Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18

2023-04-18T15:01:39Z

1 revision imported: GDPRHUB import 2023 04 18

New page

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 60 GDPR|←]] Article 61 - Mutual assistance [[Article 62 GDPR|→]]
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

== Legal Text ==
<br /><center>'''Article 61 - Mutual Assistance'''</center>

<span id="1">1. Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.</span>

<span id="2">2. Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation.</span>

<span id="3">3. Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.</span>

<span id="4">4. The requested supervisory authority shall not refuse to comply with the request unless:</span>

::<span id="4a">(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or</span>

::<span id="4b">(b) compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.</span>

<span id="5">5. The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4.</span>

<span id="6">6. Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.</span>

<span id="7">7. Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.</span>

<span id="8">8. Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2).</span>

<span id="9">9. The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).</span>

==Relevant Recitals==
{{Recital/119 GDPR}}{{Recital/123 GDPR}}{{Recital/133 GDPR}}

== Commentary ==

Article 61(1) GDPR regulates how independent authorities are to cooperate to enable the uniform application of the GDPR. Supervisory authorities (“''SA''”) must share any relevant information and, where requested, provide mutual assistance in relation to the carrying out of certain investigations or acts of investigation. Article 61(2) GDPR requires SAs to have appropriate organisational and technical measures in place to respond promptly to mutual assistance requests made in accordance with certain standards of clarity (Article 61(3) GDPR). Requests are imperative and, subject to specific exceptions (Article 61(4) and (5) GDPR), must be fulfilled and, as a rule, acknowledged electronically (Article 61(7) GDPR) and free of charge (Article 61(7) GDPR). Finally, where the requested activity is not carried out, the national SA is given the possibility of adopting measures that have legal effects on the territory of its Member State (Article 61(8) GDPR).

=== (1) Mutual Assistance to Implement and Apply the GDPR in a Consistent Manner ===
The ultimate goal of the mutual assistance under Article 61 GDPR is to "''implement and apply'' [the] ''Regulation in a consistent manner''". SAs "''provide each other with relevant information''" and "''mutual assistance''". By using the conjunction "''and''", the lawmaker seems to suggest that "''information''" and "''mutual assistance''" are alternative. Such conclusion should be rejected because "''relevant information''" is only a tool to achieve "''mutual assistance''".<ref>It is therefore a simple case of poor legislative technique. See, ''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 61 GDPR, margin number 7 (C.H. Beck 2019, 1st ed.)</ref> Other activities enabling real cooperation among SAs are "''supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations''".<ref>''Polenz'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 61 GDPR, margin number 7 (Beck 2019, 1st ed.), who clarifies that the requested SA can be asked, for example, to exercise authorisation under Article 58(3) or to carry out investigations in the form of data protection reviews in accordance with Article 58(1)(b) GDPR.</ref>

=== (2) SAs Must Act on the Assistance Request ===
Article 61(2) GDPR requires SAs to take all necessary measures to respond to requests for mutual assistance made by other SAs. This means, first of all, that the receiving SA is required to have adequate organisational measures in place to process the request internally and to follow it up fully, by any action deemed necessary. The request must also be responded to in a timely manner. In particular, the requested SA shall reply without delay and, in any event, no later than one month after receipt of the request. The wording indicates that, in principle, the answer shall not consist of a mere update but rather the outcome of the requested activities. However, it seems entirely foreseeable that the deadline will not be met in some cases, especially if the requested activities involve dealing with third parties or complex investigation operations.<ref>''Körffer'' in Paal, Pauly, DS-GVO BDSG, Article 61 GDPR, margin number 4 (Beck 2021, 3rd ed.).</ref>

=== (3) Requirements and Limits of the Assistance request ===
The request for administrative assistance must contain all the information necessary to enable the requested SA to comply with it without delay. The GDPR stipulates that the information includes the purpose and reasons for the request. Therefore, the requested information must be tailored to the subject matter of the request and can only be used in context of that request. However, scholars suggest that the requirement should not be interpreted in an overly restrictive fashion. For example, the request (and the information it implies) may well trigger ex-officio investigations (on both sides).<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 12 (Beck 2020, 3rd ed.).</ref>

=== (4) Exceptions ===
The requested SA shall not refuse to comply with the request unless (a) it is not competent for the subject matter of the request or for the measures it is requested to execute, or (b) compliance with the request would infringe the GDPR or Union or Member State law to which the SA receiving the request is subject. Some authors convincingly argue that letter (b) contains letter (a) because the competence of the SA is regulated either by European or national law.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 13 (Beck 2020, 3rd edition).</ref> Therefore, a request for administrative assistance may only be refused if the requested SA is forced to act unlawfully, either under Union or domestic legislation. However, the domestic law that limits the obligation to provide administrative assistance must, for its part, conform with Union law. In particular, the regulation does not authorise the Member States to create further grounds for refusing administrative assistance.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 61 GDPR, margin number 13 (Beck 2020, 3rd edition).</ref> In any case, according to paragraph 5 below, the requested SA shall provide reasons for any refusal to comply with a request under paragraph 4.

=== (5) Constant Updates are Required following the Request ===
Article 61(5) GDPR seems to require the requested SA to communicate the results of the request or, if not possible (see paragraph 2 above), at least an update on the progress of the procedure, in particular by making clear which "''measures'' [have been] ''taken in order to respond''".<ref>On this point, we would like to point out that, unlike what happens in Article 57(f) GDPR, under which the data subject is entitled to know the "progress and the outcome of the investigation", Article 61 GDPR seems to require higher-level accountability for inter-SAs communications.</ref> Article 61(5)(2) GDPR imposes an obligation on the requested SA to give reasons if a request for administrative assistance is rejected. The mere assertion of a possible legal violation is not sufficient in this respect. Rather, the requested SA must substantiate why it cannot comply with the request. In the event of rejection due to lack of competence, the principle of genuine cooperation between the SAs requires the requested authority to inform the requesting authority of the competent authority.<ref>''Peuker'' in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 39 (Beck 2018, 2nd edition).</ref>

=== (6) Modalities and Other Aspects ===
Article 61(6) GDPR sets out the principle of electronic communication between the SAs without excluding other forms of communication ("''as a rule''"). In urgent cases, for example, information can also be transmitted by telephone or by other means.

=== (7) Fees ===
Mutual assistance requests shall be carried out free of charge. The idea behind the exemption from fees is that the proper implementation of Union law is a matter of common interest (Article 197(1) TFEU). It is argued that costs for administrative assistance of the individual Member States converge or offset each other in the long term. Therefore, mutual invoicing of individual administrative assistance would only generate additional administrative effort, but no additional income.<ref>''Peuker'' in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 42 (Beck 2018, 2nd edition).</ref> However, in exceptional circumstances, SAs can arrange agreements to indemnify each other for specific expenditures arising from the provision of mutual assistance. These include, for example, expenses for experts or interpreters or expenses in the event of particular difficulties with administrative assistance.<ref>''Peuker'' in Sydow, Europäische Datenschutzgrundverordnung, Article 61 GDPR, margin number 44 (Beck 2018, 2nd edition).</ref>

=== (8) Inaction of the Requested Authority ===
According to Article 61(8)(1) GDPR, if, within one month of receiving the request, the requested SA does not inform the requesting SA of the results or, as the case may be, of the progress of the measures taken in order to respond to the request (Article 61(5) GDPR), the requesting SA may adopt a provisional measure on the territory of its Member State under Article 55(1) GDPR. If the SA does not meet the deadline, the consequences seem to be two, both of them derogatory to the standard procedure set forth by Article 66 GDPR. First, the SA does not have to prove the urgency required by Article 66(1) GDPR for "''normal''" urgency cases (the urgency "''shall be presumed''"). Second, the provisional measure will be subject to an "''urgent binding decision from the Board''". This second consequence is also exceptional because, as opposed to Article 66(2) GDPR, under which the SA may request either a binding or non-binding decision from the EDPB, in this case, there is no choice: there will be an assessment by the EDPB the outcome of which will be binding.

=== (9) Implementing Acts by the Commission ===
The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in Article 61 GDPR and the arrangements for the exchange of information by electronic means between supervisory authorities, and between SAs and the Board, in particular, the standardised format referred to in Article 61(6) GDPR. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2) GDPR.

== Decisions ==
→ You can find all related decisions in [[:Category:Article 61 GDPR]]

== References ==
<references />

[[Category:Article 61 GDPR]] [[Category:GDPR Articles]]

Article 61 GDPR - Revision history

Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18