SkarpChapter 14 of 16
Cross-Border Enforcement and the Consistency Mechanism
A cross-border case may involve one lead authority, several concerned authorities, competing objections, joint investigations, and urgent threats to individual rights. Articles 60–67 establish the procedures that turn this complex network into coordinated decisions and, where necessary, binding Board resolution.
The Architecture of Cross-Border Cooperation
A coordinated enforcement system
Articles 60-67 of the GDPR address situations involving multiple supervisory authorities. They move from cooperation, to consistency review, to binding resolution or urgency action where the conditions are met.
Section 1: Cooperation
Articles 60-62 cover the practical tools: lead-authority cooperation, mutual assistance, and joint operations. These are the system's information-sharing and investigative foundations.
Section 2: Consistency
Articles 63-67 provide Union-wide coherence through Board opinions, binding dispute resolution, urgency measures, and standardized electronic exchanges.
Current-status note
Regulation (EU) 2025/2518 is in force but applies from April 2, 2027. It adds procedural rules and does not replace the GDPR provisions studied in this module.
Article 60: Reaching a Cross-Border Decision
The mandatory starting point
Article 60(1) requires cooperation aimed at consensus. The lead supervisory authority and supervisory authorities concerned shall exchange all relevant information.
Draft first, then objections
The lead supervisory authority shall communicate relevant information and submit a draft decision without delay. It must take due account of the views received.
Four-week objection window
A concerned authority may express a relevant and reasoned objection "within a period of four weeks after having been consulted." The objection's timing and character both matter.
Revision or escalation
If the lead authority follows the objection, a revised draft receives a two-week procedure. If it rejects the objection or considers it insufficient, it shall refer the matter to Article 63.
Article 60 in Practice: One Decision, Several Authorities
Scenario
A controller's main establishment is in Member State A, while people in Member States B and C are substantially affected. A is the lead authority; B and C are concerned authorities.
A timely objection
B objects 20 days after consultation. Because this is within four weeks, the lead authority must either follow the relevant and reasoned objection through a revised draft or use Article 63.
No objection
If no concerned authority objects within the applicable Article 60 period, Article 60(6) deems them in agreement with the draft decision and binds them to it.
Who notifies whom?
Article 60 distinguishes ordinary decisions, dismissed or rejected complaints, and mixed complaints. Where a complaint is partly rejected and partly acted on, separate decisions shall be adopted.
Quiz: Article 60 Timing and Escalation
Choose the answer that follows Article 60 most precisely.
A concerned supervisory authority makes a relevant and reasoned objection 18 days after consultation on a draft decision. The lead supervisory authority considers the objection not relevant or reasoned. What does Article 60(4) require?
- The lead supervisory authority shall submit the matter to the Article 63 consistency mechanism.
- The lead supervisory authority may ignore the objection because it considers it unpersuasive.
- The concerned authority must adopt its own final decision immediately.
- The Board must automatically issue a binding decision within two weeks.
Show Answer
Answer: A) The lead supervisory authority shall submit the matter to the Article 63 consistency mechanism.
The objection was expressed within the four-week period. Where the lead supervisory authority does not follow a relevant and reasoned objection, or considers it not relevant or reasoned, Article 60(4) says it shall submit the matter to the Article 63 consistency mechanism. A binding decision is governed by Article 65 and is not automatic in every Article 63 referral.
Article 60 Completion: Union-Wide Compliance and Article 61 Assistance
Compliance across establishments
Article 60(10) does not limit compliance to one establishment. The controller or processor shall take necessary measures for all of its establishments in the Union.
Mutual assistance is mandatory
Article 61 requires authorities to provide relevant information and mutual assistance, and to establish measures for effective cooperation in implementing and applying the GDPR consistently.
One-month outer deadline
Each requested authority shall take all appropriate measures to reply "without undue delay and no later than one month after receiving the request."
Limited grounds for refusal
A requested authority shall not refuse unless it lacks competence or compliance would infringe the GDPR or applicable Union or Member State law. It must give reasons for a refusal.
Articles 61-62: Assistance, Joint Operations, and Responsibility
No fee for ordinary assistance
Requested authorities shall not charge a fee for actions taken under a mutual-assistance request. Exceptional specific expenditure may be addressed through agreed indemnification rules.
When assistance fails
If Article 61(5) information is not provided within one month, Article 61(8) permits a provisional territorial measure and presumes the urgent need to act.
Joint operations
Where appropriate, authorities shall conduct joint operations, including investigations and enforcement measures. Multi-establishment or substantially multi-state impact can give each relevant authority a right to participate.
Powers and liability
Seconded staff operate only within the Article 62 legal framework: host guidance and presence are required for investigative powers, and the host Member State bears initial responsibility for damage.
Articles 63-64: The Consistency Mechanism and Board Opinions
The purpose of Article 63
Article 63 frames consistency as cooperation among supervisory authorities and, where relevant, with the Commission, to support consistent GDPR application throughout the Union.
When an Article 64 opinion is required
A competent authority shall send specified draft decisions to the Board, including certain DPIA lists, codes of conduct, accreditation criteria, clauses, and binding corporate rules.
General or multi-state matters
Any supervisory authority, the Chair, or the Commission may request a Board opinion on a matter of general application or with effects in more than one Member State.
Timing and effect
The opinion is adopted within eight weeks by simple majority, with a possible six-week complexity extension. The authority may not adopt its listed draft during that period.
Article 65: When the Board Resolves a Dispute
Binding, not merely advisory
Article 65 applies in listed individual-case disputes. The Board shall adopt a binding decision, including for unresolved relevant and reasoned objections under Article 60(4).
Three routes to Article 65
The routes are: unresolved Article 60 objections; disagreement on main-establishment competence; and certain failures to seek or follow an Article 64 opinion.
Vote and deadline
The Board normally decides within one month, extendable by one month for complexity, by a two-thirds majority of its members. The decision must be reasoned and binds the authorities.
Final national decision
The relevant lead or complaint authority shall adopt its final decision on the Board's basis without undue delay and at the latest one month after Board notification.
Quiz: Opinion, Binding Decision, or Urgency?
Identify the GDPR mechanism that best matches the stated facts.
A competent supervisory authority intends to approve binding corporate rules. Under Article 64(1), what must happen before it adopts that draft decision?
- It shall communicate the draft decision to the Board so that the Board issues an opinion.
- It shall immediately request a binding decision under Article 65.
- It may adopt the draft first and ask the Board for approval later.
- It must use Article 66 because binding corporate rules always create urgency.
Show Answer
Answer: A) It shall communicate the draft decision to the Board so that the Board issues an opinion.
Article 64(1)(f) includes approval of binding corporate rules within Article 47. The competent supervisory authority shall communicate the draft decision to the Board, and Article 64 provides for a Board opinion. Article 65 applies only in its listed dispute situations.
Articles 66-67: Urgency and Electronic Exchange
Exceptional and territorial
Article 66 permits immediate provisional measures only in exceptional circumstances and where urgent action is needed to protect rights and freedoms. The measures produce effects on the authority's own territory.
Maximum provisional duration
A provisional measure must have a specified validity period that shall not exceed three months. Its adoption and reasons shall be communicated without delay.
Urgent Board action
Urgent opinions and urgent binding decisions under Article 66(2)-(3) shall be adopted within two weeks by simple majority, rather than under the ordinary Article 64 and 65 timelines.
Article 67
The Commission may adopt general implementing acts on electronic information exchange and standardized formats. Article 67 points to the Article 93(2) examination procedure.
Flashcards: Cross-Border Enforcement Essentials
Flip each card and test whether you can state the rule, trigger, and deadline precisely.
- Article 60 consensus duty
- The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article in an endeavour to reach consensus.
- Article 60 objection deadline
- A concerned authority may express a relevant and reasoned objection within a period of four weeks after having been consulted.
- Revised Article 60 draft
- Where the lead authority intends to follow an objection, the revised draft is subject to the Article 60(4) procedure within a period of two weeks.
- Union-wide compliance
- The controller or processor shall take necessary measures to ensure compliance across processing activities in the context of all its establishments in the Union.
- Mutual-assistance deadline
- A requested authority shall take all appropriate measures to reply without undue delay and no later than one month after receiving the request.
- Article 62 participation right
- Where the stated multi-establishment or substantial multi-state-impact conditions apply, a supervisory authority of each relevant Member State shall have the right to participate in joint operations.
- Article 64 opinion deadline
- The Board opinion shall be adopted within eight weeks by simple majority, with a possible further six weeks for complexity.
- Article 65 ordinary vote
- The Board's binding decision is adopted within one month from referral, extendable by a further month for complexity, by a two-thirds majority of Board members.
- Article 66 provisional-measure limit
- The measure has a specified period of validity which shall not exceed three months.
Key Terms
- Board opinion
- An opinion issued under Article 64 in the specified circumstances; it is distinct from the binding decision under Article 65.
- binding decision
- A reasoned Article 65 decision that binds the lead supervisory authority and all supervisory authorities concerned in the listed individual-case situations.
- joint operations
- Operations that supervisory authorities shall conduct where appropriate, including joint investigations and joint enforcement measures involving personnel from other Member States.
- mutual assistance
- Relevant information and assistance that supervisory authorities shall provide each other under Article 61 to implement and apply the GDPR consistently.
- provisional measure
- A territorial measure that Article 66 allows immediately in exceptional circumstances of urgent need, with a validity period not exceeding three months.
- consistency mechanism
- The Article 63 mechanism through which supervisory authorities cooperate, and where relevant cooperate with the Commission, to contribute to consistent GDPR application throughout the Union.
- lead supervisory authority
- The supervisory authority that performs the lead role in the Article 60 cooperation procedure.
- relevant and reasoned objection
- The type of objection referred to in Article 60(4) and Article 65(1)(a); Article 60 makes its timing and handling central to escalation.
- supervisory authority concerned
- A supervisory authority participating in the Article 60 procedure and capable of providing views or a relevant and reasoned objection under the conditions stated there.