Author: Vagelis Papakonstantinou

 

1. Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.
2. Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation.
3. Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.
4. The requested supervisory authority shall not refuse to comply with the request unless:

(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or

(b) compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.

5. The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4.
6. Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.
7. Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.
8. Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2).
9. The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

 

I. Preliminary remarks

The second instance of cooperation among SAs outlined in Chapter VII refers to mutual assistance. Together with the OSS of Art. 60 and the joint operations of Art. 62 they constitute the formal ways of cooperation among SAs, before the consistency mechanism of Art. 63 is invoked. Cooperation among SAs is important and is therefore fostered in the text of the GDPR. Nevertheless, it is inevitable that such cooperation will not always run smoothly. The consistency mechanism of Art. 63 assumes therefore the role of both the last resort and the watchdog to make certain that cooperation, either through the OSS or through mutual assistance or through joint operations, runs smoothly and leads to consistent application of the GDPR. This is evidenced, if not through interpretation, then at least through the GDPR’s architecture in this Chapter VII: The OSS, the provisions on mutual assistance and on joint operations are all assembled in a separate Section, Section 1, while the consistency mechanism occupies alone Section 2 (and the provisions on the EDPB Section 3 respectively).

Mutual assistance among SAs did not obviously need to be institutionalised in the text of the GDPR. Indeed, a distinct characteristic of EU data protection since the time it was first introduced through the DPD refers to increased cooperation among SAs. Although the OSS of Art. 60 did not exist, different was the case with requests for assistance among SAs, that were if not streamlined then at least not uncommon. Nevertheless, the formalisation of a mutual assistance mechanism serves two purposes: First, to formalise a procedure that is expected to increasingly take place, notwithstanding whether other administrative law already in effect enables such cooperation or not (see Recital 123). Second, to parallel and formalise its relationship with the OSS, which holds a prominent role in the GDPR; Mutual assistance (as well as joint operations) are embedded in the OSS, and as such needed their own special treatment in the text of the GDPR.

Same as with the OSS, the provisions of this Art. 61 do not create directly rights or obligations to controllers or data subjects. They are of a technical nature, setting up an administrative mechanism whose adequate, or inadequate, operation in practice does not give birth to any rights or claims to data subjects or controllers. While it is to the benefit of SAs themselves and the EDPB to uphold and preserve the mutual assistance mechanism of this Art. 61, whether in practice it is immaculately applied or not does not, directly at least, concern either individuals or organisations (see, however, → mn. 25).eng

II. Legislative history

Provisions on mutual assistance were included in the Comm-P under the same regulatory architecture (in the sense of their relationship with the OSS and joint operations), as the one that finally made it into the text of the GDPR. The final wording of this Art. 61 is the outcome mostly of the Council-R’s intervention, while suggestions in the Parl-R were for most of their part ignored.

As regards the DPD, no detailed provisions can be found in its text. The only brief mention to SAs “exchanging all useful information” could be found in its Art. 28 para. 6. Even in this case, however, it was not consistency but rather implementation that was aimed at: while the DPD set as aim of mutual assistance ensuring that “the rules of protection are properly respected throughout the European Union” (Recital 64), this Art. 61 introduces an elaborate mutual assistance mechanism “in order to implement and apply this Regulation in a consistent manner”.

 

 

[…]