at least an update on the progress of the procedure, in particular by making clear which "''measures'' [have been] ''taken in order to respond''".<ref>On this point, we would like to point out that, unlike what happens in Article 57(f) GDPR, under which the data subject is entitled to know the "progress and the outcome of the investigation", Article 61 GDPR seems to require higher-level accountability for inter-SAs communications.</ref> Article 61(5)(2) GDPR imposes an obligation on the requested SA to give reasons if a request for administrative assistance is rejected. The mere assertion of a possible legal violation is not sufficient in this respect. Rather, the requested SA must substantiate why it cannot comply with the request. In the event of rejection due to lack of competence, the principle of genuine cooperation between the SAs requires the requested authority to inform the requesting authority of the competent authority.<ref>''Peuker'' in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 39 (Beck 2018, 2nd edition).</ref>


=== (5) Constant updates are required following the request ===
=== (6) Exchange of information by electronic means ===
Paragraph 5 seems to require the requested authority to communicate the results of the request or, if not possible (see Par. 2 above), at least an update on the progress of the procedure, in particular by making clear which "measures [has been] taken in order to respond".<ref>On this point, we would like to point out that, unlike what happens in Article 57(f), under which the data subject is entitled to know the "progress and the outcome of the investigation", Article 61 seems to require higher-level accountability for inter-DPAs communications.</ref>
Article 61(6) GDPR sets out the principle of electronic communication between the SAs without excluding other forms of communication ("''as a rule''"). In urgent cases, for example, information can also be transmitted by telephone or by other means.
 
Paragraph 5, sentence 2 imposes an obligation on the requested authority to give reasons if a request for administrative assistance is rejected. However, the mere assertion of a possible legal violation is not sufficient for this. Instead, the requested authority must substantiate why it cannot comply with the request. In the event of rejection due to lack of competence, the principle of genuine cooperation between the supervisory authorities requires the requested authority to inform the requesting authority of the competent authority.<ref>''Peuker'', in Sydow, European General Data Protection Regulation, Art. 61, Marginal number 39, 2nd edition 2018</ref>
 
=== (6) Modalities and other aspects ===
Paragraph 6 sets out the principle of electronic communication between the supervisory authorities without excluding other forms of communication ("as a rule"). In urgent cases, for example, information can also be transmitted by telephone or by other means.


=== (7) Fees ===
=== (7) Fees ===
Mutual assistance requests shall be carried out free of charge. The idea behind the '''exemption from fees''' is that the proper implementation of Union law is a matter of common interest (Article 197(1) TFEU). It is argued that costs for administrative assistance of the individual Member States converge or offset each other in the long term. Therefore, mutual invoicing of individual administrative assistance would only generates additional administrative effort, but no additional income.<ref>''Peuker'', in Sydow, European General Data Protection Regulation, Art. 61, Marginal number 42, 2nd edition 2018</ref>
Mutual assistance requests shall be carried out free of charge. The idea behind the exemption from fees is that the proper implementation of Union law is a matter of common interest (Article 197(1) TFEU). It is argued that costs for administrative assistance of the individual Member States converge or offset each other in the long term. Therefore, mutual invoicing of individual administrative assistance would only generate additional administrative effort, but no additional income.<ref>''Peuker'' in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 42 (Beck 2018, 2nd edition).</ref> However, in exceptional circumstances, SAs can arrange agreements to indemnify each other for specific expenditures arising from the provision of mutual assistance. These include, for example, expenses for experts or interpreters or expenses in the event of particular difficulties with administrative assistance.<ref>''Peuker'' in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 44 (Beck 2018, 2nd edition).</ref>
 
However, in exceptional circumstances, DPAs can arrange agreements to indemnify each other for specific expenditures arising from the provision of mutual assistance. These include, for example, expenses for experts or interpreters or expenses in the event of particular difficulties with administrative assistance.<ref>''Peuker'', in Sydow, European General Data Protection Regulation, Art. 61, Marginal number 44, 2nd edition 2018</ref>
 
=== (8) Inaction of the requested authority ===
According to Paragraph 8, first sentence, if, within one month of receiving the request, the requested DPA does not inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request (Article 61(5) GDPR), the requesting supervisory authority may adopt a provisional measure on the territory of its Member State under Article 55(1).


If the authority do so, the consequences seem to be two, both of them derogatory to the standard procedure set forth by Article 66. First, the DPA do not have to prove the urgency required by Article 66(1) for "normal" urgency cases (in fact, the urgency "shall be presumed"). Second, the provisional measure will be subject to an "urgent binding decision from the Board". This second consequence is also exceptional because, as opposed to Article 66(2), under which the DPA '''may''' request either a '''binding''' or '''non-binding''' decision from the EDPB, in this case, there is no choice: there will be an assessment by the EDPB the outcome of which will be binding.
=== (8) Urgent measures in case of inaction of the requested supervisory authority (SA) ===
According to Article 61(8)(1) GDPR, if, within one month of receiving the request, the requested SA does not inform the requesting SA of the results or, as the case may be, of the progress of the measures taken in order to respond to the request (Article 61(5) GDPR), the requesting SA may adopt a provisional measure on the territory of its Member State under Article 55(1) GDPR. If the SA does not meet the deadline, the consequences seem to be two, both of them derogatory to the standard procedure set forth by Article 66 GDPR. First, the SA does not have to prove the urgency required by Article 66(1) GDPR for "''normal''" urgency cases (the urgency "''shall be presumed''"). Second, the provisional measure will be subject to an "''urgent binding decision from the Board''". This second consequence is also exceptional because, as opposed to Article 66(2) GDPR, under which the SA may request either a binding or non-binding decision from the EDPB, in this case, there is no choice: there will be an assessment by the EDPB the outcome of which will be binding.


=== (9) Implementing acts by the Commission ===
=== (9) Implementing acts by the Commission ===
The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in Article 61 and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular, the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).
The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in Article 61 GDPR and the arrangements for the exchange of information by electronic means between supervisory authorities, and between SAs and the Board, in particular, the standardised format referred to in Article 61(6) GDPR. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2) GDPR.


== Decisions ==
== Decisions ==
Line 281: Line 249:
<references />
<references />


[[Category:Article 61 GDPR]] [[Category:GDPR]]
[[Category:Article 61 GDPR]] [[Category:GDPR Articles]]

Latest revision as of 11:46, 15 January 2024

Article 61 - Mutual assistance
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 61 - Mutual assistance

1. Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.

2. Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation.

3. Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.

4. The requested supervisory authority shall not refuse to comply with the request unless:

(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or
(b) compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.

5. The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4.

6. Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.

7. Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.

8. Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2).

9. The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

Relevant Recitals

Recital 119: Participation in Consistency Mechanism in Case of Multiple Supervisory Authorities
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.

Recital 123: Cooperation Amongst Supervisory Authorities and with the Commission
The supervisory authorities should monitor the application of the provisions pursuant to this Regulation and contribute to its consistent application throughout the Union, in order to protect natural persons in relation to the processing of their personal data and to facilitate the free flow of personal data within the internal market. For that purpose, the supervisory authorities should cooperate with each other and with the Commission, without the need for any agreement between Member States on the provision of mutual assistance or on such cooperation.

Recital 133: Mutual Assistance and Provisional Measures
The supervisory authorities should assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of this Regulation in the internal market. A supervisory authority requesting mutual assistance may adopt a provisional measure if it receives no response to a request for mutual assistance within one month of the receipt of that request by the other supervisory authority.

Commentary

Article 61(1) GDPR regulates how independent authorities are to cooperate to enable the uniform application of the GDPR. Supervisory authorities (“SA”) must share any relevant information and, where requested, provide mutual assistance in relation to the carrying out of certain investigations or acts of investigation. Article 61(2) GDPR requires SAs to have appropriate organisational and technical measures in place to respond promptly to mutual assistance requests made in accordance with certain standards of clarity (Article 61(3) GDPR). Requests are imperative and, subject to specific exceptions (Article 61(4) and (5) GDPR), must be fulfilled and, as a rule, acknowledged electronically (Article 61(7) GDPR) and free of charge (Article 61(7) GDPR). Finally, where the requested activity is not carried out, the national SA is given the possibility of adopting measures that have legal effects on the territory of its Member State (Article 61(8) GDPR).

(1) Exchange of information and mutual assistance

The ultimate goal of the mutual assistance under Article 61 GDPR is to "implement and apply [the] Regulation in a consistent manner". SAs "provide each other with relevant information" and "mutual assistance". By using the conjunction "and", the lawmaker seems to suggest that "information" and "mutual assistance" are alternative. Such conclusion should be rejected because "relevant information" is only a tool to achieve "mutual assistance".[1] Other activities enabling real cooperation among SAs are "supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations".[2]

(2) Duty to act on an assistance request

Article 61(2) GDPR requires SAs to take all necessary measures to respond to requests for mutual assistance made by other SAs. This means, first of all, that the receiving SA is required to have adequate organisational measures in place to process the request internally and to follow it up fully, by any action deemed necessary. The request must also be responded to in a timely manner. In particular, the requested SA shall reply without delay and, in any event, no later than one month after receipt of the request. The wording indicates that, in principle, the answer shall not consist of a mere update but rather the outcome of the requested activities. However, it seems entirely foreseeable that the deadline will not be met in some cases, especially if the requested activities involve dealing with third parties or complex investigation operations.[3]

(3) Requirements of an assistance request and limitation of utilization of requested information

The request for administrative assistance must contain all the information necessary to enable the requested SA to comply with it without delay. The GDPR stipulates that the information includes the purpose and reasons for the request. Therefore, the requested information must be tailored to the subject matter of the request and can only be used in context of that request. However, scholars suggest that the requirement should not be interpreted in an overly restrictive fashion. For example, the request (and the information it implies) may well trigger ex-officio investigations (on both sides).[4]

(4) Conditions for a refusal to comply with an assistance request

The requested SA shall not refuse to comply with the request unless (a) it is not competent for the subject matter of the request or for the measures it is requested to execute, or (b) compliance with the request would infringe the GDPR or Union or Member State law to which the SA receiving the request is subject. Some authors convincingly argue that letter (b) contains letter (a) because the competence of the SA is regulated either by European or national law.[5] Therefore, a request for administrative assistance may only be refused if the requested SA is forced to act unlawfully, either under Union or domestic legislation. However, the domestic law that limits the obligation to provide administrative assistance must, for its part, conform with Union law. In particular, the regulation does not authorise the Member States to create further grounds for refusing administrative assistance.[6] In any case, according to paragraph 5 below, the requested SA shall provide reasons for any refusal to comply with a request under paragraph 4.

(5) Response by the requested supervisory authority (SA)

Article 61(5) GDPR seems to require the requested SA to communicate the results of the request or, if not possible (see paragraph 2 above), at least an update on the progress of the procedure, in particular by making clear which "measures [have been] taken in order to respond".[7] Article 61(5)(2) GDPR imposes an obligation on the requested SA to give reasons if a request for administrative assistance is rejected. The mere assertion of a possible legal violation is not sufficient in this respect. Rather, the requested SA must substantiate why it cannot comply with the request. In the event of rejection due to lack of competence, the principle of genuine cooperation between the SAs requires the requested authority to inform the requesting authority of the competent authority.[8]

(6) Exchange of information by electronic means

Article 61(6) GDPR sets out the principle of electronic communication between the SAs without excluding other forms of communication ("as a rule"). In urgent cases, for example, information can also be transmitted by telephone or by other means.

(7) Fees

Mutual assistance requests shall be carried out free of charge. The idea behind the exemption from fees is that the proper implementation of Union law is a matter of common interest (Article 197(1) TFEU). It is argued that costs for administrative assistance of the individual Member States converge or offset each other in the long term. Therefore, mutual invoicing of individual administrative assistance would only generate additional administrative effort, but no additional income.[9] However, in exceptional circumstances, SAs can arrange agreements to indemnify each other for specific expenditures arising from the provision of mutual assistance. These include, for example, expenses for experts or interpreters or expenses in the event of particular difficulties with administrative assistance.[10]

(8) Urgent measures in case of inaction of the requested supervisory authority (SA)

According to Article 61(8)(1) GDPR, if, within one month of receiving the request, the requested SA does not inform the requesting SA of the results or, as the case may be, of the progress of the measures taken in order to respond to the request (Article 61(5) GDPR), the requesting SA may adopt a provisional measure on the territory of its Member State under Article 55(1) GDPR. If the SA does not meet the deadline, the consequences seem to be two, both of them derogatory to the standard procedure set forth by Article 66 GDPR. First, the SA does not have to prove the urgency required by Article 66(1) GDPR for "normal" urgency cases (the urgency "shall be presumed"). Second, the provisional measure will be subject to an "urgent binding decision from the Board". This second consequence is also exceptional because, as opposed to Article 66(2) GDPR, under which the SA may request either a binding or non-binding decision from the EDPB, in this case, there is no choice: there will be an assessment by the EDPB the outcome of which will be binding.

(9) Implementing acts by the Commission

The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in Article 61 GDPR and the arrangements for the exchange of information by electronic means between supervisory authorities, and between SAs and the Board, in particular, the standardised format referred to in Article 61(6) GDPR. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2) GDPR.

Decisions

→ You can find all related decisions in Category:Article 61 GDPR

References

  1. It is therefore a simple case of poor legislative technique. See, Polenz, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 61 GDPR, margin number 7 (C.H. Beck 2019, 1st ed.)
  2. Polenz, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 61 GDPR, margin number 7 (Beck 2019, 1st ed.), who clarifies that the requested SA can be asked, for example, to exercise authorisation under Article 58(3) or to carry out investigations in the form of data protection reviews in accordance with Article 58(1)(b) GDPR.
  3. Körffer in Paal, Pauly, DS-GVO BDSG, Article 61 GDPR, margin number 4 (Beck 2021, 3rd ed.).
  4. Dix, in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 12 (Beck 2020, 3rd ed.).
  5. Dix, in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 13 (Beck 2020, 3rd edition).
  6. Dix, in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 13 (Beck 2020, 3rd edition).
  7. On this point, we would like to point out that, unlike what happens in Article 57(f) GDPR, under which the data subject is entitled to know the "progress and the outcome of the investigation", Article 61 GDPR seems to require higher-level accountability for inter-SAs communications.
  8. Peuker in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 39 (Beck 2018, 2nd edition).
  9. Peuker in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 42 (Beck 2018, 2nd edition).
  10. Peuker in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 44 (Beck 2018, 2nd edition).