Author: Stephanie Schiedermair

1. The Board shall take decisions by a simple majority of its members, unless otherwise provided for in this Regulation.

2. The Board shall adopt its own rules of procedure by a two-thirds majority of its members and organise its own operational arrangements.

I. Introduction

The DPD (Art. 29) provided for a single voting rule regarding the adoption of decisions by a simple majority of the representatives of the SAs and required the Art. 29 WP to draft its rules of procedure. In the same vein, Art. 72 GDPR establishes the voting requirements of the EDPB and demands that the Board lay down its rules of procedure.[1]

II. Analysis

As a general rule, the EDPB shall take decisions by a simple majority of its members. The fact that decisions are made in general by way of a majority vote as opposed to a unanimous vote allows the Board to make binding decisions on matters in dispute between the SAs.[2] The GDPR can, however, provide for deviations from this basic rule. By way of example, decisions made by the Board as part of the dispute resolution procedure pursuant to Art. 65 are made with a two-thirds majority. The Board’s rules of procedure also must be adopted by a two-thirds majority of its members. The EDPS has the same voting rights as the representatives of the Member States as a rule. Due to the Community competence of the EDPS, however, it has voting rights in dispute resolution procedures pursuant to Art. 65 GDPR[3] only on those decisions which concern principles and rules that apply to the Union institutions, bodies, offices and agencies and correspond in substance to the provisions of the GDPR. If a representative of the Comm takes part in meetings of the Board, this representative does not have a voting right on the Board. The Board sets out the details of its working procedures in its rules of procedure.[4] Within this context, it can also set up sub-groups on certain data protection issues, as was also the case with the Art. 29 WP.[5]

The EDPB rules of procedure consist of eight titles:[6]

• ‘The Board’: this title refers to the identity, the missions and the principles governing the EDPB.
• ‘Composition’: this title deals with membership, appointment of the Chair and deputy chairs (including term of service), the obligations of the Chair and deputy chairs as well as the role of the observers, experts and other parties.
• ‘Adoption of Documents and Procedure’: this title addresses opinions, guidelines, recommendations, best practices as well as binding decisions of the EDPB and the procedure governing emergency situations.
• ‘Secretariat and Organisation’: this title is dedicated to the EDPB’s secretariat and its economic resources and information about expenses and its information and communication system.
• ‘Working Methods’: this title is concerned with the meetings of the EDPB (such as information about language of the proceedings or consultations).
• ‘General Provisions’: this title is devoted to access to meetings and documentation, confidentiality matters, data protection, reporting and representation of the EDPB before the CJEU.
• ‘Coordinated Supervision Committee’: this is a new title under which the Coordinated Supervision Committee is established. The Committee is aimed at, among others, achieving the goals of its participating authorities, facilitating the exchange of information, aiding in audits and inspections, assessing problems regarding the interpretation or exercise of the rights of the data subjects.
• ‘Final Provisions’: this title deals with the amendment procedure, the EDPB’s webpage, time limits and entry into force.

[1]A discussion in: Docksey, ‘Art. 72’ in Kuner/Bygrave/Docksey, p. 1090.

[2]See also Albrecht, CR 2016, p. 88 (p. 96).

[3]Cf. Art. 41 et seq. of Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, OJ L 8, dated 12 January 2001, 1.

[4]See the rules of procedure, adopted on 8 October 2020, https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_rop_version_7_adopted_20201008_de.pdf (14 February 2021).

[5]See recital 139 GDPR.

[6]EDPB, ‘Rules of procedure’ (version 7, adopted on 25 May 2018, as last modified and adopted on 8 October 2020).