The GDPR

The urgency procedure allows a supervisory authority in exceptional circumstances to take an urgent provisional measure, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65,. that is, without requesting the opinion or a binding decision by the Board.

Article 66 provides several categories of urgency procedures which differ according to the intensity of the cooperation between the competent supervisory authority and the European Data Protection Board.

In the first scenario, the national supervisory authority may act a priori on its own.  In exceptional circumstances, where a supervisory authority considers that there is an urgent need to act to protect the rights and freedoms of data subjects, it may adopt provisional measures intended to produce legal effects in its own territory with a specified validity period which shall not exceed three months. However, article 66 does not specify such circumstances or the scope of these measures. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other authorities concerned, to the Board and to the Commission (paragraph 1).

Where a supervisory authority considers that the provisional measures must be extended by final measures, it may request an urgent opinion or an urgent binding decision from the Board. (paragraph 2).

In the second scenario, any supervisory authority may request an urgent opinion or an urgent binding decision from the Board where a competent supervisory authority has not introduced an appropriate measure where there is an urgent need to act, in order to protect the rights and freedoms of data subjects. The supervisory authority must specifically give reasons for requesting such opinion or decision, including reasons for the urgent need to act. This is an original control mechanism for the European authorities, under the aegis of the Board (paragraph 3).

When the notice or a binding decision is urgently requested, paragraph 4 provides reduced delays in which the Board must adopt its opinion or decision. Thus, the Board must adopt its opinion or decision within two weeks by simple majority of the members of the Board.

The Directive

There was no corresponding provision in the regime of the Directive.

Potential issues

Although the principle behind these urgency procedures is excellent, the vagueness of their content and their effects present a risk for creating difficulty during implementation in the internal law. The Member states are required to integrate these procedures into their internal legal system, which runs the risk to create disparities in the effectiveness between the Member States due to these ambiguities and the potential for greatly differing practices.

Nothing is said either on the choice between an opinion or decision of the Board which appear to have the sovereign power of the national control authority. There too, very different practices could emerge depending on the degree of political courage and responsibility of each supervisory authority.

European Union

CJEU caselaw

C-645/19 (15 June 2021) - Facebook Ireland Ltd e.a. c. Gegevensbeschermingsautoriteit

1) Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a supervisory authority of a Member State which, under the national legislation adopted in order to transpose Article 58(5) of that regulation, has the power to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where necessary, to initiate or engage in legal proceedings, may exercise that power in relation to an instance of cross‑border data processing even though it is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, with respect to that data processing, provided that that power is exercised in one of the situations where Regulation 2016/679 confers on that supervisory authority a competence to adopt a decision finding that such processing is in breach of the rules contained in that regulation and that the cooperation and consistency procedures laid down by that regulation are respected.

2) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the lead supervisory authority, to initiate or engage in legal proceedings, within the meaning of that provision, that the controller or processor with respect to the cross-border processing of personal data against whom such proceedings are brought has a main establishment or another establishment on the territory of that Member State.

3) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where appropriate, to initiate or engage in legal proceedings, within the meaning of that provision, may be exercised both with respect to the main establishment of the controller which is located in that authority’s own Member State and with respect to another establishment of that controller, provided that the object of the legal proceedings is a processing of data carried out in the context of the activities of that establishment and that that authority is competent to exercise that power, in accordance with the terms of the answer to the first question referred.

4) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, has brought a legal action, the object of which is an instance of cross-border processing of personal data, before 25 May 2018, that is, before the date when that regulation became applicable, that action may, from the perspective of EU law, be continued on the basis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which remains applicable in relation to infringements of the rules laid down in that directive committed up to the date when that directive was repealed. That action may, in addition, be brought by that authority with respect to infringements committed after that date, on the basis of Article 58(5) of Regulation 2016/679, provided that that action is brought in one of the situations where, exceptionally, that regulation confers on a supervisory authority of a Member State which is not the ‘lead supervisory authority’ a competence to adopt a decision finding that the processing of data in question is in breach of the rules contained in that regulation with respect to the protection of the rights of natural persons as regards the processing of personal data, and that the cooperation and consistency procedures laid down by that regulation are respected, which it is for the referring court to determine.

5) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.

Opinion of Advocate General

Judgment of the Court

Retour au sommaire Retour au sommaire