menu MENU
arrow_back Tilbake til alle artikler
Endre land (Nåværende : Norway) language
Kontakt vårt medlem i Norway mail_outline
Besøk nettstedet til Bull & Co account_balance

arrow_backTidligere artikkel
Artikkel 60
Neste artikkelarrow_forward

Cooperation between the lead supervisory authority and the other supervisory authorities concerned

Offisielle tekster Retningslinjer Beslutninger Vurderinger
EU-regulering Vurderinger
nasj. regulering
Vis nøkkelord og artikler relatert til art. 60 i forordningen keyboard_arrow_down Skjul nøkkelord og artikler relatert til art. 60 keyboard_arrow_up

Nøkkelord relatert til art. 60

Vis forordningens fortaletekst relatert til art. 60 keyboard_arrow_down Skjul forordningens fortaletekst relatert til art. 60 keyboard_arrow_up

(133) The supervisory authorities should assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of this Regulation in the internal market. A supervisory authority requesting mutual assistance may adopt a provisional measure if it receives no response to a request for mutual assistance within one month of the receipt of that request by the other supervisory authority..

(134) Each supervisory authority should, where appropriate, participate in joint operations with other supervisory authorities. The requested supervisory authority should be obliged to respond to the request within a specified time period.

Det finnes ingen fortaletekst i direktivet relatert til art. 60.

GDPR

The Regulation seeks to provide solutions to the lack of coordination between the various national authorities potentially competent under the Directive via single window mechanism established by Article 56. The “lead” supervisory authority is the only authority competent to monitor the activities of the controller or the processor carried out throughout the Union and to take the relevant decisions. The competence of the “lead” supervisory authority is specified in Article 56 of the Regulation that we refer to.

Article 60 of the Regulation impose on the ‘lead’ supervisory authority the obligation to cooperate with the other supervisory authorities with a view to reach a consensus in cases of potential debate on the designation of the competent supervisory authorities, in particular, to exchange all useful information (paragraph 1). Such exchange of information must be carried out by electronic means, by using a standard form (paragraph 10).

The lead supervisory authority may request at any time from the other “supervisory authorities concerned” the provision of mutual assistance in application of Article 61. According to article 4 (22) of the Regulation, the supervisory authority may be concerned by the processing in three cases:

“a) the controller or processor is established on the territory of the Member State of that supervisory authority;

b) data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing;

or c) a complaint has been lodged with that supervisory authority.”

In addition, the lead authority may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State (Article 60, paragraph 2).

Let’s recall, in the comments to Article 56, we have seen that when one national authority other than the leading supervisory authority is, however, competent by application of the second paragraph of Article 56 to handle a claim lodged with it, it should inform the lead supervisory authority. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case or the authority should handle it at local level.

In the case where the lead supervisory authority decides to handle the case, paragraph 3 of Article 60 shall apply. This provision requires the lead supervisory authority to communicate “without delay” the useful information on the matter to the other supervisory authorities concerned. The supervisory authority shall also submit without delay a draft for a decision to the other supervisory authorities concerned in order to obtain their opinion and take due account of their views.

The other supervisory authorities have the ability to raise objections to the draft decision within a period of four weeks (paragraph 4). In the absence of response within the time limits set by the provision, the other supervisory authorities shall be deemed to have approved the draft for a decision and shall be bound by it (paragraph 6).

The lead supervisory authority shall, if it does not follow the “relevant and reasoned” objection provided by any other supervisory authority, submit the matter to the consistency mechanism referred to in Article 63 (4). The relevant and reasoned objection is defined in Article 4 (24) of the Regulation as “an objection as to whether there is an infringement of this Regulation, or, as the case may be, whether envisaged action in relation to the controller or processor complies with this Regulation. The objection shall clearly demonstrate the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union.

In this case, the European Data Protection Board must make a binding decision on all aspects of the said objection and must in particular consider whether there is a violation of the Regulation (see Article 65 (1) (a)).

Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. They will have a period of two weeks to provide their opinion. In this case, the procedure provided for in paragraph 3 shall apply (Art. 60, (5)).

At the end of this procedure, the lead supervisory authority shall adopt the decision and communicate it to the main establishment of the controller or the processor and shall inform the other supervisory authorities concerned, as well as the European Data Protection Board, making sure to include a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant of the decision (paragraph 7).

Where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof (paragraph 8).

In the case of a mixed decision, i.e., where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. In this case, the allocation of competences shall be as follows:

- the lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, and

- the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof (paragraph 9).

The controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union (paragraph 10).  The controller or processor shall notify the lead supervisory authority of the measures taken for complying with the decision,  thenshall also inform the other supervisory authorities concerned.

Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply (Article 60 (11)). This provision authorises the relevant supervisory authority to adopt without delay temporary measures with a limited legal scope within the territory of its Member State.

Direktivet

The Directive only provides that the supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information. However, no provision of the Directive regulates the modes of cooperation between the national supervisory authorities.

The absence of obligation for coordination to the national supervisory authorities in the Directive has led to many problems for companies that operate on a transnational level facing the application of different national legislations.

Utfordringer

The implemented procedure seems highly complex and will lead to considerable work for the authorities concerned, who may often have to deal with the same case. Concomitant action by two separate authorities according to the nature of the decision (rejection or admission) is more likely to cause confusion for the complainant and concerned controllers/subcontractors who may no longer know who their interlocutor is.

arrow_back Tidligere artikkel • Artikkel 60 • Neste artikkel arrow_forward
arrow_back Tidligere artikkel • Artikkel 60 Neste artikkel arrow_forward
arrow_back Tidligere artikkel • Artikkel 60 Neste artikkel arrow_forward
Retour au sommaire
arrow_back Tidligere artikkel • Artikkel 60 Neste artikkel arrow_forward
Forordning
1e 2e

Art. 60

1.   The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.

2.   The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.

3.   The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.

4.   Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.

5.   Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.

6.   Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.

7.   The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.

8.   By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.

9.   Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof.

10.   After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.

11.   Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.

12.   The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.
1. forslag close

No specific provision
2. forslag close

Art. 54a

1. The lead supervisory authority (…) shall cooperate with the other concerned supervisory authorities in accordance with this article in an endeavour to reach consensus (…). The lead supervisory authority and the concerned supervisory authorities shall exchange all relevant information with each other.

1a. The lead supervisory authority may request at any time other concerned supervisory authorities to provide mutual assistance pursuant to Article 55 and may conduct joint operations pursuant to Article 56, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.

2. The lead supervisory authority shall, without delay communicate the relevant information on the matter to the other concerned supervisory authorities. It shall without delay submit a draft decision to the other concerned supervisory authorities for their opinion and take due account of their views.

3. Where any of the other concerned supervisory authorities within a period of four weeks after having been consulted in accordance with paragraph 2, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the objection or is of the opinion it is not relevant and reasoned, submit the matter to the consistency mechanism referred to in Article 57. (…)

3a. Where the lead supervisory authority intends to follow the objection made, it shall submit to the other concerned supervisory authorities a revised draft decision for their opinion. This revised draft decision shall be subject to the procedure referred to in paragraph 3 within a period of two weeks.

4. Where none of the other concerned supervisory authority has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 3 and 3a, the lead supervisory authority and the concerned supervisory authorities shall be deemed to be in agreement with this draft decision and shall be bound by it.

4a. The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other concerned supervisory authorities and the European Data Protection Board of the decision in question including a summary of the relevant facts and grounds. The supervisory authority to which a complaint has been lodged shall inform the complainant on the decision.

4b. By derogation from paragraph 4a, where a complaint is dismissed or rejected, the supervisory authority to which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.

4bb. Where the lead supervisory authority and the concerned supervisory authorities are in agreement to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter.The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller and notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint and notify it on that complainant and shall inform the controller or processor thereof.

4c. After being notified of the decision of the lead supervisory authority pursuant to paragraph 4a and 4bb, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards the processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other concerned supervisory authorities.

4d. Where, in exceptional circumstances, a concerned supervisory authority has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 61 shall apply.

5. The lead supervisory authority and the other concerned supervisory authorities shall supply the information required under this Article (…) to each other by electronic means, using a standardised format.
Direktiv close

Art. 28

(...)

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

(...). 
Norway
compare_arrows
visibility Gamle loven

Art. 60

Samarbeid mellom ledende tilsynsmyndighet og andre berørte tilsynsmyndigheter

1. Den ledende tilsynsmyndigheten skal samarbeide med de andre berørte tilsynsmyndighetene i samsvar med denne artikkel og bestrebe seg på å oppnå enighet. Den ledende tilsynsmyndigheten og de berørte tilsynsmyndighetene skal utveksle all relevant informasjon seg imellom.

2. Den ledende tilsynsmyndigheten kan til enhver tid anmode andre berørte tilsynsmyndigheter om gjensidig bistand i henhold til artikkel 61 og gjennomføre felles aktiviteter i henhold til artikkel 62, særlig for å foreta undersøkelser eller føre tilsyn med gjennomføringen av et tiltak som gjelder en behandlingsansvarlig eller databehandler som er etablert i en annen medlemsstat.

3. Den ledende tilsynsmyndigheten skal uten opphold oversende relevant informasjon om saken til de andre berørte tilsynsmyndighetene. Den skal uten opphold legge fram et utkast til avgjørelse for de andre berørte tilsynsmyndighetene, slik at de kan avgi uttalelse, og skal ta behørig hensyn til deres synspunkter.

4. Dersom en av de andre berørte tilsynsmyndighetene innen fire uker etter å ha blitt konsultert i samsvar med nr. 3 i denne artikkel, uttrykker en relevant og begrunnet innsigelse mot utkastet til avgjørelse, skal den ledende tilsynsmyndigheten, dersom den ikke etterkommer den relevante og begrunnede innsigelsen eller mener at innsigelsen ikke er relevant eller begrunnet, framlegge forholdet for konsistensmekanismen nevnt i artikkel 63.

5. Dersom den ledende tilsynsmyndigheten har til hensikt å etterkomme den relevante og begrunnede innsigelsen, skal den framlegge et revidert utkast til avgjørelse til de andre berørte tilsynsmyndighetene og be om deres uttalelse. Det reviderte utkastet til avgjørelse skal behandles i samsvar med framgangsmåten nevnt i nr. 4 innen en frist på to uker.

6. Dersom ingen av de andre berørte tilsynsmyndighetene innen fristen nevnt i nr. 4 og 5 har gjort innsigelse mot utkastet til avgjørelse framlagt av den ledende tilsynsmyndigheten, skal den ledende tilsynsmyndigheten og de berørte tilsynsmyndighetene anses for å samtykke i nevnte utkast til avgjørelse og være bundet av det.

7. Den ledende tilsynsmyndigheten skal treffe avgjørelsen og meddele den til den behandlingsansvarliges eller databehandlerens hovedvirksomhet eller eneste virksomhet, etter hva som er relevant, og underrette de andre berørte tilsynsmyndighetene og Personvernrådet om den aktuelle avgjørelsen, herunder gi et sammendrag av de relevante faktiske forhold og begrunnelser. Tilsynsmyndigheten som det er klaget til, skal underrette klageren om avgjørelsen.

8. Dersom en klage avvises eller avslås, skal tilsynsmyndigheten som klagen ble inngitt til, som unntak fra nr. 7, treffe avgjørelsen og meddele den til klageren og underrette den behandlingsansvarlige om den.

9. Dersom den ledende tilsynsmyndigheten og de berørte tilsynsmyndighetene er enige om å avvise eller avslå deler av en klage og å behandle andre deler av klagen, skal det treffes en særskilt avgjørelse for hver av disse delene. Den ledende tilsynsmyndigheten skal treffe avgjørelse om den del som gjelder tiltak knyttet til den behandlingsansvarlige, meddele dette til den behandlingsansvarliges eller databehandlerens hovedvirksomhet eller eneste virksomhet på territoriet til medlemsstaten den er underlagt, og underrette klageren om dette, mens klagerens tilsynsmyndighet skal treffe avgjørelse om den del som gjelder avvisning av eller avslag på klagen, og meddele den til klageren og underrette den behandlingsansvarlige eller databehandleren om dette.

10. Etter å ha blitt underrettet om den ledende tilsynsmyndighetens avgjørelse i henhold til nr. 7 og 9 skal den behandlingsansvarlige eller databehandleren treffe de nødvendige tiltak for å sikre overholdelse av denne avgjørelse med hensyn til behandlingsaktiviteter som utføres i forbindelse med alle vedkommendes virksomheter i Unionen. Den behandlingsansvarlige eller databehandleren skal underrette den ledende tilsynsmyndigheten, som skal underrette de andre berørte tilsynsmyndighetene om tiltakene som er truffet for å sikre overholdelse av avgjørelsen.

11. Dersom en berørt tilsynsmyndighet i særlige tilfeller har grunn til å tro at det er et akutt behov for å treffe tiltak for å verne de registrertes interesser, får framgangsmåten for behandling av hastesaker nevnt i artikkel 66 anvendelse.

12. Den ledende tilsynsmyndigheten og de andre berørte tilsynsmyndighetene skal utveksle den informasjonen som kreves i henhold til denne artikkel, elektronisk og ved bruk av et standardisert format.
Gamle loven close

Ingen tilsvarende bestemmelse
Norway close

Ingen tilsvarende bestemmelse
arrow_back Tidligere artikkel • Artikkel 60 Neste artikkel arrow_forward
close

2016 - www.itiplaw.eu.