menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Hungary) language
Contact our local member in Hungary mail_outline
Visit the website of Oppenheim account_balance

arrow_backPrevious Article
Article 61
Next Articlearrow_forward

Mutual assistance

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 61 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 61 keyboard_arrow_up

Key words related to article 61

Show the recitals of the Regulation related to article 61 keyboard_arrow_down Hide the recitals of the Regulation related to article 61 keyboard_arrow_up

(5) The economic and social integration resulting from the functioning of the internal market has led to a substantial increase in cross-border flows of personal data. The exchange of personal data between public and private actors, including natural persons, associations and undertakings across the Union has increased. National authorities in the Member States are being called upon by Union law to cooperate and exchange personal data so as to be able to perform their duties or carry out tasks on behalf of an authority in another Member State.

(133) The supervisory authorities should assist each other in performing their tasks and provide mutual assistance, so as to ensure the consistent application and enforcement of this Regulation in the internal market. A supervisory authority requesting mutual assistance may adopt a provisional measure if it receives no response to a request for mutual assistance within one month of the receipt of that request by the other supervisory authority.

Show the recitals of the Directive related to article 61 keyboard_arrow_down Hide the recitals of the Directive related to article 61 keyboard_arrow_up

(64) Whereas the authorities in the different Member States will need to assist one another in performing their duties so as to ensure that the rules of protection are properly respected throughout the European Union;

The GDPR

The objective of the European legislature is to set explicit and consistent rules on mandatory mutual assistance between supervisory authorities and to oversee the penalties in cases of failure to comply with a request from another supervisory authority.

Article 61, paragraph 1 introduces the general principle that the supervisory authorities should share all useful information and help each other to ensure a consistent application of EU rules. Mutual assistance shall cover, in particular, information requests and supervisory measures for instance prior authorizations and consultations, inspections and investigations.

Each supervisory authority shall take all appropriate measures required to reply to a request from another supervisory authority without undue delay and no later than one month after receiving the request (paragraph 2). In order to be eligible, requests for assistance must satisfy paragraph 3, that the requests contain all the necessary information including the purpose of and reasons for the request and that the information exchanged shall be used only for the purpose for which it was requested. 

Paragraph 4 lists exhaustively the only two acceptable reasons for which a national authority may refuse to comply with a request for assistance. It rests on the competence of the authority to handle the subject-matter of the request or the measures it is requested to execute (a); where the request for assistance in incompatible with the Regulation or Union or Member State law to which the supervisory authority receiving the request is subject (b). In the case of refusal, the requested supervisory authority shall provide reasons for their decision (paragraph 5).

The requesting supervisory authority shall be informed of the results or, as the case may be, of the progress of the measures taken in order to respond to the request (paragraph 5).

Article 61 also defines the modes for communication between authorities; in principle the information requested must be delivered by electronic means, using a standard form. It follows in paragraph 7 that supervisory authorities are to provide the mutual assistance free of charge however the parties may agree indemnify each other for specific expenditure but only in exceptional circumstances (paragraph 5). 

Where a supervisory authority does not provide the information within one month of receiving the request, the requesting supervisory authority may adopt a provisional measure in the territory of its Member State in accordance with Article 55. In this scenario, the urgent need to act under Article 66 shall be presumed met and require an urgent binding decision from the European Data Protection Board pursuant to Article 66 (2).

Finally, it should be noted that the Commission may, by means of implementing acts, specify the standardized format and procedures for mutual assistance and the arrangements for the exchange of information by electronic means between supervisory authorities, with the Board and in accordance with the examination procedure referred to in Article 93 (2).

The Directive

Under the Directive, the Member States were already required to help each other to fulfil their tasks and ensure full compliance with the data protection rules. So, Article 28 (6) of the Directive provides for the supervisory authorities to mutually cooperate to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

Potential issues

We do not see a priori any specific implementation difficulties.

arrow_back Previous Article • Article 61 • Next Article arrow_forward
arrow_back Previous Article • Article 61 Next Article arrow_forward
arrow_back Previous Article • Article 61 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-230/14 (1 october 2015) Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 61 Next Article arrow_forward
Regulation
1e 2e

Art. 61

1.   Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations.

2.   Each supervisory authority shall take all appropriate measures required to reply to a request of another supervisory authority without undue delay and no later than one month after receiving the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation.

3.   Requests for assistance shall contain all the necessary information, including the purpose of and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.

4.   The requested supervisory authority shall not refuse to comply with the request unless:

(a)

it is not competent for the subject-matter of the request or for the measures it is requested to execute; or

(b)

compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.

5.   The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority shall provide reasons for any refusal to comply with a request pursuant to paragraph 4.

6.   Requested supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.

7.   Requested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for mutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.

8.   Where a supervisory authority does not provide the information referred to in paragraph 5 of this Article within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need to act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant to Article 66(2).

9.   The Commission may, by means of implementing acts, specify the format and procedures for mutual assistance referred to in this Article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board, in particular the standardised format referred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).
1st proposal close

Art. 55

1.           Supervisory authorities shall provide each other relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective co-operation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and prompt information on the opening of cases and ensuing developments where data subjects in several Member States are likely to be affected by processing operations.

2.           Each supervisory authority shall take all appropriate measures required to reply to the request of another supervisory authority without delay and no later than one month after having received the request. Such measures may include, in particular, the transmission of relevant information on the course of an investigation or enforcement measures to bring about the cessation or prohibition of processing operations contrary to this Regulation.

3.           The request for assistance shall contain all the necessary information, including the purpose of the request and reasons for the request. Information exchanged shall be used only in respect of the matter for which it was requested.

4.           A supervisory authority to which a request for assistance is addressed may not refuse to comply with it unless:

(a)     it is not competent for the request; or

(b)     compliance with the request would be incompatible with the provisions of this Regulation.

5.           The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress or the measures taken in order to meet the request by the requesting supervisory authority.

6.           Supervisory authorities shall supply the information requested by other supervisory authorities by electronic means and within the shortest possible period of time, using a standardised format.

7.           No fee shall be charged for any action taken following a request for mutual assistance.

8.           Where a supervisory authority does not act within one month on request of another supervisory authority, the requesting supervisory authorities shall be competent to take a provisional measure on the territory of its Member State in accordance with Article 51(1) and shall submit the matter to the European Data Protection Board in accordance with the procedure referred to in Article 57.

9.           The supervisory authority shall specify the period of validity of such provisional measure. This period shall not exceed three months. The supervisory authority shall, without delay, communicate those measures, with full reasons, to the European Data Protection Board and to the Commission.

10.         The Commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the European Data Protection Board, in particular the standardised format referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
2nd proposal close

Art. 55

1. Supervisory authorities shall provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner, and shall put in place measures for effective co-operation with one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as requests to carry out prior authorisations and consultations, inspections and investigations. (...)

2. Each supervisory authority shall take all appropriate measures required to reply to the request of another supervisory authority without undue delay and no later than one month after having received the request. Such measures may include, in particular, the transmission of relevant information on the conduct of an investigation (…).

3. The request for assistance shall contain all the necessary information, including the purpose of the request and reasons for the request. Information exchanged shall be used only for the purpose for which it was requested.

4. A supervisory authority to which a request for assistance is addressed may not refuse to comply with it unless:

(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute;

or (b) compliance with the request would be incompatible with the provisions of this Regulation or with Union or Member State law to which the supervisory authority receiving the request is subject.

5. The requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case may be, of the progress or the measures taken in order to respond to the request. In cases of a refusal under paragraph 4, it shall explain its reasons for refusing the request.

6. Supervisory authorities shall, as a rule, supply the information requested by other supervisory authorities by electronic means, using a standardised format.

7. No fee shall be charged for any action taken following a request for mutual assistance. Supervisory authorities may agree with other supervisory authorities rules for indemnification by other supervisory authorities for specific expenditure arising from the provision of mutual assistance in exceptional circumstances.

8. Where a supervisory authority does not provide the information referred to in paragraph 5 within one month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a provisional measure on the territory of its Member State in accordance with Article 51(1) and shall submit the matter to the European Data Protection Board (…) in accordance with the consistency mechanism referred to in Article 57.

9. The supervisory authority shall specify the period of validity of such a provisional measure which shall not exceed three months. The supervisory authority shall, without delay, communicate such a measure, together with its reasons for adopting it, to the European Data Protection Board (…) in accordance with the consistency mechanism referred to in Article 57.

10. The Commission may specify the format and procedures for mutual assistance referred to in this article and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the European Data Protection Board, in particular the standardised format referred to in paragraph 6. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 87(2).
Directive close

Art. 28

(...).

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

(...). 
Hungary
compare_arrows
visibility Old law

65. § *  (1) Harmadik országok hatóságaival és nemzetközi szervezetekkel a Hatóság - különösen az általános adatvédelmi rendelet 50. cikkében és a 2016/680 (EU) irányelv 40. cikkében meghatározottak szerint, az ott előírt módon - együttműködik.

(2) Az (1) bekezdésben foglalt együttműködés keretében a Hatóság jogsegély érdekében harmadik ország hatóságához vagy nemzetközi szervezethez fordulhat, és - a 67. §-ban foglalt kivétellel - teljesíti a harmadik ország hatóságától vagy nemzetközi szervezettől érkező jogsegélykérelmet, ha a harmadik ország vagy nemzetközi szervezet és Magyarország közötti közigazgatási jogsegélyegyezmény, más nemzetközi szerződés, jogszabály vagy az Európai Unió jogi aktusa ezt lehetővé teszi.

66. § *  A Hatóság megtagadja a harmadik ország hatóságától vagy nemzetközi szervezettől érkező jogsegélykérelem teljesítését és a megtagadás indokairól tájékoztatja a harmadik ország hatóságát, illetve a nemzetközi szervezetet, ha a jogsegélykérelem teljesítése

a) nem tartozik a feladat- és hatáskörébe,

b) sértené Magyarország nemzetbiztonsági érdekeit vagy a közbiztonságot,

c) sértené az ügyben érintett személy alapvető jogát, vagy

d) jogszabályba ütközne.

67. § *  (1) EGT-állam felügyeleti hatóságaival a Hatóság az Európai Unió kötelező jogi aktusában meghatározott módokon, így különösen az általános adatvédelmi rendelet 61. cikkében és a 2016/680 (EU) irányelv 50. cikkében meghatározott kölcsönös segítségnyújtás keretei között, az ott előírt módon együttműködik.

(2) Az általános adatvédelmi rendelet 62. cikkében meghatározott módon, az EGT-állam felügyeleti hatóságával közösen végzett műveletek során

a) a Hatóság személyi állományába tartozó, a Hatóság elnöke által a közös műveletben való közreműködésre kijelölt köztisztviselő a más EGT-állam területén, a más EGT-állam felügyeleti hatósága által átruházott feladat- és hatáskörök,

b) a más EGT-állam felügyeleti hatósága feladat- és hatáskörében eljáró és e felügyeleti hatóság által kijelölt személy Magyarország területén a Hatóság elnöke által írásban meghatározott terjedelemben a Hatóság feladat- és hatáskörének

gyakorlásában közreműködik.

(3) A (2) bekezdés b) pontjában meghatározott személy eljárására a magyar jog az irányadó.

68. § *  Ha a harmadik ország vagy más EGT-állam hatóságától, illetve nemzetközi szervezettől érkező - a Hatóság folyamatban lévő eljárásához közvetlenül nem kapcsolódó - megkeresés teljesítéséhez adatok, iratok beszerzése, vagy más eljárási cselekmény lefolytatása szükséges, a Hatóság e célból hatósági ellenőrzést végez. Ilyen esetben az ellenőrzés a Hatóságnak a beszerzett bizonyítékok átadásáról szóló végzésével zárul.
Old law close

See Article 60: LINK
arrow_back Previous Article • Article 61 Next Article arrow_forward
close

2016 - www.itiplaw.eu.