Table of Contents
Article 60 of GDPR: Cooperation Between The Supervisory Authorities
Article 60 of GDPR deals with the manner the lead supervisory authority will cooperate with the other competent and concerned supervisory authorities.
Exchange of information (Article 60(1) GDPR)
The lead supervisory and any other concerned supervisory authority should cooperate in such a way as to reach a consensus on the manner to deal with a data protection matter.
To achieve that goal, they are required to exchange any relevant information with one another to help each other achieve the said consensus.
Demand for assistance (Article 60(2) GDPR)
The lead supervisory authority can ask the assistance of another supervisory authority with respect to:
- Perform a joint operation
- Helping with an investigation
- Monitor the implementation of GDPR measures
Communication of information to the concerned supervisory authority (Article 60(3) GDPR)
The lead supervisory authority is responsible to ensure it communicates the necessary information regarding its demand or decision to the concerned supervisory authority.
It will also communicate a draft of its decision to the other supervisory authorities for their views and will take them into account.
Objection to the demand of the lead supervisory authority (Article 60(4) GDPR)
If a concerned supervisory authority raises objections against the lead supervisory authority’s demand or consultation request, the lead supervisory authority must submit the matter to the consistency mechanism if it chooses not to follow the relevant objection of the concerned supervisory authority.
The concerned supervisory authority must raise its objections based on relevant and respond motives and must communicate it within 4 weeks from the receipt of the consultation request from the lead supervisory authority.
Revision to lead supervisory authority’s decision (Article 60(5) GDPR)
If the lead supervisory authority receives a relevant and reasoned objection of a concerned supervisory authority and it intends to follow the said objection, it will submit a revised draft of its decision to the concerned supervisory authority for review.
The concerned supervisory authority will have 2 weeks to respond.
No objections to the lead supervisory authority’s draft decision (Article 60(6) GDPR)
When there is no objection raised against the lead supervisory authority’s decision, all the concerned supervisory authorities along with the lead supervisory authority are deemed to be in an agreement.
Notification of decision to organizations (Article 60(7) GDPR)
The lead supervisory authority has the duty to notify the data controller or data processor of its decision.
It must also inform the other concerned supervisory authorities of its decision along with the European Data Protection Board by providing a summary of the relevant facts and the grounds for its decision as well.
If a complaint was filed directly with a concerned supervisory authority, it will be responsible to communicate the decision to the complainant.
Dismissal of a complaint (Article 60(8) GDPR)
When a complaint is dismissed or rejected, the supervisory authority where the complaint was filed will adopt that decision and notify the complainant and the data controller.
Complaint partly dismissed partly valid (Article 60(9) GDPR)
If a complaint is received and the lead supervisory authority and the concerned supervisory authority agree that parts of the complaint should be dismissed and parts should be investigated, then the lead supervisory authority will investigate the relevant part and the concerned supervisory authority will notify the decision to dismiss parts of the decision to the complainant.
Compliance with the supervisory authority’s decision (Article 60(10) GDPR)
When a data controller or data processor receives the decision of the supervisory authority, it shall take the necessary measures to comply with the decision.
The organization must inform the supervisory authority of the measures taken to ensure their data processing activities have become compliant with GDPR.
Urgency procedure (Article 60(11) GDPR)
If the supervisory authority believes that there are reasons to trigger the urgency procedure provided for under GDPR, they have the power to do so.
Communication between supervisory authorities (Article 60(12) GDPR)
GDPR specifies that supervisory authorities are required to share any information between them by electronic means using a standardised format.
Recitals applicable to Article 60 of GDPR
Relevant Recitals: 124, 125, 130
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 60 or relevant recitals
None
GDPR Text: Article 60 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection RegulationÂ
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
