menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Netherlands) language
Contact our local member in Netherlands mail_outline
Visit the website of Ventoux account_balance

arrow_backPrevious Article
Article 64
Next Articlearrow_forward

Opinion of the Board

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 64 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 64 keyboard_arrow_up

Key words related to article 64

Show the recitals of the Regulation related to article 64 keyboard_arrow_down Hide the recitals of the Regulation related to article 64 keyboard_arrow_up

(139) In order to promote the consistent application of this Regulation, the Board should be set up as an independent body of the Union. To fulfil its objectives, the Board should have legal personality. The Board should be represented by its Chair. It should replace the Working Party on the Protection of Individuals with Regard to the Processing of Personal Data established by Directive 95/46/EC. It should consist of the head of a supervisory authority of each Member State and the European Data Protection Supervisor or their respective representatives. The Commission should participate in the Board's activities without voting rights and the European Data Protection Supervisor should have specific voting rights. The Board should contribute to the consistent application of this Regulation throughout the Union, including by advising the Commission, in particular on the level of protection in third countries or international organisations, and promoting cooperation of the supervisory authorities throughout the Union. The Board should act independently when performing its tasks.

 

There is no recital in the Directive related to article 64.

The GDPR

Article 64 defines the cases for which the opinion of the Board must be requested by a national authority before implementing its decision. The European Board is indeed at the heart of the mechanism for the control of consistency.

The European Board is granted power to issue an opinion on some national authorities draft decisions. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

- aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35 (4) of the Regulation;

- concerns a matter pursuant to Article 40 7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

- aims to approve the criteria for accreditation of a body pursuant to Article 41 3) or a certification body pursuant to Article 43 3);

- aims to determine standard data protection clauses referred to in point (d) of Article 46 (2) and in Article 28 (8);

- aims to authorise contractual clauses referred to in point (a) of Article 46 (3);

- aims to approve binding corporate rules within the meaning of Article 47.

Furthermore, any supervisory authority, the Chair of the European Data Protection Board or the Commission may request that any matter of general application or which effects more than one Member State, be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance (see Article 61) or for joint operations (see Article 62).

Paragraph 3 specifies that the European Board must issue an opinion on the matter submitted under paragraphs 1 and 2, provided that an opinions has not already been issued on the same matter. Moreover, the relevant opinion shall be adopted within eight weeks by simple majority of the members of the Board but the period may be extended by a further six weeks subject to complexity of the subject matter. Regarding the draft decision of the supervisory authority circulated to the members of the Board in accordance with paragraph 6, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision (paragraph 3). The competent supervisory authority shall not adopt the draft decision within that period (paragraph 6).

The modes of communication for the draft decision of a supervisory authority within the meaning of paragraph 1 are defined in paragraphs 4 and 5:

- Supervisory authorities and the Commission shall, without undue delay, communicate in standard format by electronic means to the Board any relevant information, including where relevant a summary of the facts, the draft decision, the grounds for enactment, and the views of other supervisory authorities concerned (paragraph 4).

-  The Chair of the Board shall, without unduedelay inform by electronic means, the members of the Board and the Commission of any relevant information which has been communicated to it using a standardized format (paragraph 5, a)). Where required, The Chair of the Board shall also inform the supervisory authority referred to in paragraphs 1 and 2, and the Commission of the opinion and make it public (paragraph 5, b)).

The relevant supervisory authority shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision. In a case of amendment, the supervisory authority shall communicate the draft decision to the Board in a standardized format (paragraph 7).

Where the supervisory authority concerned informs the Chair of the Board that it does not intend to follow the opinion of the Board, in whole or in part, the Board shall issue a binding decision according to the procedure described in Article 65.

The Directive

The European Data Protection Board did not exist under the Directive.

Potential issues

We do not see  a priori  any specific implementation difficulties.

arrow_back Previous Article • Article 64 • Next Article arrow_forward
arrow_back Previous Article • Article 64 Next Article arrow_forward
arrow_back Previous Article • Article 64 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-645/19 (15 June 2021) - Facebook Ireland Ltd e.a. c. Gegevensbeschermingsautoriteit

1) Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a supervisory authority of a Member State which, under the national legislation adopted in order to transpose Article 58(5) of that regulation, has the power to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where necessary, to initiate or engage in legal proceedings, may exercise that power in relation to an instance of cross‑border data processing even though it is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, with respect to that data processing, provided that that power is exercised in one of the situations where Regulation 2016/679 confers on that supervisory authority a competence to adopt a decision finding that such processing is in breach of the rules contained in that regulation and that the cooperation and consistency procedures laid down by that regulation are respected.

2) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the lead supervisory authority, to initiate or engage in legal proceedings, within the meaning of that provision, that the controller or processor with respect to the cross-border processing of personal data against whom such proceedings are brought has a main establishment or another establishment on the territory of that Member State.

3) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where appropriate, to initiate or engage in legal proceedings, within the meaning of that provision, may be exercised both with respect to the main establishment of the controller which is located in that authority’s own Member State and with respect to another establishment of that controller, provided that the object of the legal proceedings is a processing of data carried out in the context of the activities of that establishment and that that authority is competent to exercise that power, in accordance with the terms of the answer to the first question referred.

4) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, has brought a legal action, the object of which is an instance of cross-border processing of personal data, before 25 May 2018, that is, before the date when that regulation became applicable, that action may, from the perspective of EU law, be continued on the basis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which remains applicable in relation to infringements of the rules laid down in that directive committed up to the date when that directive was repealed. That action may, in addition, be brought by that authority with respect to infringements committed after that date, on the basis of Article 58(5) of Regulation 2016/679, provided that that action is brought in one of the situations where, exceptionally, that regulation confers on a supervisory authority of a Member State which is not the ‘lead supervisory authority’ a competence to adopt a decision finding that the processing of data in question is in breach of the rules contained in that regulation with respect to the protection of the rights of natural persons as regards the processing of personal data, and that the cooperation and consistency procedures laid down by that regulation are respected, which it is for the referring court to determine.

5) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.

Opinion of Advocate General

Judgment of the Court

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 64 Next Article arrow_forward
Regulation
1e 2e

Art. 64

1.   The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:

(a) aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);

(b) concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

(c) aims to approve the criteria for accreditation of a body pursuant to Article 41(3) or a certification body pursuant to Article 43(3);

(d) aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);

(e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or

(f) aims to approve binding corporate rules within the meaning of Article 47.

2.   Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.

3.   In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision.

4.   Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned.

5.   The Chair of the Board shall, without undue, delay inform by electronic means:

(a) the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and

(b) the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.

6.   The competent supervisory authority shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3.

7.   The supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.

8.   Where the supervisory authority concerned informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply.
1st proposal close

Art. 58 

1.           Before a supervisory authority adopts a measure referred to in paragraph 2, this supervisory authority shall communicate the draft measure to the European Data Protection Board and the Commission.

2.           The obligation set out in paragraph 1 shall apply to a measure intended to produce legal effects and which:

(a)     relates to processing activities which are related to the offering of goods or services to data subjects in several Member States, or to the monitoring of their behaviour; or

(b)     may substantially affect the free movement of personal data within the Union; or

(c)     aims at adopting a list of the processing operations subject to prior consultation pursuant to Article 34(5); or

(d)     aims to determine standard data protection clauses referred to in point (c) of Article 42(2); or

(e)     aims to authorise contractual clauses referred to in point (d) of Article 42(2); or

(f)      aims to approve binding corporate rules within the meaning of Article 43.

3.           Any supervisory authority or the European Data Protection Board may request that any matter shall be dealt with in the consistency mechanism, in particular where a supervisory authority does not submit a draft measure referred to in paragraph 2 or does not comply with the obligations for mutual assistance in accordance with Article 55 or for joint operations in accordance with Article 56.

4.           In order to ensure correct and consistent application of this Regulation, the Commission may request that any matter shall be dealt with in the consistency mechanism.

5.           Supervisory authorities and the Commission shall electronically communicate any relevant information, including as the case may be a summary of the facts, the draft measure, and the grounds which make the enactment of such measure necessary, using a standardised format.

6.           The chair of the European Data Protection Board shall immediately electronically inform the members of the European Data Protection Board and the Commission of any relevant information which has been communicated to it, using a standardised format. The chair of the European Data Protection Board shall provide translations of relevant information, where necessary.

7.           The European Data Protection Board shall issue an opinion on the matter, if the European Data Protection Board so decides by simple majority of its members or any supervisory authority or the Commission so requests within one week after the relevant information has been provided according to paragraph 5. The opinion shall be adopted within one month by simple majority of the members of the European Data Protection Board. The chair of the European Data Protection Board shall inform, without undue delay, the supervisory authority referred to, as the case may be, in paragraphs 1 and 3, the Commission and the supervisory authority competent under Article 51 of the opinion and make it public.

8.           The supervisory authority referred to in paragraph 1 and the supervisory authority competent under Article 51 shall take account of the opinion of the European Data Protection Board and shall within two weeks after the information on the opinion by the chair of the European Data Protection Board, electronically communicate to the chair of the European Data Protection Board and to the Commission whether it maintains or amends its draft measure and, if any, the amended draft measure, using a standardised format.
2nd proposal close

Art. 58

1. (…)

2. (…)

3. (…)

4. (…)

5. (…)

6. (…)

7. In the cases referred to in paragraphs 2 and 4 of Article 57, the European Data Protection Board shall issue an opinion on the subject- matter submitted to it provided it has not already issued an opinion on the same matter. This opinion shall be adopted within one month by simple majority of the members of the European Data Protection Board. This period may be extended by a further month, taking into account the complexity of the subject matter. Regarding the draft decision circulated to the members of the Board in accordance with paragraph 6 of Article 57, a member which has not objected within the period indicated by the Chair, shall be deemed to be in agreement with the draft decision.

7a. Within the period referred to in paragraph 7 the competent supervisory authority shall not adopt its draft decision in accordance with paragraph 2 of Article 57.

7b. The chair of the European Data Protection Board shall inform, without undue delay, the supervisory authority referred to, as the case may be, in paragraphs 2 and 4 of Article 57 and the Commission of the opinion and make it public.

8. The supervisory authority referred to in paragraph 2 of Article 57 shall take utmost account of the opinion of the European Data Protection Board and shall within two weeks after receiving the opinion, electronically communicate to the chair of the European Data Protection Board whether it maintains or will amend its draft decision and, if any, the amended draft decision, using a standardised format.

9. Where the concerned supervisory authority informs the chair of the European Data Protection Board within the period referred to in paragraph 8 that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, paragraph 3 of Article 57 shall apply. 10. (…) 11. (…)
Directive close

No specific provision
Netherlands
compare_arrows

Belgique close

Pas de disposition correpondante
arrow_back Previous Article • Article 64 Next Article arrow_forward
close

2016 - www.itiplaw.eu.