Guidelines 9/2020 on relevant and reasoned objection under Regulation 2016/679

Paragraph 3.1.1  Existence of an infringement of the GDPR

25. In the first case, the content of the objection will amount to a disagreement between the CSA and the LSA as to whether, in the facts at issue, the activities and processing operations carried out by the controller or processor led to an infringement of the GDPR or not, and to which infringement(s) specifically.

26. In this context, the term “infringement” should be interpreted as “an infringement of a given provision of the GDPR”. Therefore, the CSA’s objections to the draft decision must be justified and motivated through reference to evidence and facts that support the objection, by having regard to the facts and evidence (the ‘relevant information’ referred to in Article 60.3) provided by the LSA. These requirements should apply to each specific infringement and to each specific provision in question (e.g. if the draft decision says that the controller infringed Articles 6, 7, and 14 GDPR, and the CSA disagrees on whether there is an infringement of Article7 and 14 and considers that there is an infringement of Article13 GDPR).

Example: For instance, the CSA argues that the household exemption is not applicable to some of the processing operations conducted by a data controller and involving the use of CCTV. The LSA did not take this into consideration. In order to justify its objection, the CSA refers to Article 2(2)(c) GDPR, EDPB Guidelines 3/2019 on processing of personal data through video devices, and CJEU case C-212/13 Ryneš.

27. An objection as to whether there is an infringement of the GDPR may also include a disagreement as to the conclusions to be drawn from the findings of the investigation. For instance, the objection may state that the findings amount to the infringement of a provision of the GDPR other than (and/or inaddition to) those already analysed by the draft decision. However, this is less likely to happen when the obligation for the lead supervisory authority to cooperate with the concerned supervisory authorities and exchange all relevant information has been duly complied with in the time preceding the issuance of the draft decision.

28. In some circumstances, the objection could go as far as identifying gaps in the draft decision justifying the need for further investigation by the LSA. For instance, if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised by the complainant or resulting from an infringement reported by a CSA, a relevant and reasoned objection may be raised based on the failure of the LSA to properly handle the complaint and in safeguarding the rights of the data subject.In this regard, a distinction must be made between, on one hand, own-volition inquiries and, on the otherhand, investigations triggered by complaints or by reports on potential infringements shared by concerned supervisory authorities. In procedures based on a complaint or on an infringement reported by a CSA, the scope of the procedure (i.e. those aspects of data processing which are potentially the subject of a violation) should be defined by the content of the complaint or the CSA reporting, in other words by the aspects the complaint or report aims at. In ex officio procedures, the SAs should seek consensus regarding the scope of the procedure (i.e. the aspects of data processing under scrutiny) prior to initiating the procedure formally. As mentioned above, raising an objection should only be considered as a last resort to remedy an allegedly insufficient involvement of the CSA(s) in the preceding stages of the process. The system designed by the legislator suggests that consensus on the scope of the investigation should be reached at an earlier stage by the competent supervisoryauthorities.

29. The insufficient factual information or description of the case at stake, or the absence or insufficiency of assessment or reasoning (with the consequence that the conclusion in the draft decision is not adequately supported by the assessment carried out and the evidence presented, as required in Article 58 GDPR), can also be a matter of objection linked to the existence of an infringement, as long as the whole threshold set forth by Art. 4 (24) GDPR is met and it is possible that there can be a link between such allegedly insufficient analysis and the finding of an infringement / the envisaged action.

30. It is possible for a relevant and reasoned objection to raise issues concerning procedural aspects to the extent that they amount to situations in which the LSA allegedly disregarded procedural requirements imposed by the GDPR and this affects the conclusion reached in the draft decision.

Example: The supervisory authority of Member State YY is competent to act as lead supervisory authority for the cross-border processing carried out by the controller CC whose main establishment is in YY. The competent supervisory authority of Member State XX informs the lead supervisory authority (YY) concerning a complaint lodged with the XX SA substantially affecting data subjects only in XX, pursuant to Article 56(2) and (3) GDPR. The lead supervisory authority YY decides to handle the case. The supervisory authority of XX decides to submit to the YY SA a draft pursuant to Article 56(4). The lead supervisory authority prepares a draft decision pursuant to Article 60 (3) GDPR and submits it to the concerned supervisory authorities. The XX SA raises a relevant and reasoned objection concerning the fact that the YY SA should have taken utmost account of the draft received from the XX SA, pursuant to Article 56 (4) GDPR. The objection puts forward arguments clarifying the different conclusion that the draft decision would have reached if the YY SA had complied with its procedural obligation imposed by Article 56(4) GDPR.

31. An objection pursuant to Art. 60 (4) / 65 (1)(a) is without prejudice to the provision of Art. 65 (1)(b). Therefore, a disagreement on the competence of the supervisory authority acting as lead supervisory authority to issue a decision in the specific case should not be raised through an objection pursuant to Article 60 (4) and falls outside of the scope of Article 4 (24); unlike the objection pursuant to Art. 60 (4), the EDPB considers the procedure pursuant to Art. 65 (1)(b) to be applicable at any stage.