Author: Indra Spiecker gen. Döhmann

 

1. In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Arts. 63, 64 and 65 or the procedure referred to in Art. 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.
2. Where a supervisory authority has taken a measure pursuant to para. 1 and considers that definitive measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision.
3. Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act.
4. By derogation from Art. 64 para. 3 and Art. 65 para. 2, an urgent opinion or an urgent binding decision referred to in paras. 2 and 3 of this Art. shall be adopted within two weeks by simple majority of the members of the Board.

 

I. Aims, history and systematic

Paras. 1-4 of Art. 66 of the GDPR standardise the urgency procedure. This procedure is required if the consistency mechanism according to Art. 63-65 or the procedure according to Art. 60 is too lengthy because a measure is urgently needed to protect the rights and freedoms of data subjects. The procedure enables the competent supervisory authority to take independent measures without first coordinating them with the other concerned supervisory authorities, although this would actually be required according to Art. 60 or Art. 63 et seq. Thus, within the scope of Art. 66, a differentiated structuring of the various objectives regarding the effectiveness of enforcement and communication between the supervisory authorities is established. Art. 66, despite its systematic position in Section 2 on consistency, is a special rule that expands beyond this scope, since the norm does not apply exclusively to the consistency mechanism according to Art. 63, 64 and 65, but also to the cooperation between the supervisory authorities, which is regulated in more detail in Section 1 (Art. 60-62). The consistency mechanism and the procedure according to Art. 60 share the common understanding that in the cases regulated in Art. 66 para. 1 exceptional circumstances require a rapid measure by the concerned supervisory authority. This is intended in particular to achieve effective protection of fundamental rights – above all of Art. 7 and 8 CFR – of the persons concerned. Accordingly, the supervisory authorities can act here both on the basis of their own powers and to remedy complaints. Especially in the cases of Art. 60 para. 11, the procedure should be an important component of a uniform and consistent practice of the supervisory authorities avoiding enforcement deficits. The provision is also important because there is no direct remedy against an inactive lead supervisory authority. Furthermore, it is of great importance because it takes into account the fact that information infringements can usually not be reversed and preventive measures are therefore particularly important (→ introduction mn. 4).

The norm is largely identical to the proposal in Art. 61 Comm-P and has only undergone minor changes and additions in the further course of the procedure, which reacted to changes in Art. 65.

Para. 1 regulates the material preconditions for interim measures, while para. 2 standardises the requirements for subsequent definitive measures. Para. 3 concerns the special case of inaction by a competent supervisory authority. Para. 4 determines the exact extent of the reduction of the deadline as well as the altered majority requirements for opinions and decisions of the Board in the urgency procedure. Thus, para. 2 to para. 4 regulate the actual urgency procedure, para. 1, on the other hand, the original power of action of the concerned supervisory authority existing independently of any action by the EDPB. Rec. 137 must be consulted when interpreting the norm.

 

II. Material preconditions for interim measures (para. 1)

A supervisory authority concerned (Art. 4 No. 22) may, in exceptional circumstances, take interim measures on its territory with a maximum duration of three months if the supervisory authority determines that there is an urgent need to act in order to protect the rights and freedoms of the data subject. The supervisory authority is obliged to inform all other supervisory authorities concerned as well as the EDPB and the Comm of this measure and to explain its reasons without delay. Para. 1 thus exempts the acting supervisory authority from the otherwise compulsory coordination with the other supervisory authorities as well as from the cooperation requirement of Art. 51 para. 2 sentence 2 or Art. 63.

1. Competence

In the urgency procedure, any supervisory authority concerned is competent. The lead supervisory authority (Art. 56) is considered to be a concerned supervisory authority, because according to Art. 56 para. 1 it is the authority of the main or only establishment, and the local jurisdiction for an establishment turns the authority concerned at the same time into one according to Art. 4 No. 22 lit. a.

 

 

 

[…]