In which cases is the dispute resolution mechanism of Art. 65.1 (c) GDPR triggered?
While Art. 65 (a) and (b) relate to the one-stop-mechanism, Art.65.1 (c) GDPR concerns obligations of Data Protection Authorities (DPAs) stemming from the consistency mechanism.
More specifically, every competent DPA has the duty to request an opinion from the EDPB before adopting national measures pursuant to article 64.1 GDPR. Such measures include lists of processing operations for which a Data Protection Impact Assessment (DPIA) is required, or the approval of a new set of standard clauses. In addition, under Art. 64.2 GDPR, any SA may also request an EDPB consistency opinion on any matter of general application or producing effects in more than one Member State.
If an DPA does not request the opinion of the EDPB for the cases listed under Art. 64.1 GDPR or does not follow the EDPB opinion issued under Art. 64 GDPR, any DPA and the European Commission can launch the dispute resolution procedure of Art. 65.1 (c) GDPR about the matter.
The EDPB has adopted its binding decision: when is it notified to the relevant national Data Protection Authorities (DPAs), in which language and what happens next?
Once the EDPB has adopted a binding decision, the EDPB Chair notifies the binding decision to the relevant national Data Protection Authorities (DPAs) without undue delay.
Prior to the notification, the binding decision is translated into the languages of the relevant national DPAs that have to adopt a final decision or take measures at national level on the basis of the binding decision1. Translation and proofreading can take a few weeks. In any case, the English version of the decision is the only authentic language version.
Next step for the relevant Data Protection Authorities (DPAs)
Once the relevant SAs have been notified of the binding decision, a decision has to be adopted at national level to implement the content of the binding decision. This decision will be adopted without undue delay and at the latest one month after the EDPB has notified its decision. For cross-border cases where no consensus was found (Art. 65.1 (a) GDPR), the final decision will be addressed to the controller or processor and, where relevant, to the complainant.
Please see paragraphs 6 and 7 of Art. 11 of the EDPB Rules of Procedure. In exceptional cases, other Concerned Supervisory Authority (CSAs) can request, providing the reasons, an urgent translation in their official EU language(s) no later than at the moment of adoption of the binding decision.