In cross-border cases, supervisory authorities (SAs) have to cooperate in order to ensure a consistent application of the GDPR.
The Lead Supervisory Authority (LSA) has to cooperate with the other supervisory authorities in an endeavour to reach consensus.
In this case, the so-called consistency mechanism can be triggered. Under this mechanism the European Data Protection Board (EDPB) issues opinions or, in case of dispute between national data protection authorities, issues binding decisions to arbitrate.
In the cooperation phase, it is the Lead Supervisory Authority that acts as the main point of contact for the controller and processor and drafts a decision. The LSA needs to submit a draft decision to the SAs concerned. The SAs concerned can express relevant and reasoned objections to the draft decision, the LSA can decide to follow or not to follow the objection.
When none of the SAs concerned objects, they shall be deemed in agreement with the draft decision.
If the LSA intends to follow the objection, it shall submit a revised draft decision to the other SAs concerned.
If the LSA has rejected a reasonable or relevant objection, the case is referred to Board (Art. 65 –Dispute resolution by the Board). The Board then issues a binding decision. The LSA shall adopt its final decision on the basis of the Board’s binding decision.
The Internal Market Information System (IMI) is the IT platform chosen to support cooperation and consistency procedure under the GDPR.
The so-called consistency mechanism can also be triggered to ask the Board to issue an opinion, as regards a draft decision submitted by a supervisory authority or following a request concerning a matter of general application or producing effects in more than one Member State.