How does cross-border cooperation work under the GDPR?
The General Data Protection Regulation (GDPR) requires the Data Protection Authority (DPA) of the European Economic Area (EEA) to cooperate closely - under the umbrella of the European Data Protection Board (EDPB) - to ensure the consistent application of the GDPR and the protection of individuals’ data protection rights across the EEA. One of their tasks is to coordinate decision-making in cross-border data processing cases. A processing is cross-border when:
data processing takes place in more than one country;
or it substantially affects or it is likely to substantially affect individuals in more than one country.
Under the so-called one-stop-shop mechanism Art. 60 GDPR, the Lead Supervisory Authority (LSA) acts as the main point of contact for the controller or processor for a given processing, while the Concerned Supervisory Authorities (CSAs) act as the main point of contact for individuals in the territory of their Member State. The LSA is the authority in charge of leading the cooperation process. It will share relevant information with the CSAs, carry out the investigations, prepare the draft decision relating to the case, and cooperate with the other CSAs in an endeavour to reach consensus on this draft decision.
I have received a communication from someone claiming to be working for the EDPB informing me that I am not in compliance with the GDPR, is this something the EDPB does?
Please note that the EDPB does not contact individuals, via phone or other means of communication, to inform them of such matters.
Therefore, it could be that the call you received represents a phishing attack targeting you abusing our name.
I submitted feedback to a public consultation, but I cannot see my comments on the public consultation page. How do I know that my feedback was received by the EDPB?
All comments submitted are screened and reviewed manually before being displayed on our website. There should have been a visual confirmation after submitting your comments on our website.
In any case, please allow for some time before your comments are published.
I think my data protection rights have been violated, what can I do?
If you believe your data protection rights have been violated you can contact the organisation holding your data, contact your national data protection authority (DPA), or go to a national court.
DPAs can conduct investigations and impose sanctions where necessary. You can find the contact details for all EEA DPAs here.
I wish to lodge a complaint with a data protection authority (DPA), which authority should I contact?
Under the GDPR, you have the right to lodge a complaint with the Data Protection Authority (DPA) in the country of:
your habitual residence;
your place of work; or
the place where the alleged infringement took place.
In which cases is the dispute resolution mechanism of Art. 65.1 (c) GDPR triggered?
While Art. 65 (a) and (b) relate to the one-stop-mechanism, Art.65.1 (c) GDPR concerns obligations of Data Protection Authorities (DPAs) stemming from the consistency mechanism.
More specifically, every competent DPA has the duty to request an opinion from the EDPB before adopting national measures pursuant to article 64.1 GDPR. Such measures include lists of processing operations for which a Data Protection Impact Assessment (DPIA) is required, or the approval of a new set of standard clauses. In addition, under Art. 64.2 GDPR, any SA may also request an EDPB consistency opinion on any matter of general application or producing effects in more than one Member State.
If an DPA does not request the opinion of the EDPB for the cases listed under Art. 64.1 GDPR or does not follow the EDPB opinion issued under Art. 64 GDPR, any DPA and the European Commission can launch the dispute resolution procedure of Art. 65.1 (c) GDPR about the matter.
Is the guidance adopted by the Article 29 Working Party (WP29) still relevant today?
The EDPB endorsed WP29 documents are available here.
As regards the other existing WP29 documents, they may remain relevant and helpful insofar as the EDPB has not adopted new documents on the topic and/or they are compatible with the GDPR. This amounts to a case-by-case assessment.
My organisation would like to become a certification body, how can we become accredited?
Certification bodies are accredited by the national data protection authorities (DPA) or by the national accreditation body (named in accordance with Regulation 17065/2012). For further information regarding certification bodies, we recommend contacting the national DPA in your country. You can find an overview of all EEA DPAs here.
The dispute resolution mechanism of Art. 65 GDPR has been triggered - what happens next?
Within one month from the referral of the subject matter, the EDPB must adopt a decision by a two-thirds majority.
The one-month deadline to adopt this binding decision can be extended by another month, if the case is complex. When the EDPB is not able to reach a decision within the abovementioned period, the decision must be adopted by a simple majority within two additional weeks. Should the members of the EDPB be split, the decision will be adopted by the vote of the EDPB Chair.