Cooperation, consistency and the EDPB (Articles 60–66, 68–71)
Cross-border cases run through the cooperation procedure (): the lead authority circulates a draft decision; other concerned DPAs may agree or raise a reasoned objection. Mutual assistance () and joint operations () support this. The consistency mechanism () sits the EDPB () at its centre. The EDPB issues opinions () and binding dispute-resolution decisions (); the urgency procedure () allows provisional measures lasting up to three months. The WhatsApp case showed the EDPB forcing Ireland's DPC to raise a fine to €225 million.
| Article | Tool | What it does |
|---|---|---|
| 60 | Cooperation procedure | Lead authority circulates a draft decision; reasoned objections are accepted (→ revised draft) or rejected (→ consistency mechanism) |
| 61 | Mutual assistance | Cooperation and information exchange without undue delay, subject to a one-month long-stop |
| 62 | Joint operations | All concerned DPAs have a right to participate in joint investigations/enforcement |
| 63 | Consistency mechanism | Overarching duty to cooperate to apply the GDPR consistently |
| 64 | EDPB opinions | On DPIA lists, codes, accreditation criteria, contractual clauses, BCRs, and general-application matters |
| 65 | EDPB binding decision | Dispute resolution - binding decisions on rejected objections, competence disputes, or failure to seek/follow an Art 64 opinion |
| 66 | Urgency procedure | Provisional measures for up to three months, bypassing cooperation/consistency |
The EDPB (Art 68) is the successor to the Article 29 Working Party (WP29). It comprises a chairperson, the heads of the DPAs and the European Data Protection Supervisor (EDPS); the Commission may send a delegate. It must act independently (Art 69) and has a long list of tasks (Art 70), including publishing advice, guidance and best practice, plus annual reports (Art 71).
In July 2021 an EDPB binding decision under Article 65(1)(a) required Ireland's DPC to impose a higher fine on WhatsApp than the €30m–€50m intimated - resulting in an uplifted fine of €225 million in August 2021. This showed DPAs successfully overturning the lead authority's jurisdictional primacy.