The GDPR gives competence to each national data protection supervisory authority (“SA”) to monitor, promote, investigate and enforce the GDPR and to cooperate with, including sharing information with and providing mutual assistance to, other SAs to ensure the consistent application and enforcement of the GDPR (article 57). The GDPR also requires SAs to share relevant information and provide mutual assistance to implement and apply the GDPR consistently, to put in place measures to cooperate with one another (article 61) and to conduct joint investigations and enforcement where appropriate (article 62).

In 2020, the EDPB, an independent body tasked with ensuring consistent application of the GDPR and which is composed of the heads of the SAs, adopted a document setting out a Coordinated Enforcement Network (“CEF”) to meet the GDPR requirements for cooperation between SAs.

The CEF provides a framework for coordinated action on a topic, within the scope of the GDPR, to be defined each year which may include awareness raising, information gathering, enforcement sweeps and joint investigations where appropriate. Having agreed a methodology, the SAs look at the same topic in their respective countries at the same time and share findings which are then analysed, allowing for targeted follow-up on both the national and the EU level. These proactive measures by the SAs sit alongside their responsibility to respond to complaints of GDPR breaches. In both cases, the responsibility for enforcement remains with the SAs whereas the CEF provides a means to share and combine national efforts and takes responsibility if the coordinated action outcomes include recommendations or a call for guidance. The CEF also provides the means by which the tools provided in articles 61 and 62 may be put into effect.

Last year, the EDPB selected the designation and position of data protection officers for the coordinated enforcement action. During its October 2023 plenary, the EDPB selected implementation of the right of access for its next coordinated enforcement action. Further work will be carried out in the coming months to specify the details and the action itself will be launched in 2024.

For more information, click here.