Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated textCurrent language: EN
- General data protection
Basic legislative acts
- GDPR regulation
Article 64 Opinion of the Board
Summary What does Article 64 of the GDPR regulation say?
This article is part of the GDPR's consistency mechanism, which is designed to ensure uniform application of the regulation across Member States.
It establishes when the European Data Protection Board must issue an opinion on draft decisions being prepared by national supervisory authorities.
The article covers a defined set of scenarios — such as approving codes of conduct, certification criteria, standard data protection clauses, and binding corporate rules — where a supervisory authority must first submit its draft to the Board before acting.
It also sets out the process and timelines for the Board to deliver its opinion, and what happens if a supervisory authority chooses not to follow that opinion, in which case it feeds directly into Article 65's binding decision mechanism.
Important points:
- Competent supervisory authorities are required to submit draft decisions to the Board and must not adopt those decisions while the Board's opinion process is ongoing.
- The Board must issue its opinion within eight weeks, extendable by a further six weeks, by simple majority of its members.
- Where a supervisory authority does not intend to follow the Board's opinion, Article 65 applies, escalating the matter to a binding decision.
Springlex's summary of the article is a reading aid, not a substitute for the legal text.
The Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures below. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:
aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);
concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;
- ▼C1ModificationCorrectedPoint (c) corrected by a corrigendum to Regulation (EU) 2016/679. Published in the Official Journal 23 May 2018.
aims to approve the requirements for accreditation of a body pursuant to Article 41(3), of a certification body pursuant to Article 43(3) or the criteria for certification referred to in Article 42(5);
aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);
aims to authorise contractual clauses referred to in point (a) of Article 46(3); or
aims to approve binding corporate rules within the meaning of Article 47.
Any supervisory authority, the Chair of the Board or the Commission may request that any matter of general application or producing effects in more than one Member State be examined by the Board with a view to obtaining an opinion, in particular where a competent supervisory authority does not comply with the obligations for mutual assistance in accordance with Article 61 or for joint operations in accordance with Article 62.
In the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it provided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks by simple majority of the members of the Board. That period may be extended by a further six weeks, taking into account the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the members of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period indicated by the Chair, shall be deemed to be in agreement with the draft decision.
Supervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the Board, using a standardised format any relevant information, including as the case may be a summary of the facts, the draft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory authorities concerned.
The Chair of the Board shall, without undue, delay inform by electronic means:
the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and
the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.
- ▼C1ModificationCorrectedParagraphs 6 – 8 corrected by a corrigendum to Regulation (EU) 2016/679. Published in the Official Journal 23 May 2018.
The competent supervisory authority referred to in paragraph 1 shall not adopt its draft decision referred to in paragraph 1 within the period referred to in paragraph 3.
The competent supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and shall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether it will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.
Where the competent supervisory authority referred to in paragraph 1 informs the Chair of the Board within the period referred to in paragraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the relevant grounds, Article 65(1) shall apply.
Relevant recitals
Recital 136 Board's opinions and dispute decisions
In applying the consistency mechanism, the Board should, within a determined period of time, issue an opinion, if a majority of its members so decides or if so requested by any supervisory authority concerned or the Commission. The Board should also be empowered to adopt legally binding decisions where there are disputes between supervisory authorities. For that purpose, it should issue, in principle by a two-thirds majority of its members, legally binding decisions in clearly specified cases where there are conflicting views among supervisory authorities, in particular in the cooperation mechanism between the lead supervisory authority and supervisory authorities concerned on the merits of the case, in particular whether there is an infringement of this Regulation.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
supervisory authority concerned
- the controller or processor is established on the territory of the Member State of that supervisory authority;
- data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or
- a complaint has been lodged with that supervisory authority;
Definition
processing
Definition
controller
Definition
enterprise
Definition
binding corporate rules
Definition
group of undertakings
Definition
processor
Definition
supervisory authority
Definition
personal data