Author: Indra Spiecker gen. Döhmann

 

1. The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

(a) aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);

(b) concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

(c) aims to approve the requirements for accreditation of a body pursuant to Article 41(3), of a certification body pursuant to Article 43(3) or the criteria for certification referred to in Article 42(5);

(d) aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);

(e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or

(f) aims to approve binding corporate rules within the meaning of Article 47.

2. Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.
3. In the cases referred to in para.s 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. 2That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in para. 1 circulated to the members of the Board in accordance with para. 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision.
4. Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned.
5. The Chair of the Board shall, without undue, delay inform by electronic means:

• (a) the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and
• (b) the supervisory authority referred to, as the case may be, in para.s 1 and 2, and the Commission of the opinion and make it public.

6. The competent supervisory authority referred to in para. 1 shall not adopt its draft decision referred to in para. 1 within the period referred to in para. 3.
7. The competent supervisory authority referred to in para. 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.
8. Where the competent supervisory authority referred to in para. 1 informs the Chair of the Board within the period referred to in para. 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply.

 

I. Systematic, history and purpose

Art. 64 regulates the opinion procedure. The purpose of this procedure is to ensure that the GDPR is enforced as uniformly as possible. For this, the Member State supervisory authorities in the EDPB are to adopt a joint opinion (Art. 288 para. 5 TFEU). This can be mandatory (para. 1) or optional upon request (para. 2). This instrument counteracts divergent interpretations in the Member States and fragmentation in enforcement practice.[1]  Even though the opinion procedure typically takes place within the framework of a staged individualized administrative procedure (para. 1), it is envisaged that such common legal positions are not only developed in the case of concrete measures, but also on fundamental issues proactively addressed upon request (para. 2). The process for the opinion procedure in para. 3 is in terms of time not regulated stringently before the requirements for the submission of supervisory authorities and the Comm in para. 4. Para. 4 specifies the EDPB’s information and knowledge basis and thus regulates the basic conditions for preparing decisions. Para. 5 describes the procedure regarding further information by the chair of the EDPB after the opening of the opinion procedure. Para. 6 contains an obligation of the competent supervisory authority not to make the procedure before the EDPB become obsolete by a hasty decision for the specific case. Para. 7 deals with the further procedure after the Board has sent its opinion to the competent supervisory authority. Finally, para. 8 regulates what to do if the competent supervisory authority does not wish to follow the opinion of the Board in whole or in part. Beyond the scope of Art. 64, the GDPR provides for further opinions of the EDPB in Art. 70. However, it would be inappropriate to conclude from this that Art. 64 is to be primarily applied in cases of temporal urgency.[2]  Even though this may place a considerable burden on the EDPB, the structuring effect of procedures under Art. 64 would otherwise be misunderstood. Moreover, this would not reduce a potential overload for the EDPB, but would make it more difficult to deal with fundamental issues. It is this function, however, that the consistency mechanism is designed for, to effectively remedy the enforcement deficit. Overload phenomena are to be remedied through expanded resources.

Obtaining an opinion does not ultimately restrict the independence of the supervisory authorities (→ Art. 52 mn. 3). The supervisory authorities continue to directly implement the provisions of the GDPR (→ Art. 63 mn. 27). For the opinion according to para. 1, this follows from the fact that it constitutes an inter-administrative act. The EDPB only becomes active on the basis of and within the framework of a concrete, staged administrative procedure under the direction of a supervisory authority, which retains the right of final decision, even if this may then lead to the dispute settlement procedure under Art. 65. In addition, the EDPB himself is independent, Art. 69.

Since the consistency mechanism has no real predecessor within the DPD, no regulations on the opinion procedure have been amended by Art. 64. However, the Art. 29 Working Party performed a function similar to the Art. 64 procedure, albeit significantly retracted, by issuing opinions and recommendations under Art. 30 DPD.[3] This limited function resulted from the legal position, which was essentially reduced to consultation and which is for the EDPB significantly enhanced by the binding nature of the EDPB’s measures. Comparable to the tasks of paras. 1 and 2 as well as the objective of the consistency mechanism was above all the task according to Art. 30 para. 1 lit. a DPD, according to which the Art. 29 WP could address all questions that arose in the context of the implementation of the DPD in order to contribute to a consistent application. This very general consultation task and power is now found in para. 2. In terms of content, the task was comparable to para. 1 in Art. 30 para. 1 lit. d DPD, which provided that opinions were to be issued on codes of conduct pursuant to Art. 27 DPD (now: Art. 40 GDPR).

The form of the consistency mechanism, although not its actual institutionalisation, was highly contentious in the legislative process; this also affected Art. 64. Compared to Art. 58 Comm-P, Art. 64 was modified in particular with regard to those measures where the opinion procedure should be applicable.[4] The possibility for the Comm to comment and issue statements (Art. 59 Comm-P) was completely deleted. This counteracted the Comm’s initial strong position (→ Art. 63 mn. 8 et seq.).[5] In addition, far-reaching obligations to obtain opinions, in particular with regard to widely defined processing activities, similar to the width of the market principle of Art. 3 para. 2, were deleted. Thus, the scope of measures when the EDPB has to be mandatorily involved was reduced (Art. 58 para. 2 lit. a and b Comm-P). In para. 2, the general scope of application was additionally narrowed by restricting it to “matters of general application”. The EP’s proposal in Art. 66 para. 1 Parl-R to be able to request an opinion from the EDPB was rejected. In the corrigendum of April 2018, the term “competent authority” was clarified to mean the competent authority of para. 1; in para. 1 lit. c the scope of application was extended to the criteria for certification pursuant to Art. 42 para. 5.

It is not clear from the wording of Art. 64 whether the opinion procedure only applies to projected measures and matters with cross-border significance (→ Art. 63 mn. 12). At least, the measures listed under para. 1 do not indicate that a cross-border aspect of data processing is necessary,[6] since the corresponding measures can almost all also be carried out exclusively in a member state of the EU without a cross-border processing being relevant. Reference to recital 135 as a limiting argument also fails because its formulations in p. 2 and p. 3 use this characteristic inconsistently and, moreover, p. 2 only speaks of “in particular”. Also because of systematic and teleological, purpose oriented arguments, the opinion procedure does not require measures and matters with cross-border significance,[7] especially since Chapter VII does not only cover cross-border matters. This is also not contradicted for Art. 64 by the fact that in para. 1 lit. b reference is made to Art. 40 para. 7 (draft of codes of conduct), according to which only the draft of such codes of conduct is subject to the consistency mechanism if processing activities exist in several Member States.[8] The fact that individual regulations require cross-border data processing explicitly clarifies that a cross-border reference only has to exist in exceptional cases. Only exceptionally would some criteria fall under this requirement, such as lit. a or the accreditation criteria pursuant to lit. c or, as in lit. e, solely in relation to processors in third countries. Not least, it is often not certain ex ante whether there is a cross-border reference,[9] so that in dubio pro uniformity – also in favor of the data processor – the opinion procedure is applicable. The dispute is in any case defused by the fact that para. 2 allows for matters of general application to be examined by the Board with the aim of issuing an opinion at the request of one supervisory authority only. Thus, even if a supervisory authority does not refer the matter to the EDPB under para. 1 on its own initiative because it takes the view that a cross-border reference is required, the EDPB can still take action on the matter via para. 2.

 

 

 

 

[…]

 

 

 

 

[1] Also cf. Klabunde in Ehmann/Selmayr Art. 64 mn. 4; Van Eecke/Šimkus, ‘Art. 63’ in Kuner/Bygrave/Docksey, A. p. 996.

[2] Van Eecke/Šimkus, ‘Art. 64’ in Kuner/Bygrave/Docksey, C. 5 p.1012.

[3] Cf. the previous legal situation under the DPD: Schöndorf-Haubold in Sydow Art. 64 mn. 2 et seq.

[4] In detail Schöndorf-Haubold in Sydow Art. 64 mn. 5 et seq.

[5] Cf. also Marsch in BeckOK DatenschutzR Art. 64 mn. 3.

[6] Also Marsch in BeckOK DatenschutzR Art. 64 mn. 7.

[7] Different Hullen in Plath DS-GVO Art. 64 mn. 1; Caspar in Kühling/Buchner Art. 64 mn. 3.

[8] Contradicting Spindler ZD 2016, 407 (410).

[9] Marsch in BeckOK DatenschutzR Art. 64 mn. 7.1.