Author: Indra Spiecker gen. Döhmann
- In order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall adopt a binding decision in the following cases:
(a) where, in a case referred to in Article 60 para. 4, a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority or the lead authority has rejected such an objection as being not relevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;
(b) where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;
(c) where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.
- The decision referred to in para. 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board. That period may be extended by a further month on account of the complexity of the subject-matter. The decision referred to in para. 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them.
- Where the Board has been unable to adopt a decision within the periods referred to in para. 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in para. 2 by a simple majority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the vote of its Chair.
- The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under para. 1 during the periods referred to in paras. 2 and 3.
- The Chair of the Board shall notify, without undue delay, the decision referred to in para. 1 to the supervisory authorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in para. 6.
- The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in para. 1 of this Article, without undue delay and at the latest by one month after the Board has notified its decision. The lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the date when its final decision is notified respectively to the controller or the processor and to the data subject. The final decision of the supervisory authorities concerned shall be adopted under the terms of Article 60 para. 7-9. The final decision shall refer to the decision referred to in para. 1 of this Article and shall specify that the decision referred to in that para. will be published on the website of the Board in accordance with para. 5 of this Article. The final decision shall attach the decision referred to in para. 1 of this Article.
Ι. Aims, purposes and systematic
Art. 65 standardises the central instrument of the consistency mechanism with the dispute settlement procedure. This is without precedent in data protection law[1] and also in the rest of EU law[2]; Art. 29 Working Party did not have an even remotely comparable strong position. Above all, the binding nature of the decisions ending the procedure according to para. 1 for the supervisory authorities results in the special effectiveness of the consistency mechanism for establishing a consistent and effective interpretation and enforcement practice of the Member State supervisory authorities. The aim is to create legal certainty, legal uniformity and a level playing field.[3] However, the instrument of dispute resolution applies only in individual cases; the actors involved are intended to try a consensus among themselves first (→ Art. 60 mn. 5 et seq.). This also upholds the independence of the supervisory authorities; due to the binding nature of the decisions in the dispute settlement procedure according to para. 1, this is after all not insignificantly restricted, although not violated finally because the EDPB itself is independent. It also consists of the independent supervisory authorities themselves – at least with regard to voting rights – and thus shares their independence. In the end, a part of an independent decision remains with the supervisory authorities because the EDPB does not take over the decision-making power as such, but this remains with the supervisory authorities themselves for specific cases according to para. 6 (→ Art. 63 mn. 27). All of this applies anyhow only to the enforcement of legal acts adopted on the basis of the dispute settlement procedure.
However, the legal practice up to now falls far short of great expectations. Only very few decisions have been taken in the dispute resolution procedure at all, and this is unfortunately not because the supervisory authorities in Europe have been united in their approach against a multitude of unlawful established practices or newly emerging services, applications, software or technologies and their competences. On the contrary, only a few draft decisions have been submitted at all, especially with regard to the processing of globally active data processors, where obvious doubts about the lawfulness of their processing exist. Furthermore, the procedure is slow and a final decision can take a long time.[4] Therefore, the enforcement, impact and effectiveness of the GDPR has so far remained far behind what was expected by the legislator and reads in the Regulation. However, some fundamental decisions have been taken,[5] but all in all very few taking into account the amount of processings. As a result, it is not surprising that the Comm is seeking to regulate data markets in other ways. Most of the decisions taken concern the Irish Supervisory Authority due to its responsibility for Meta.[6]
Para. 1 specifies the matters in which the Board conducts the dispute settlement procedure. In contrast to the opinion procedure according to Art. 64 para. 1, the GDPR does not provide for any assignments to the dispute settlement procedure beyond para. 1. Para. 2 to 5 standardise the dispute settlement procedure in its details even to the information of the public and any potential complainants; para. 4, comparable to Art. 64 para. 6, imposes a blocking period on the supervisory authority during which it may not take any action. Para. 6 determines the requirements for the decision of the supervisory authority on the basis of the decision issued in the procedure according to Art. 65.
II. History
The norm was only included in the GDPR in its current form as a result of the proposals of the EP and the Council.[7] Art. 58a para. 7 Parl-R provided that “the EDPB […] may adopt a measure which is binding on the supervisory authority”. Art. 58a Council-R clarified to the effect that the title of the norm already spoke of “decision[s] of the European Data Protection Board”. This proposal was largely implemented in the GDPR. The transfer of a last decision-making power to the Board was thus a central change that the EP and the Council pushed through compared to the original draft of the Comm.[8] Thus, the Board has the possibility to adopt legally binding decisions in accordance with Art. 288 TFEU.[9] The rule has also been changed in terms of content by the consolidation in April 2018 with regard to para. 1 lit. a: In addition, it was added for the first option that the supervisory authority did not join the objection.
The EDPB has developed guidelines within the framework of Art. 64 according to recital 124 sentence 4, some of which go far beyond formal requirements, especially with regard to the definition of a reasoned and relevant objection.[10]
III. Applicability of the dispute settlement procedure (para. 1)
Para. 1 lit. a to lit. c standardise those cases in which a binding decision by the Board is required; the GDPR does not regulate any other cases. The provision mentions three cases: divergent opinions of the supervisory authorities in both the cases of Art. 60 para. 4 (para. 1 lit. a), disputes about the competent supervisory authority for the head office (para. 1 lit. b) as well as cases in which the competent supervisory authority does not obtain a necessary opinion of the Board or does not follow the opinion of the Board (para. 1 lit. c). It is clear from the nature of the cases of application mentioned that the legislator has deliberately limited the application to a few cases. However, since the listed cases have a wide scope of application, in particular Art. 60 para. 4 and Art. 64 para. 1 and para. 2, the dispute settlement procedure can be used in a large number of substantive issues and thus enable the EDPB to make far-reaching binding decisions. Unlike the opinion procedure, however, the EDPB cannot itself conduct the dispute settlement procedure, which would be more effective because it is more binding.
-
Divergent opinions of the supervisory authorities (para. 1 lit. a)
Para. 1 lit. a contains two alternatives. Both require a lead supervisory authority and a draft decision of it which has been objected; in both cases, there must be a disagreement between the lead supervisory authority and at least one concerned supervisory authority in order to trigger the consistency procedure. The distinguishing criterion, however, is what the disagreement is about: alt. 1 concerns a substantive disagreement, as has been made clear since the consolidation of April 2018, alt. 2 concerns a disagreement on the relevance or merits of the objection.
[…]
[1] About the previous legal situation and similar procedures in data protection law Schöndorf-Haubold in Sydow Art. 65 mn. 3 et seq.
[2] The Joint Supervisory Body within the framework of the Europol Decision is institutionally and functionally different because Europol is an independent supranational institution whose supervisory body pursues completely different purposes.
[3] Reding, ZD 2012, 195 (196).
[4] For the Decision 3/2022 on Meta it took 4½ years from the first complaints at the national supervisory authority.
[5] Cf. Decisions 2-5/2022 for the legal basis of processings (Art. 6).
[6] In January 2023, 6 of 7 Binding Decisions taken.
[7] Schöndorf-Haubold in Sydow Art. 65 mn. 7.
[8] Marsch in BeckOK DatenschutzR Art. 65 mn. 2.
[9] Cf. Piltz, K&R 2017, 85 (87); Schantz, NJW 2016, 1841 (1847); Marsch in BeckOK DatenschutzR Art. 65 mn. 1.
[10] EDPB, Guidelines 03/2021 mn. 64 et seq.