Authors: Indra Spiecker gen. Döhmann

(24) ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union;

I. Aims, history, systematic

The provision is closely related to Art. 60 para. 4 and Art. 65 para. 1 lit. a. It concerns the case of a dissent between the lead supervisory authority and an affected supervisory authority on a draft decision of the lead supervisory authority and this dissent can result in dispute settlement proceedings before the EDPB (→ Art. 65 mn. 5 et seq.). The disagreement arises because the concerned supervisory authority lodges just an objection to a draft decision of the lead supervisory authority according to No. 24, Art. 60 para. 4 and para. 6. According to rec. 124, the EDPB is required to provide guidelines about when an objection is relevant and reasoned. After the adoption on 08.10.2020 for public consultation, the EDPB adopted guidelines to this effect on 09.03.21. As legal definition, and then as a “relevant and reasoned” objection, the rule was added as No. 19c by the Council-R and was adopted as such.

II. Individual interpretation of the provision

The definition of No. 24 aims at granting the objection a minimum of substantive basis; whether it is actually correct, however, is not necessary. The objection is only provided for in relation to a concrete draft resolution according to Art. 60 para. 4. Consequently, it must be directed at one of two alternatives: According to Alt. 1, the concerned supervisory authority assesses the infringement of the GDPR differently, i.e. has a different opinion on the requirements and legal consequences. It is also conceivable that it recognises further violations or other violations. The objection may also reveal gaps in the draft decision. Also included is the possibility of an objection concerning the role and addressing of the parties, as this may affect the finding of a violation of a provision, but not because of disagreement concerning the competence of the supervisory authority (Art. 65 para. 13 et seq.). In Alt. 2, however, the objection concerns the consequences, whether the intended measure is indeed in compliance with the GDPR. In any case, the objection must clearly state the significance of the risks resulting from the draft decision regarding the freedoms and rights of data subjects (→ Art. 1 mn. 36 et seq.) and, where applicable, the free flow of personal data (→ Art. 1 mn. 41 et seq.). This illustrates that the objection must discuss why the draft decision in the supervisory authority’s opinion does not adequately address the problem. The wording is unfortunate because it gives the impression that a relevant and justified objection could only be directed towards a more infringing measure in the specific case. However, such an objection can also be directed at mitigating the proposed assessment and the measures based on it. Nevertheless, an objection within the meaning of No. 24 cannot be raised if the lead supervisory authority has not even submitted a draft resolution. This results from the wording of Art. 60 para. 4, but also from Art. 66 para. 3, according to which an urgency procedure can be initiated due to inactivity of the supervisory authority (→ Art. 66 mn. 17).

It is difficult to determine the further qualification of the objection: According to the wording, it must be a “relevant and reasoned” objection. Since the legislator obviously sees a difference, as he has chosen two different terms, an interpretation to the effect that the terms are identical is not possible; a differentiation must be made. The term “relevant” is used in various contexts in the GDPR. In Art. 13 para. 3 and Art. 14 para. 4, the term is meant to assist the data subject with regard to information obligations after a change of purpose since the data collection. Art. 45 para. 3 uses the term in the context of the adoption of an adequacy decision by an implementing act of the Comm; there, a mechanism is provided which takes into account the relevant developments in the third country. Consequently, the term means the information relevant for the decision on the continuation of adequacy. Finally, Art. 50 Art. 1 lit. c uses the term to refer to the involvement of relevant stakeholders in international cooperation on data protection. The term thus refers to relevant stakeholders. Art. 57 para. 1 lit. i uses the term to describe the selective monitoring of changes. Art. 60 para. 7 requires the lead supervisory authority to communicate the relevant facts and reasons for its decision. In Art. 61 para. 1 and para. 2, the supervisory authorities provide each other with relevant information. Art. 64 para. 8 requires the competent supervisory authority to communicate its non-compliance with an opinion with relevant reasons. What all uses of the term have in common is that they describe the characteristic of selectivity: Not all information is to be communicated, not all developments are to be perceived, not all facts and reasons are to be given, but only those that have weight for a concrete decision, i.e. are relevant, and precisely for this concrete decision. In the case of No. 24, the objection is therefore relevant if it refers to the concrete draft decision, targets it argumentatively not presenting common and generalised doubts, but expresses precise objections and considerations in the concrete case and related to it. The further conditions of No. 24 (→ mn. 3) assist, but are not complete. This is also the opinion of the EDPB itself seeing relevance if the objection was successful due to a different conclusion, whether the GDPR was violated or whether the draft measure against the controller or processor as proposed by the supervisory authority is in accordance with the GDPR. Consequently, small differences in the reasoning or the wording of the decision shall be of no importance.

The adjective “reasoned” demands that the objection is at all accompanied argumentatively, so that the lead supervisory authority or the EDPB may recognize why the concerned supervisory authority objects to the draft decision. Those reasons must be legitimate and legally significant, i.e. they must be able to lead to a change of consequence. It is not necessary that the reasoned objection is convincing. The first cases of objections according to No. 24 in a proceeding according to Art. 65 (→ Art. 65 mn. 9, 13) showed, however, that the criterion of significance of the specific risk is interpreted strictly and that most objections fail because not passing this threshold. However, this is not in accordance with the wording and the purposes.