Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18

2023-04-18T15:01:39Z

1 revision imported: GDPRHUB import 2023 04 18

New page

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 59 GDPR|←]] Article 60 - Cooperation between the lead supervisory authority and the other supervisory authorities concerned [[Article 61 GDPR|→]]
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

== Legal Text ==
<br /><center>'''Article 60 - Cooperation between the lead supervisory authority and the other supervisory authorities concerned'''</center>

<span id="1">1. The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities concerned shall exchange all relevant information with each other.</span>

<span id="2">2. The lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual assistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out investigations or for monitoring the implementation of a measure concerning a controller or processor established in another Member State.</span>

<span id="3">3. The lead supervisory authority shall, without delay, communicate the relevant information on the matter to the other supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory authorities concerned for their opinion and take due account of their views.</span>

<span id="4">4. Where any of the other supervisory authorities concerned within a period of four weeks after having been consulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft decision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in Article 63.</span>

<span id="5">5. Where the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall be subject to the procedure referred to in paragraph 4 within a period of two weeks.</span>

<span id="6">6. Where none of the other supervisory authorities concerned has objected to the draft decision submitted by the lead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.</span>

<span id="7">7. The lead supervisory authority shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.</span>

<span id="8">8. By derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof.</span>

<span id="9">9. Where the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the controller, shall notify it to the main establishment or single establishment of the controller or processor on the territory of its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that complainant and shall inform the controller or processor thereof.</span>

<span id="10">10. After being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the controller or processor shall take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory authorities concerned.</span>

<span id="11">11. Where, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall apply.</span>

<span id="12">12. The lead supervisory authority and the other supervisory authorities concerned shall supply the information required under this Article to each other by electronic means, using a standardised format.</span>

==Relevant Recitals==
{{Recital/124 GDPR}}
{{Recital/125 GDPR}}
{{Recital/130 GDPR}}

== Commentary ==
Article 60 GDPR introduces Chapter VII of the GDPR under the heading “''Cooperation and consistency''” and, in particular, Section 1 of that Chapter, headed “''Cooperation''”. Specifically, Article 60 GDPR regulates the cooperation procedure between the various supervisory authorities (“SA”) in case the rules of Article 56 GDPR apply. In such cases, the SA of the place where the controller's or processor's main establishment is located assumes the role of directing and coordinating the decision-making procedure. In doing so, the lead supervisory authority (“''LSA''”) shall cooperate with the other supervisory authorities concerned in accordance with the principles and rules provided by Article 60 and more generally throughout Chapter VII. The wording of the provision indicates that a LSA has already been identified under Article 56 GDPR and that all the requirements set forth therein are met. <blockquote><u>EDPB Guidelines</u>: on this Article, please see [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-022022-application-article-60-gdpr_en Guidelines 02/2022 on the application of Article 60 GDPR] </blockquote>

=== (1) The Lead Supervisory Authority Shall Cooperate With the Other Supervisory Authorities Concerned ===
The ultimate aim of the cooperation procedure under Article 60 GDPR is to adopt a uniform decision for data processing operations of a cross-border nature. The task of directing or, rather, coordinating the decision-making procedure falls to the LSA. In practice, this translates into three essential (though not exclusive) obligations.

Firstly, as soon as the LSA learns of its responsibility under Article 56(1) GDPR, it must take the initiative and identify the other concerned supervisory authorities (“''CSA''”). In doing so, it is necessary to verify the main elements of the processing and to understand which Member States are likely to be affected by it. In this perspective, it is necessary to verify, for example, in which Member States the data subjects whose rights may be violated are located and/or the locations of the controller's or processor's establishments.

Secondly, after composing the “''decision-making group''”, the LSA is obliged to “''cooperate''” with all other authorities and to facilitate the sharing of information necessary for the decision-making process. (“''exchange'' ''all relevant information with each other''”).<ref>The duty to cooperate, it is argued, is not one-sided but naturally applies also the CSAs. ''Dix,'' in Kühling, Buchner, GDPR BDSG, Article 60 GDPR, margin number 6 (C.H. Beck 2020).</ref> Article 60 GDPR puts a particular focus on the information exchange obligation. Effective Union-wide enforcement requires that all CSAs, including the LSA, receive and share all relevant information on cross-border data processing as promptly as possible. The above stays true even when the identity of the LSA is still unclear as the required exchange of information must take place in any case under Article 61 GDPR and Article 62 GDPR.

Finally, when all the elements for the decision have been gathered, the LSA is obliged to reach a “''consensus''” with the other authorities concerned.<ref>The letter of the law seems to put this obligation specifically on the LSA rather than single CSAs; see ''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (NOMOS 2019).</ref> CSAs shall therefore be given adequate information and sufficient opportunity to present their legal positions (Article 60(3) GDPR), which, as long as possible, shall be incorporated into the LSA’s final assessment.<ref>''Polenz,'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 5 (NOMOS 2019).</ref> The above seems confirmed by Recital 125 GDPR, which specifies that “''the supervisory authority should closely involve and coordinate the supervisory authorities concerned in the decision-making process''”.

=== (2) The Lead Supervisory Authority may Request Cooperation ===
Article 60(2) GDPR presents two further forms of cooperation between the various authorities involved. First, before issuing a binding decision, it may (and usually will) be necessary for the LSA and the CSAs to exercise investigative powers in their territory towards the main branch and the other branches of the controller or processor. To that end, the LSA may request other CSAs to provide mutual assistance pursuant to Article 61 GDPR and conduct joint operations pursuant to Article 62 GDPR. Second, cooperation may also be requested in later procedural steps for “''monitoring the implementation of a measure concerning a controller or processor established in another Member State''”.<ref>''Polenz,'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 8 (NOMOS 2019).</ref> Once the decision has been adopted, it must also be ensured that it is actually complied with. In this sense, the local CSAs closest to the place of the breach must verify that the controller or processor complies with the content of the decision and brings data processing into compliance with the GDPR.

=== (3) Draft Decision and Relevant Reasoned Objection ===
Article 60(3) GDPR sets out the procedural background of the cooperation mechanism.<ref>Paragraphs 3 to 10 contain a completely new, relatively complex two-phases decision-making procedure. The first (or preparatory) phase regulates how information, draft decisions and objections are exchanged among authorities (paragraphs 3 to 6). The second phase, which consists of the actual decision-making stage (including enforcement, paragraphs 6 to 10); see ''Polenz,'' in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 60 GDPR, margin number 9 (NOMOS 2019).</ref> The LSA communicates the relevant information on the matter to the other CSAs and, without delay, provides them with a draft decision for their opinion, which shall be taken into “''due account''”. In other words, under Article 60(1) GDPR, the LSA must adequately address the positions of the other SAs and integrate them into the decision-making process.

==== CSA’s Objection ====
Under Article 4(24) GDPR, any CSA can submit an “''objection to a draft decision''” which must be “''relevant and reasoned''” and focuses on “''whether there is an infringement of this Regulation, or whether envisaged action in relation to the controller or processor complies with this Regulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the fundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the Union''”.<ref>The EDPB provided guidance for the notion of the terms “''relevant and reasoned''”, including what should be considered when assessing whether an objection “''clearly demonstrates the significance of the risks posed by the draft decision''”. See EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, 8 October 2020 (available [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-092020-relevant-and-reasoned_en here]).</ref> An objection submitted by a CSA should indicate each part of the draft decision that is considered deficient, erroneous or lacking some necessary elements, either by referring to specific articles/paragraphs or by other clear indication and showing why such issues are to be deemed “''relevant''” as further explained below. Therefore, the objection aims, first of all, at pointing out how and why according to the CSA the draft decision does not appropriately address the situation and/or does not envision appropriate action towards the controller or processor. The proposals for amendments put forward by the objection should aim to remedy these errors.

===== Relevant =====
For the objection to be considered as “''relevant''”, there must be a direct connection between the objection and the draft decision at issue. More specifically, the objection needs to concern either whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR. An objection should only be considered relevant if it relates to the specific legal and factual content of the draft decision. Raising only abstract or broad comments or objections cannot be considered relevant in this context.<ref>EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, 8 October 2020, p. 5 (available [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-092020-relevant-and-reasoned_en here]).</ref>

===== Reasoned =====
In order for the objection to be “''reasoned''”, it needs to include clarifications and arguments as to why an amendment of the decision is proposed (i.e. the alleged legal/factual mistakes of the draft decision). It also needs to demonstrate how the change would lead to a different conclusion as to whether there is an infringement of the GDPR or whether the envisaged action in relation to the controller or processor complies with the GDPR.

The CSA should provide sound reasoning for its objection, particularly by reference to legal arguments (relying on EU law and/or relevant national law and including e.g. legal provisions, guidelines, case law) or factual arguments, where applicable. The CSA should present the fact(s) allegedly leading to a different conclusion regarding the infringement of the GDPR by the controller/processor or the aspect of the decision that, in their view, is deficient/erroneous.

In order for an objection to be adequately reasoned, it should be coherent, clear, precise and detailed in explaining the reasons for objection. It should set forth, clearly and precisely, the essential facts on which the CSA based its assessment and the link between the envisaged consequences of the draft decision (if it was to be issued “as is”) and the significance of the anticipated risks. Moreover, the CSA should indicate which parts of the draft decision it disagrees with. In cases where the objection is based on the opinion that the LSA failed to investigate an essential fact of the case entirely, or on an additional violation of the GDPR, it would be sufficient for the CSA to present such arguments in a conclusive and substantiated manner.<ref>EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, 8 October 2020, pp. 5-6 (available [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-092020-relevant-and-reasoned_en here]).</ref>

===== Infringement of the GDPR =====
The CSA’s objections to the draft decision must be justified and motivated through reference to evidence and facts that support the objection, by having regard to the facts and evidence<ref>The "''relevant information''" referred to in Article 60(3) GDPR.</ref> provided by the LSA. These requirements should apply to each specific infringement and to each specific provision in question (e.g.if the draft decision says that the controller infringed [[Article 6 GDPR|Articles 6, 7, 14 GDPR]], and the CSA disagrees on whether there is an infringement of [[Article 7 GDPR|Article 7, 14 GDPR]] and considers that there is an infringement of [[Article 13 GDPR]]). In some circumstances, the objection could go as far as identifying gaps in the draft decision justifying the need for further investigation by the LSA. For instance, if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised by the complainant or resulting from an infringement reported by a CSA, a relevant and reasoned objection may be raised based on the failure of the LSA to handle the complaint properly and in safeguarding the rights of the data subject.<ref>EDPB, Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679, 8 October 2020 (available [https://edpb.europa.eu/our-work-tools/documents/public-consultations/2020/guidelines-092020-relevant-and-reasoned_en here]).</ref><blockquote><u>EDPB Guidelines:</u> On this provision there are [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-092020-relevant-and-reasoned-objection-under_en the Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679]</blockquote>

=== (4) Objection is Rejected ===
If the LSA does not follow the relevant and reasoned objection(s) or believes that the objection(s) is not reasoned or relevant, the matter is referred to the attention of the EDPB which will decide it following [[Article 63 GDPR]] and [[Article 65 GDPR|Article 65(1)(a) GDPR]]. It then becomes incumbent upon the Board to adopt a binding decision on whether the objection is “''relevant and reasoned''” and, in general, if it meets the requirements outlined in [[Article 4 GDPR|Article 4(24) GDPR]].<blockquote><u>EDPB Guidelines:</u> On this provision there are [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-092020-relevant-and-reasoned-objection-under_en the Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679]</blockquote>

=== (5) Objection Is Accepted ===
Where the LSA intends to follow one or more relevant and reasoned objections made by one or more CSAs, it shall submit to the other supervisory authorities concerned a revised draft decision for their opinion as foreseen in Article 60(4) GDPR. However, in this case, the CSAs only have two weeks to express their opinion.

=== (6) Agreement on the Draft Decision ===
Where none of the other CSAs has objected to the draft decision submitted by the LSA within the period referred to in Article 60(4) and (5) GDPR, the LSA and the CSAs shall be deemed to agree with that draft decision and shall be bound by it. In this case, the decision becomes final.

=== (7) Notification of the Final Decision ===
The LSA shall adopt and notify the decision to the main establishment or single establishment of the controller or processor, as the case may be, and inform the other CSAs and the EDPB about the decision, including a summary of the relevant facts and grounds. The SA with which a complaint has been lodged shall inform the complainant on the decision.

=== (8) Dismissal ===
By derogation from Article 60(7) GDPR, where a complaint is dismissed or rejected, the SA with which the complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller thereof. This provision facilitates the data subject who might intend to file an appeal before a national court.

=== (9) Partial Dismissal ===
Where the LSA and the CSAs agree to dismiss or reject parts of a complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of the matter. On the one hand, the LSA adopts the decision for the part concerning actions about the controller, notifies it to the main establishment or single establishment of the controller or processor on the territory of its Member State and informs the complainant. On the other hand, the SA of the complainant adopts the decision for the part concerning dismissal or rejection, notifies it to the complainant and informs the controller or processor.

=== (10) Enforcement ===
After being notified of the decision of the LSA according to Article 60(7) and (9) GDPR, the controller or processor shall take the necessary measures to ensure compliance for all its establishments in the Union. The controller or processor shall notify the measures taken for complying with the decision to the LSA, which shall inform the other CSAs.

=== (11) Urgency procedure ===
Where, in exceptional circumstances, a CSA has reasons to consider that there is an urgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 GDPR shall apply.

=== (12) Forms of Communication: Electronic Means and Standardised Format ===
The LSA and the other CSAs shall supply the information required under Article 60 GDPR to each other by electronic means, using a standardised format. Since May 2018, “''the Board and DPAs have been using the IMI case registry, in which cases with a cross-border component are normally logged in.45 In due course the European Commission is empowered to draw up a standardised format (see Article 61(9)).46 The existence of a standardised format may partially alleviate the administrative burdens and costs linked with the exchange of documents (e.g. translations), which may nonetheless remain substantial''”.<ref>''Tosoni'', in Kuner et al, The EU General Data Protection Regulation (GDPR): A Commentary, p. 969 (Oxford University Press 2020).</ref>

== Decisions ==
→ You can find all related decisions in [[:Category:Article 60 GDPR]]

== References ==
<references />

[[Category:GDPR Articles]]

Article 60 GDPR - Revision history

Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18