Article 66
Urgency procedure

Official
Texts
Guidelines
& Caselaw
Review of
EU Regulation
Review of
Nat. Regulation
Show the recitals of the Regulation related to article 66 keyboard_arrow_down Hide the recitals of the Regulation related to article 66 keyboard_arrow_up

(137) There may be an urgent need to act in order to protect the rights and freedoms of data subjects, in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded. A supervisory authority should therefore be able to adopt duly justified provisional measures on its territory with a specified period of validity which should not exceed three months.

There is no recital in the Directive related to article 66.

The GDPR

The urgency procedure allows a supervisory authority in exceptional circumstances to take an urgent provisional measure, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65,. that is, without requesting the opinion or a binding decision by the Board.

Article 66 provides several categories of urgency procedures which differ according to the intensity of the cooperation between the competent supervisory authority and the European Data Protection Board.

In the first scenario, the national supervisory authority may act a priori on its own.  In exceptional circumstances, where a supervisory authority considers that there is an urgent need to act to protect the rights and freedoms of data subjects, it may adopt provisional measures intended to produce legal effects in its own territory with a specified validity period which shall not exceed three months. However, article 66 does not specify such circumstances or the scope of these measures. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other authorities concerned, to the Board and to the Commission (paragraph 1).

Where a supervisory authority considers that the provisional measures must be extended by final measures, it may request an urgent opinion or an urgent binding decision from the Board. (paragraph 2).

In the second scenario, any supervisory authority may request an urgent opinion or an urgent binding decision from the Board where a competent supervisory authority has not introduced an appropriate measure where there is an urgent need to act, in order to protect the rights and freedoms of data subjects. The supervisory authority must specifically give reasons for requesting such opinion or decision, including reasons for the urgent need to act. This is an original control mechanism for the European authorities, under the aegis of the Board (paragraph 3).

When the notice or a binding decision is urgently requested, paragraph 4 provides reduced delays in which the Board must adopt its opinion or decision. Thus, the Board must adopt its opinion or decision within two weeks by simple majority of the members of the Board.

The Directive

There was no corresponding provision in the regime of the Directive.

Potential issues

Although the principle behind these urgency procedures is excellent, the vagueness of their content and their effects present a risk for creating difficulty during implementation in the internal law. The Member states are required to integrate these procedures into their internal legal system, which runs the risk to create disparities in the effectiveness between the Member States due to these ambiguities and the potential for greatly differing practices.

Nothing is said either on the choice between an opinion or decision of the Board which appear to have the sovereign power of the national control authority. There too, very different practices could emerge depending on the degree of political courage and responsibility of each supervisory authority.

Regulation
1e 2e

Art. 66

1.   In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.

2.   Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision.

3.   Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act.

4.   By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board.

1st proposal close

Art. 61 

1. In exceptional circumstances, where a supervisory authority considers that there is an urgent need to act in order to protect the interests of data subjects, in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded by means of an alteration of the existing state or for averting major disadvantages or for other reasons, by way of derogation from the procedure referred to in Article 58, it may immediately adopt provisional measures with a specified period of validity. The supervisory authority shall, without delay, communicate those measures, with full reasons, to the European Data Protection Board and to the Commission.

2.  Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion of the European Data Protection Board, giving reasons for requesting such opinion, including for the urgency of final measures.

3. Any supervisory authority may request an urgent opinion where the competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the interests of data subjects, giving reasons for requesting such opinion, including for the urgent need to act.

4. By derogation from Article 58(7), an urgent opinion referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the European Data Protection Board.

2nd proposal close

Art. 61 

1. In exceptional circumstances, where a concerned supervisory authority considers that there is an urgent need to act in order to protect rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Article 57 or the procedure referred to in Article 54a, immediately adopt provisional measures intended to produce legal effects within the territory of its own Member State, with a specified period of validity. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them, to the other concerned supervisory authorities, the European Data Protection Board and to the Commission.

2. Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the European Data Protection Board, giving reasons for requesting such opinion or decision.

3. Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the European Data Protection Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act.

4. By derogation from paragraph 7 of Article 58 and paragraph 2 of Article 58a, an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the European Data Protection Board.

 

 

Directive close

No specific provision

France close

Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés

Art. 46

Modifié par la loi n°2018-493 du 20 juin 2018

I. - Lorsque le non-respect des dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi entraîne une violation des droits et libertés mentionnés à l'article 1er de la présente loi et que le président de la commission considère qu'il est urgent d'intervenir, il saisit la formation restreinte, qui peut, dans le cadre d'une procédure d'urgence contradictoire définie par décret en Conseil d'Etat, adopter l'une des mesures suivantes :

1° L'interruption provisoire de la mise en œuvre du traitement, y compris d'un transfert de données hors de l'Union européenne, pour une durée maximale de trois mois, si le traitement n'est pas au nombre de ceux qui intéressent la sûreté de l'Etat ou la défense ou de ceux relevant du chapitre XIII lorsqu'ils sont mis en œuvre pour le compte de l'Etat ;

2° La limitation du traitement de certaines des données à caractère personnel traitées, pour une durée maximale de trois mois, si le traitement n'est pas au nombre de ceux qui intéressent la sûreté de l'Etat ou la défense ou de ceux relevant du même chapitre XIII lorsqu'ils sont mis en œuvre pour le compte de l'Etat ;

3° La suspension provisoire de la certification délivrée au responsable de traitement ou à son sous-traitant ;

4° La suspension provisoire de l'agrément délivré à un organisme de certification ou un organisme chargé du respect d'un code de conduite ;

5° La suspension provisoire de l'autorisation délivrée sur le fondement du III de l'article 54 de la présente loi ;

6° L'injonction de mettre en conformité le traitement avec les obligations résultant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi ou de satisfaire aux demandes présentées par la personne concernée en vue d'exercer ses droits, qui peut être assortie, sauf dans le cas où le traitement est mis en œuvre par l'Etat, d'une astreinte dont le montant ne peut excéder 100 000 € par jour de retard à compter de la date fixée par la formation restreinte ;

7° Un rappel à l'ordre ;

8° L'information du Premier ministre pour qu'il prenne, le cas échéant, les mesures permettant de faire cesser la violation constatée, si le traitement en cause est au nombre de ceux qui intéressent la sûreté de l'Etat ou la défense ou de ceux relevant du chapitre XIII de la présente loi lorsqu'ils sont mis en œuvre pour le compte de l'Etat. Le Premier ministre fait alors connaître à la formation restreinte les suites qu'il a données à cette information au plus tard quinze jours après l'avoir reçue.

II. - En cas de circonstances exceptionnelles prévues au 1 de l'article 66 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, lorsque la formation restreinte adopte les mesures provisoires prévues aux 1° à 4° du I du présent article, elle informe sans délai de la teneur des mesures prises et de leurs motifs les autres autorités de contrôle concernées, le comité européen de la protection des données et la Commission européenne.

Lorsque la formation restreinte a pris de telles mesures et qu'elle estime que des mesures définitives doivent être prises, elle met en œuvre les dispositions du 2 de l'article 66 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité.

III. - Pour les traitements relevant du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité, lorsqu'une autorité de contrôle compétente en application du même règlement n'a pas pris de mesure appropriée dans une situation où il est urgent d'intervenir afin de protéger les droits et libertés des personnes concernées, la formation restreinte, saisie par le président de la commission, peut demander au comité européen de la protection des données un avis d'urgence ou une décision contraignante d'urgence dans les conditions et selon les modalités prévues aux 3 et 4 de l'article 66 dudit règlement.

IV. - En cas d'atteinte grave et immédiate aux droits et libertés mentionnés à l'article 1er de la présente loi, le président de la commission peut en outre demander, par la voie du référé, à la juridiction compétente d'ordonner, le cas échéant sous astreinte, toute mesure nécessaire à la sauvegarde de ces droits et libertés.

Décret d'application. 

CF art. 79 et 80 du décret pris pour l'application de la loi n°78-17 du 6 janvier 1978.

close