Why Article 64(2) of the GDPR has become a problematic enforcement mechanism

Art. 64(2) GDPR is really problematic. It’s a horrendous mechanism, as currently applied by data protection authorities and the EDPB:
– If a supervisory authority (SA) thinks something is important it can ask an Opinion from the EDPB, which has 8 weeks (+ 6, so 14 in total, in complex cases) to respond. Not much time for important issues if the EDPB is going to play lawmaker.

– Opinions are de facto binding upon *all* SAs (see Art. 65(1)(c) GDPR), given that not following them allows the Commission or “any supervisory authority concerned” (defined under the GDPR) to “communicate the matter to the [EDPB]” and trigger a binding decision procedure. And we can guess how likely the EDPB is to backtrack on something that it has already said in an Opinion, especially given Art. 64(3) GDPR (“the Board shall issue an opinion […] provided that it has not already issued an opinion on the same matter”).
[See why I say the EDPB is playing lawmaker?]

– Plus, if a SA blindly follows an EDPB Opinion, will a national court’s decision overturning the SA’s decision ever lead the EDPB to self-reflect regarding that Opinion, also given Art. 64(3) GDPR? What is the procedure for getting rid of an Opinion and replacing it altogether?

– For its two most recent Art. 64(2) Opinions, 08/2024 (Consent or Pay) & 11/2024 (facial recognition to streamline airport passengers’ flow) – both in my view fundamentally flawed, procedurally and in terms of content (see notably https://lnkd.in/eddQ4yW8 ) – the EDPB *did not* consult with any controller or processor likely to be affected by those Opinions, despite a clear obligation under Art. 70 GDPR to “where appropriate, consult interested parties and give them the opportunity to comment within a reasonable period”.

Why wouldn’t it be appropriate to check with someone what their arguments might be before you say something they do is (very likely) a GDPR infringement?

The EDPB even refers in its Rules of Procedure to “independence and impartiality” and “good governance, integrity and good administrative behaviour” as guiding principles for the EDPB. Aspirational principles only then?

– Of course 14 weeks isn’t a lot of time, but for guidelines the EDPB has often applied a deadline of 4-6 weeks for consultations.

– Yet if a contemplated approach leads to lots of comments/pushback (you know, after first *considering* a consultation), what would prevent the EDPB from adopting a tamer Opinion that doesn’t take a definite position but refers to Guidelines that will be adopted at a later stage?

EDPB Opinions are not untouchable, and the data litigator in me encourages all affected to challenge the thought that the EDPB is unaccountable. We have been helping a few controllers, processors and their federations to figure out the next move. What will yours be?

[A debate on the use & handling of Art. 64(2) Opinion requests was on the agenda for the EDPB’s meeting of 19 June 2024. I’m keen to read the Minutes!]

privacy