This is Part 4 of a five-part series on the “One Stop Shop” mechanism in the proposed new European data protection regulation. In Part 1 we examined why there is a need for a One Stop Shop, and what it is. In Part 2 we examined the concept of main establishment and the position of entities without an EU establishment. In Part 3 we considered the competency of supervisory authorities (SAs), the cooperation obligations in relation to SAs and the functions of the European Data Protection Board (EDPB). In this Part we consider the consistency mechanism applicable to SAs.
Consistency mechanism
In order to ensure that the current cultural data protection enforcement divergences do not reappear in the interpretation and enforcement of the Regulation, it was felt by EU policymakers that a mechanism to ensure consistency is required. Article 57 states, ‘for the purposes set out in Article 46(1), the supervisory authorities shall co-operate with each other and the Commission through the consistency mechanism’.
Under the European Commission’s (the Commission) proposal for the new Regulation (the Commission 2012 Proposal), any SA or the EDPB is entitled to request that a matter is dealt with through the consistency mechanism. Similarly, the Commission has the power to request that any matter is dealt with via the consistency mechanism in order to ‘ensure the correct and consistent application’ of the Regulation.
The ‘Partial Agreement’ reached between members of the Council on 13 March 2015 (the Council March 2015 Position) refers a narrower range of matters to the consistency mechanism, although it potentially encourages a much higher number of EDPB referrals by giving the EDPB powers to decide on matters where SAs disagree (six EU Member States still favour the introduction of a quantitative threshold before an SA disagreement can be put through this process).
The Commission 2012 Proposal mechanism works as follows:
- before an SA adopts a measure, it forwards a draft to the EDPB and the Commission;
- where the EDPB decides, or the Commission or any SA makes a request, the EDPB will issue and adopt an opinion (or decision) within one month of the referral;
- the chair of the EDPB will give notice of its opinion to the SA that proposed the measure, any SA that referred it to the EDPB, any other SA that has jurisdiction over the data controller’s activities, and the Commission;
- the SA that proposed the measure, and any other with jurisdiction over the data controller’s activities, will take account of the opinion and, within two weeks, inform the EDPB and the Commission whether it intends to implement the measure as originally drafted or make any amendments to it;
- within ten weeks of the matter being raised under the consistency mechanism (or six if it was raised as a matter of urgency under Article 61), the Commission is able to adopt an opinion on the suggested measure. No action can be taken on the measure during this period;
- the SA concerned should ‘take utmost account’ of the Commission’s opinion and inform the Commission and the EDPB whether it will use the original measure or amend it in response to the opinion. Where the SA decides against following the opinion of the Commission, it must provide a justification and the draft measure cannot be adopted for a further month;
- within one month of receiving notice from the SA, if the Commission still has serious doubts as to whether the proposed measure ensures the correct and consistent application of the Regulation, the Commission may adopt a ‘reasoned decision’ requiring the SA to suspend the adoption of the measure for up to 12 months. During this time the Commission will attempt to reconcile the positions of the SA and EDPB or adopt a measure of its own design; and
- any measure drawn up by the Commission may be adopted as an ‘implementing act’ under Article 62, which allows it to introduce a legal measure without any right of judicial appeal or redress.
Under the Commission 2012 Proposal, in situations where it is required, any measure implemented will not be legally valid if SAs fail to communicate the draft measure to the EDPB and the Commission (and so ultimately avoid the consistency mechanism). This has been omitted from the Council March 2015 Position.
Under the Council March 2015 Position:
- the consistency mechanism only applies to certain measures and the EDPB will issue an opinion whenever a competent SA intends to adopt such measure. It will adopt a binding decision where a concerned SA ‘expresses a relevant and reasoned objection’ to a draft decision of the lead SA or where the lead SA rejects an objection made to it as not being relevant and/or reasoned;
- the EDPB decision will be addressed to the lead SA and all concerned SAs and will be made within one month of the referral. This period may be extended by a further month on account of the complexity of the subject matter, and where the EDPB cannot make a decision with a two thirds majority, it may be extended for a further two weeks (at the end of which the decision will be made by simple majority);
- SAs are not to adopt their own decisions during these periods (although there is an urgency procedure);
- as well as informing SAs, the EDPB must inform the Commission and put the decision on its website; and
- the SA’s final decision must be adopted on the basis of the EDPB position without delay and within one month of the EDPB’s decision.
Check back on Monday for Part 5 of the “One Stop Shop” series, which will analyze the application of sanctions by the lead SA across the EU, disagreements between SAs, complaints and litigation for affected data subjects, the application of foreign laws by the lead SA, and matters of language and culture.
