Article 62 — Joint operations of supervisory authorities

Article 62 is the GDPR’s mechanism for supervisory authorities to work together in the field, not merely exchange emails, documents or legal opinions. It allows officials from different Member States to participate in the same investigation or enforcement operation, while carefully regulating who may exercise public powers, which country’s law applies, and who bears responsibility if something goes wrong.

In plain language, Article 62 says:

When a cross-border data protection problem cannot be investigated effectively by authorities acting separately, they should, where appropriate, form a joint team. Foreign officials may participate, but the host authority remains in control of compulsory action on its territory.

1. Why Article 62 is necessary

Each national supervisory authority normally exercises compulsory regulatory powers within its own Member State. A French authority cannot ordinarily enter an office in Germany, compel access to a German server or exercise French public powers on German territory.

At the same time, modern processing operations rarely respect national boundaries. A multinational platform may have:

• its main establishment in Ireland;
• engineers in Germany;
• a processor in France;
• servers in the Netherlands;
• users throughout the EEA;
• a decision-making team spread across several establishments.

Articles 60 and 61 facilitate cooperation, but written information exchange is not always enough. Some cases require officials from several authorities to work together directly.

Illustration

A multinational recruitment platform uses a single AI system throughout Europe. The controller’s main establishment is in the Netherlands, the model is developed in Germany, applicant data are hosted in France, and complaints have been filed in Spain and Italy. A joint operation could involve:

• Dutch officials coordinating the investigation;
• German technical specialists examining the model;
• French officials inspecting the data-hosting environment;
• Spanish and Italian officials contributing evidence about affected applicants. Article 62 supplies the legal framework for that cooperation. The GDPR expressly authorises joint investigations and joint enforcement measures involving personnel from several Member States.

---

2. Relationship with Articles 60 and 61

Article 62 must be distinguished from the other cooperation mechanisms.

Article 60: Joint decision-making

Article 60 governs the cooperation procedure in a cross-border case. The lead supervisory authority shares information, prepares a draft decision, considers other authorities’ views and resolves objections through the EDPB where necessary.

Article 61: Mutual assistance

Article 61 usually involves one authority asking another authority to perform a particular act, such as:

• obtaining documents;
• carrying out an inspection;
• transmitting information;
• interviewing a witness.

The requested authority generally performs that act within its own territory and reports the result.

Article 62: Joint operational activity

Article 62 goes further. Personnel from more than one authority participate in the same coordinated operation.

[!example] Illustration The Irish lead authority asks the German authority to inspect a German establishment and send the inspection report. That is principally mutual assistance under Article 61. If Irish investigators travel to Germany and join German officials in the inspection, evidence review and interviews, the operation falls within Article 62. The mechanisms are complementary. Article 60(2) expressly recognises that the lead authority may request mutual assistance and conduct joint operations while handling a cross-border case. Article 62 provides the operational structure for personnel from several national authorities to act together.

3. Article 62 applies beyond physical inspections

The phrase “joint operation” is broader than an unannounced raid or site visit. It may include:

• joint investigations;
• joint audits;
• joint interviews;
• coordinated technical testing;
• examination of databases;
• joint evaluation of algorithms;
• simultaneous inspections;
• verification of compliance with a decision;
• coordinated enforcement measures;
• combined evidence-analysis teams;
• temporary secondment of technical experts.

The EDPB’s internal Article 62 document describes a structured process involving identification of participating authorities, invitations, a joint-operation action plan, allocation of powers, completion procedures, confidentiality, language, costs, dispute resolution and withdrawal arrangements.

Illustration

Three authorities jointly examine a social-media recommendation system. The operation may proceed remotely:

• one authority supplies data-science specialists;
• another supplies legal investigators;
• another supplies child-rights expertise;
• all officials access a controlled evidence environment;
• the host authority directs the exercise. No physical inspection is necessary for the activity to qualify as a joint operation.

---

4. Article 62(1): The general duty to conduct joint operations

Paragraph 1 states that supervisory authorities shall, where appropriate, conduct joint operations, including joint investigations and joint enforcement measures.

Two parts of this language matter:

1. “shall” creates a duty;
2. “where appropriate” requires an assessment of suitability and necessity.

The provision does not require a joint operation in every cross-border case. Many matters can be resolved through document exchange, Article 61 assistance and Article 60 consultation. But authorities should use Article 62 where coordinated participation would materially improve the investigation or enforcement.

4.1 Meaning of “where appropriate”

A joint operation may be appropriate where:

• evidence is spread across several Member States;
• the same processing occurs in several establishments;
• simultaneous inspections are necessary;
• specialist expertise is located in another authority;
• a large number of people in several states are affected;
• local-language knowledge is important;
• a single inspection would give an incomplete picture;
• implementation of an EEA-wide order must be verified;
• there is a risk that evidence will be moved or altered;
• authorities need common factual findings.

Illustration

A controller operates identical employee-monitoring systems in ten countries. Each system is configured locally, but the main establishment claims that all subsidiaries follow the same safeguards. A joint operation may be appropriate because officials can compare:

• written central policy;
• actual local settings;
• retention;
• access permissions;
• employee notices;
• local deviations. Separate uncoordinated investigations could produce inconsistent evidence and duplicate work.

4.2 When a joint operation may be unnecessary

A joint operation may be disproportionate where:

• the facts are admitted;
• the issue is purely legal;
• the relevant documents are already available;
• only one establishment is involved;
• the infringement is minor and local;
• Article 61 assistance can obtain the necessary evidence efficiently.

Illustration

A controller admits that it answered one access request two weeks late and has already supplied the complete response. Sending officials from four authorities to conduct a joint inspection would ordinarily add unnecessary cost and complexity.

4.3 Authorities must give genuine consideration to Article 62

The words “where appropriate” should not become a convenient excuse never to conduct joint operations.

An authority should consider:

• cross-border scale;
• investigative needs;
• expertise;
• proportionality;
• expected benefits;
• resource requirements;
• whether another cooperation tool would suffice.

A repeated institutional policy of refusing every joint operation because travel is inconvenient would undermine Article 62.

5. Joint investigations

A joint investigation is a coordinated fact-finding activity involving personnel from more than one supervisory authority.

It may include:

• preparing a common investigation plan;
• identifying legal and technical questions;
• inspecting systems;
• taking witness accounts;
• obtaining data samples;
• testing interfaces;
• reviewing internal documents;
• comparing local practices;
• analysing evidence jointly.

Illustration

A platform uses a “consent or pay” model throughout the EEA. The authorities jointly examine:

• whether refusal is as easy as acceptance;
• whether users suffer detriment if they refuse;
• whether fees vary by country;
• whether children are affected;
• which data are collected after the user pays;
• whether the same interface is used in every language. The operation provides a shared evidential basis, even though the ultimate decision may still be adopted through Article 60.

5.1 Investigation must remain within Article 58

Article 62 does not invent new investigative powers.

The operation must rely on powers available under Article 58 and applicable national law, such as:

• ordering information;
• conducting audits;
• obtaining access to data;
• entering premises;
• obtaining access to processing equipment.

Article 62 determines how personnel from another authority may participate. It does not eliminate warrants, hearing rights, professional-secrecy protections or proportionality requirements.

6. Joint enforcement measures

Joint operations may also include enforcement activity.

Possible examples include:

• coordinated service of corrective orders;
• simultaneous verification of compliance;
• coordinated temporary restrictions;
• supervision of deletion across several establishments;
• verification of changes to a platform interface;
• coordinated action against interconnected controller and processor establishments.

The phrase should be understood carefully. Article 60 normally determines how a binding cross-border decision is agreed and adopted. Article 62 does not allow a group of officials to bypass the draft-decision and objection procedure.

Illustration

A final Article 60 decision requires a retailer to stop using facial recognition throughout its EEA stores. A joint enforcement operation may verify that:

• cameras have been disabled;
• biometric templates have been deleted;
• old backups are handled lawfully;
• local stores no longer enrol customers;
• processors have received instructions;
• notices have been removed. The operation enforces or monitors the agreed decision. It does not replace the decision-making procedure.

---

7. Article 62(2): Right to participate

Paragraph 2 gives certain supervisory authorities a right to participate in a joint operation.

The right arises where:

1. the controller or processor has establishments in several Member States; or
2. a significant number of data subjects in more than one Member State are likely to be substantially affected.

A supervisory authority of each relevant Member State has the right to participate. The authority competent under Article 56(1) or 56(4) must invite the relevant authorities and respond without delay to participation requests.

8. First participation route: establishments in several Member States

Where the controller or processor has establishments in several Member States, the authority of each relevant state may have a participation right.

The establishment must be relevant to the joint operation. Article 62 should not be interpreted mechanically to mean that every authority connected with any remote group office has an automatic right to join every operation concerning every unrelated processing activity.

Illustration

A global group has:

• a marketing establishment in France;
• a payroll establishment in Germany;
• a logistics establishment in Poland. A joint operation concerns a Europe-wide employee-payroll system operated through Germany. Germany plainly has a close connection. France or Poland may also have a participation right if their establishments use or contribute to the payroll system. Their mere existence within the corporate group should not automatically determine participation if they have no connection to the relevant processing. The analysis should remain processing-specific.

---

9. Second participation route: significant number of individuals substantially affected

An authority may also have a participation right where:

• a significant number of people in its state are likely to be affected; and
• the effect is substantial.

Both elements matter.

9.1 “Significant number”

The GDPR does not define a fixed numerical threshold.

Significance depends on context, including:

• the population of the Member State;
• the size of the service;
• the category of affected persons;
• concentration of impact;
• nature of the processing;
• vulnerability of affected persons.

Illustration

Ten thousand affected users may be significant for a specialised medical service. The same number may be less significant for a universally used communication platform, although the operation may still substantially affect those individuals. A purely mathematical test would be too rigid.

9.2 “Substantially affected”

A substantial effect may involve:

• denial of employment;
• financial loss;
• discriminatory profiling;
• disclosure of sensitive data;
• identity theft;
• persistent surveillance;
• loss of confidentiality;
• inability to exercise rights;
• automated decisions producing serious consequences.

Illustration

A fertility application exposes the health information of 5,000 users in each of several states. Even if the number is modest relative to total population, the sensitivity and consequences may make the effect substantial.

9.3 “Likely” to be affected

Actual harm need not already have occurred.

The participation right may arise where future substantial effects are sufficiently likely.

[!example] Illustration A credit-scoring model is about to be introduced across six Member States. It has not yet rejected applicants, but testing indicates a serious discriminatory pattern. Authorities need not wait for thousands of harmful decisions before conducting a joint operation.

10. Mandatory invitation by the competent authority

The authority competent under Article 56(1) or (4) must invite the relevant authorities.

This is not merely a courtesy.

The competent authority should identify:

• Member States containing establishments connected to the processing;
• states where a significant number of people may be substantially affected;
• authorities holding relevant expertise or evidence;
• authorities that have requested participation.

Illustration

The Dutch lead authority plans a joint inspection into a platform used heavily in Spain, France and Germany. If the statutory conditions are met, it should invite the Spanish, French and German authorities. It should not create a closed operation involving only authorities with which it already agrees.

10.1 Article 56(4)

Article 56(4) concerns cases that appear locally focused under Article 56(2), but which the lead authority decides to handle through Article 60.

Where a joint operation is then appropriate, the lead authority must respect Article 62 participation rights.

Illustration

A complaint initially concerns CCTV at one French store of a multinational retailer. The Italian lead authority decides to take the case because the investigation reveals that the system is part of a wider corporate policy. France and any other qualifying authorities must be invited to the relevant operation.

11. Right to request participation

A qualifying supervisory authority need not wait passively for an invitation. It may ask to participate.

The competent authority must respond without delay.

A meaningful response should state:

• whether participation is accepted;
• what operation is proposed;
• expected role;
• timing;
• powers;
• logistical conditions;
• reasons for any limitation or disagreement.

Silence is particularly problematic because paragraph 7 creates consequences where an authority fails to comply with the paragraph 2 obligation within one month.

12. Is the participation right absolute?

The supplied commentary suggests that participation may be refused for proportionality, seriousness or national-security reasons. That proposition must be approached cautiously.

The text says that a qualifying authority“shall have the right to participate.” It does not expressly create a general proportionality or “minimum seriousness” exception.

Practical arrangements may regulate:

• number of participating staff;
• remote rather than physical participation;
• access to particular confidential material;
• division of tasks;
• timing;
• security clearances;
• operational necessity.

But those arrangements should not destroy the statutory right.

Illustration

Twenty authorities qualify to participate in a large platform investigation. It may be impractical for each to send ten officials into one server room. The host may reasonably organise:

• a smaller physical team;
• remote participation;
• shared representatives;
• specialist working groups;
• secure circulation of evidence. That manages the exercise of the right. It does not exclude qualifying authorities from the operation. Any limitation should be:
• objectively justified;
• proportionate;
• transparent;
• non-discriminatory;
• consistent with effective participation.

---

13. Article 62(3): Powers of visiting personnel

Paragraph 3 contains the Article’s most technically difficult rules.

Its purpose is to answer:

What may an official from Authority A legally do while participating in an operation on the territory of Member State B?

Article 62 offers two models.

Model 1: Host-conferred powers

The host authority may confer powers, including investigative powers, on visiting personnel, where:

• host Member State law permits it; and
• the seconding authority authorises its personnel to receive those powers.

Model 2: Use of home powers

The host authority may allow visiting personnel to exercise powers derived from the law of their own Member State, but only where host Member State law permits that arrangement.

In both models:

• powers are exercised under the guidance of the host authority;
• host personnel must be present;
• visiting personnel are subject to host-state law.

14. Host and seconding authorities

The terminology is important.

Host supervisory authority

The host is the authority of the Member State where the joint operation is physically or legally being carried out.

Seconding supervisory authority

The seconding authority sends members or staff to participate in the host state.

Illustration

French officials travel to Germany to inspect a German establishment.

• Germany is the host authority.
• France is the seconding authority.
• French officials are the seconded personnel. If German officials later travel to inspect a French processing centre, the roles reverse for that operation.

---

15. Model 1: Conferral of host powers

Under the first model, the host grants visiting officials certain powers that exist under host law.

Illustration

German law permits the German supervisory authority to authorise visiting EEA officials to:

• ask questions;
• inspect specified systems;
• review documents;
• assist in copying evidence. The German authority confers those defined powers on French investigators, with France’s authorisation. The French officials exercise German-conferred powers, not independent French sovereign authority.

15.1 Conferral is not automatic

Three questions must be answered:

1. Does host law permit powers to be conferred?
2. Which powers may be conferred?
3. Has the seconding authority authorised its personnel to accept and exercise them?

A general Article 62 invitation does not necessarily authorise every visiting official to exercise every Article 58 power.

The joint-operation plan should specify:

• persons authorised;
• powers conferred;
• scope;
• duration;
• evidential procedures;
• supervision arrangements.

16. Model 2: Exercise of seconding-state powers

The second model permits visiting officials to exercise powers derived from their own national law, but only if host law allows it.

This is unusual because public powers are ordinarily territorial. Article 62 permits controlled cross-border exercise while preserving the host state’s consent and supervision.

Illustration

Dutch law gives forensic investigators a particular power to create verified technical images of processing systems. Belgian law allows seconded EEA officials to use home-state technical powers during joint operations. Dutch investigators participating in Belgium may use that power, subject to:

• Belgian permission;
• the operation’s scope;
• host guidance;
• Belgian officials being present;
• Belgian law governing conduct.

16.1 Host law remains decisive

The visiting authority cannot say:

“Our domestic law permits this, so we may do it anywhere in Europe.”

The host state must permit the exercise of foreign powers. If host law prohibits a method, the visiting official cannot use it merely because home law allows it.

17. Why the second model has limited practical reach

Article 58 already gives every supervisory authority similar core investigative powers.

The second model may still matter because national law can differ regarding:

• forensic methods;
• copying techniques;
• interview procedures;
• compulsory questioning;
• sealing evidence;
• remote system access;
• additional powers under Article 58(6).

But Article 62 cannot be used to import a broader foreign power in a way that defeats host-state protections.

[!example] Illustration Home-state law allows administrative investigators to seize all devices without a warrant. Host law requires judicial authorisation. The visiting official cannot avoid the host warrant requirement by relying on home-state law. The host’s permission and legal safeguards remain essential.

18. Guidance and presence of host officials

Visiting personnel may exercise investigative powers only:

• under the guidance of host personnel; and
• in their presence.

These conditions protect territorial sovereignty and legal accountability.

18.1 Meaning of guidance

Host guidance may include:

• defining the operation’s scope;
• giving instructions;
• determining lawful methods;
• supervising interviews;
• approving evidence collection;
• stopping improper action;
• applying local procedural requirements.

18.2 Meaning of presence

For an on-site inspection, physical presence will usually be required.

For a remote technical operation, “presence” may arguably be satisfied through effective real-time host supervision, depending on:

• national law;
• nature of the power;
• secure technical arrangements;
• the operation plan.

The provision should not be interpreted so loosely that visiting officials exercise unsupervised public powers from abroad.

[!example] Illustration A French technical expert accesses a German server remotely while German officials monitor the session live, control credentials and approve every extraction. Whether this satisfies “presence” depends on German procedural law and the nature of the action. A pre-authorised but unsupervised download conducted days later would be much harder to reconcile with the text.

19. Visiting personnel are subject to host-state law

Paragraph 3 expressly provides that seconded personnel are subject to the law of the host Member State.

This may include laws concerning:

• official conduct;
• confidentiality;
• evidence handling;
• searches;
• data protection;
• privilege;
• health and safety;
• criminal liability;
• disciplinary standards;
• use of force or compulsory powers;
• judicial authorisation.

Illustration

A visiting official may lawfully record interviews in the home state without consent. Host-state law prohibits covert recording in that context. The official must follow host-state law.

19.1 Home-state employment status continues

The official remains employed or appointed by the seconding authority. But while operating in the host state, conduct in the joint operation is governed by the host’s legal framework.

This creates a dual relationship:

• employment and internal status remain connected to the seconding authority;
• operational conduct is governed by host law and host supervision.

20. Planning a joint operation

The EDPB internal document recommends a structured process, including a joint-operation action plan agreed among participating authorities. It addresses participation, powers, duration, confidentiality, retention, language, costs, dispute resolution and withdrawal.

A sound action plan should identify:

• legal basis;
• purpose;
• participating authorities;
• host and seconding roles;
• investigation scope;
• target controller or processor;
• locations;
• powers;
• personnel;
• operational command;
• timetable;
• evidence procedures;
• confidentiality;
• translation;
• costs;
• security;
• incident response;
• liability;
• reporting;
• completion method.

Illustration

A joint operation involves simultaneous inspections in France and Germany. The plan should clarify:

• who leads each site;
• whether evidence will be copied or viewed;
• how matching evidence sets are created;
• how privileged material is filtered;
• where the master record is stored;
• which authority communicates with the controller;
• how findings enter the Article 60 case. Without advance planning, authorities risk:
• duplicating questions;
• collecting inconsistent evidence;
• exceeding national powers;
• compromising confidentiality;
• creating disputes about responsibility.

---

21. Evidence collected during a joint operation

Article 62 does not provide a complete evidential code. National law and the joint-operation plan must address:

• who formally collects evidence;
• who holds original documents;
• chain of custody;
• authenticity;
• translation;
• access by participating authorities;
• use in administrative decisions;
• use in court;
• retention;
• destruction or return.

Illustration

French officials identify relevant emails during an inspection in Germany. The German host authority may need to:

• formally copy the emails;
• create an inventory;
• verify integrity;
• record the source;
• store the evidence;
• provide lawfully authorised copies to France or the lead authority. If French officials simply take unrecorded copies home, admissibility, confidentiality and purpose-limitation problems may arise.

21.1 Rights of defence

The controller or processor should be able to understand:

• which evidence is relied upon;
• how it was obtained;
• which authority collected it;
• whether procedural safeguards were followed;
• how to challenge it.

Joint operations should not obscure accountability by allowing every authority to blame another for evidential defects.

22. Interviews during joint operations

A joint team may interview:

• executives;
• DPOs;
• engineers;
• security staff;
• local managers;
• processors;
• witnesses.

The action plan should determine:

• who asks questions;
• whether statements are voluntary or compelled;
• applicable warnings;
• rights to legal assistance;
• recording method;
• language and interpretation;
• signature or confirmation;
• handling of self-incrimination concerns.

[!example] Illustration A Spanish official asks questions during an inspection hosted in Italy. The interview remains governed by Italian host law. The Spanish official cannot apply a Spanish procedural rule inconsistent with Italian safeguards.

23. Joint enforcement is not joint punishment without process

The phrase “joint enforcement measures” must be read with Articles 58, 60, 65, 66 and national procedural law.

A joint team cannot simply decide on-site that:

• the controller is guilty;
• an EEA-wide fine is immediately due;
• processing must permanently stop throughout Europe.

A final cross-border decision ordinarily requires:

• completed investigation;
• right to be heard;
• draft decision;
• consultation of concerned authorities;
• objection process;
• EDPB resolution if needed;
• formal adoption and notification.

Joint operational activity supports that process. It does not replace due process.

24. Article 62(4): Host-state responsibility and liability

Paragraph 4 provides that when seconded staff operate in another Member State, the host Member State assumes responsibility for their actions, including liability for damage caused during the operation, under the law of the state where the operation occurs.

This rule protects third parties.

A person harmed during a joint operation should not need to untangle internal arrangements among several foreign regulators before seeking compensation. The host state is the immediate public-law point of responsibility.

Illustration

During a German-hosted inspection, a seconded French official:

• negligently destroys a server;
• discloses confidential information;
• unlawfully copies unrelated personal data;
• causes physical damage to equipment. Under paragraph 4, Germany assumes responsibility under German law because the operation occurred there.

---

25. Meaning of “responsibility” and “liability”

The provision refers to both responsibility and liability.

Responsibility is broader. It indicates that the host state is institutionally accountable for seconded personnel’s operational conduct.

Liability concerns the legal obligation to repair damage, typically through compensation or another remedy.

Possible damage may include:

• property damage;
• financial loss;
• unlawful disclosure;
• loss caused by wrongful interruption of systems;
• harm to third parties;
• damage to the controller or processor.

The exact conditions for compensation are governed by the law of the state where the damage occurred.

25.1 Damage must arise during operations

The rule concerns damage caused during the joint operation.

A loose connection with the operation may not be sufficient.

[!example] Illustration A seconded official causes damage while copying evidence at the inspected office. Paragraph 4 clearly applies. The same official causes an unrelated road accident while privately sightseeing after the operation. Ordinary national liability rules may apply, but the event is not necessarily damage caused during the joint operation.

26. The wording issue in paragraph 4

Paragraph 4 refers to staff operating in another Member State “in accordance with paragraph 1.” The supplied commentary argues that this might exclude operations arising under paragraph 2.

That interpretation would create a serious gap because paragraph 2 does not create a completely separate category of operation. It regulates participation rights and invitations within the broader category of joint operations established by paragraph 1.

The better systemic interpretation is:

• paragraph 1 establishes joint operations generally;
• paragraph 2 governs who has participation rights in qualifying operations;
• paragraph 4 applies when seconded staff operate abroad in a joint operation.

Otherwise, liability protection would depend irrationally on whether participation resulted from a voluntary invitation or a statutory participation right.

A narrow literal reading should therefore be avoided where it defeats the protective purpose of paragraphs 4 to 6.

27. Article 62(5): Compensation to the injured person

The Member State where the damage was caused must compensate the injured person under the same conditions applicable to damage caused by its own staff.

This reflects equal treatment.

[!example] Illustration A German official and a seconded French official both negligently damage equipment during a German-hosted operation. The injured company should not face weaker compensation rules merely because the immediate act was performed by the French official. Germany compensates under the rules applicable to damage caused by German public officials. The external claimant deals with the host state. Internal reimbursement is addressed separately.

28. Internal reimbursement by the seconding state

After the host state compensates the injured person, the seconding Member State whose staff caused the damage must reimburse the host state in full.

This separates two relationships:

External relationship

The host state compensates the injured person.

Internal relationship

The seconding state reimburses the host state.

Illustration

During a Netherlands-hosted operation:

• a Belgian seconded official causes €100,000 of compensable damage;
• the Netherlands pays the injured party €100,000;
• Belgium reimburses the Netherlands in full. This arrangement protects the injured person from an interstate liability dispute while ultimately placing the financial burden on the state whose staff caused the harm.

---

29. What if several officials caused the damage?

Article 62 does not expressly explain allocation where damage results from:

• combined acts of host and seconded personnel;
• several seconding authorities;
• defective host instructions;
• shared technical failure;
• inability to identify the individual actor.

The participating states may need to resolve allocation under:

• applicable national law;
• the operation agreement;
• general EU-law principles;
• negotiated settlement;
• judicial procedures where necessary.

Illustration

A data set is unlawfully published because:

• the host authority approved release;
• a visiting official chose the wrong file;
• another authority failed to apply required redaction. Full reimbursement by one seconding state may not reflect the facts. The authorities should investigate causation and use their agreed dispute-resolution mechanism. The external claimant’s right against the host should not be delayed by this internal complexity.

---

30. Article 62(6): No routine reimbursement claims

Paragraph 6 states that, except for the specific paragraph 5 reimbursement rule, Member States should refrain from requesting reimbursement from one another for Article 62(4) damage.

Its purpose is to prevent a chain of routine interstate claims that would discourage cooperation.

Illustration

A joint operation creates administrative costs, minor inconvenience or internal expenditure without triggering the paragraph 5 damage mechanism. The participating state should not automatically invoice every other state for its share.

30.1 Rights against third parties remain

Paragraph 6 preserves rights against third parties.

[!example] Illustration Damage is partly caused by an external forensic contractor that supplied defective software. The host state may retain rights against that contractor under the applicable contract or tort law.

31. Liability and unlawful instructions

Difficult questions arise where:

• the host instructs the visiting official to act;
• the instruction is unlawful;
• the seconded official follows it;
• damage results.

Paragraph 4 places external responsibility on the host. Paragraph 5 refers to reimbursement where staff of the seconding authority caused the damage.

The internal allocation may turn on:

• causation;
• knowledge;
• operational control;
• whether the instruction was manifestly unlawful;
• host and seconding duties;
• the action plan;
• national law.

This illustrates why Article 62 liability rules should be supplemented by a detailed operational agreement.

32. Confidentiality during joint operations

Joint operations involve direct access to sensitive materials.

Participating personnel may see:

• personal data;
• health information;
• trade secrets;
• source code;
• security vulnerabilities;
• legal advice;
• whistleblower identities;
• investigation strategy.

All officials remain subject to professional-secrecy obligations under Article 54 and the host-state rules applicable under Article 62(3).

The operation plan should regulate:

• access levels;
• secure devices;
• copying;
• retention;
• onward sharing;
• remote access;
• return or deletion;
• public communication.

The EDPB internal document expressly includes confidentiality, transparency, publicity, information retention and reuse among the operational matters that authorities should address.

33. Legal privilege and professional secrecy

The host state’s rules on legal professional privilege and equivalent secrecy obligations apply.

Illustration

During an inspection of a technology company, the joint team encounters confidential advice from the company’s external lawyer. The team should follow the host-state process, which may involve:

• sealing the material;
• independent privilege review;
• redaction;
• judicial determination;
• exclusion from the investigation file. A visiting official cannot apply a narrower concept of privilege from the home state if host law provides stronger protection. The same reasoning may apply to:
• medical secrecy;
• journalistic sources;
• banking confidentiality;
• judicial records.

---

34. Public communications

A joint operation may attract media attention.

Authorities should agree in advance:

• whether the operation will be announced;
• which authority speaks publicly;
• how ongoing-investigation confidentiality is protected;
• how differing national transparency laws are reconciled;
• whether the controller is named;
• how inaccurate speculation is corrected.

Illustration

One participating authority announces that the controller “committed a serious GDPR violation” before the investigation is complete. That statement may:

• prejudice the process;
• undermine the presumption of impartiality;
• affect rights of defence;
• conflict with the host authority’s legal position. A coordinated communication policy reduces these risks.

---

35. Language and translation

Joint teams may operate in several languages.

The action plan should address:

• working language;
• translation of evidence;
• interpreters;
• interview language;
• certified translations;
• responsibility for checking accuracy;
• translation costs;
• language of the final report.

Illustration

A witness gives evidence in Polish, the host file is maintained in German and the lead authority works in Dutch. A reliable translation process is necessary so that:

• investigators understand the evidence;
• the controller can respond;
• concerned authorities can assess it;
• courts can review it. A mistranslated technical term may materially change the legal analysis.

---

36. Costs

Article 62 contains liability rules but no detailed general cost-allocation system for ordinary joint-operation expenses.

Participating authorities should agree on:

• travel;
• accommodation;
• interpretation;
• external experts;
• forensic equipment;
• secure facilities;
• technical licences;
• staff time.

The EDPB internal document lists costs as a matter for the general terms and conditions of joint operations.

A practical approach may be:

• each authority bears the ordinary costs of its own staff;
• exceptional shared expenses are allocated by agreement;
• urgent action is not delayed by unresolved minor costs.

37. Withdrawal from a joint operation

An authority may need to withdraw because of:

• loss of competence;
• conflict of interest;
• resource emergency;
• legal prohibition;
• change in the operation’s scope;
• inability to accept conferred powers.

The operation plan should require:

• written notice;
• reasons;
• transfer of outstanding work;
• continued confidentiality;
• handling of evidence already obtained;
• impact on participation rights;
• replacement arrangements.

Withdrawal should not be used strategically to avoid disagreement within the Article 60 process.

38. Article 62(7): Failure to invite or respond

Paragraph 7 applies where:

• a joint operation is intended; and
• a supervisory authority does not comply within one month with the second sentence of paragraph 2.

The second sentence of paragraph 2 requires the competent authority to:

• invite relevant authorities; and
• respond without delay to participation requests.

If that obligation is not fulfilled within one month, the other authorities may:

1. adopt territorial provisional measures under Article 55;
2. rely on presumed urgency under Article 66(1);
3. request an EDPB opinion or urgent binding decision under Article 66(2).

39. What counts as non-compliance?

Non-compliance may include:

• failure to invite a qualifying authority;
• silence on a participation request;
• unjustified exclusion;
• a nominal invitation that prevents meaningful participation;
• unreasonable delay beyond one month.

Illustration

The lead authority invites France but refuses to provide:

• the operation plan;
• date;
• evidence;
• access arrangements;
• any actual role. If the invitation is purely formal and makes participation impossible, it may not constitute genuine compliance.

39.1 The one-month rule

Paragraph 2 says the authority must respond “without delay.” Paragraph 7 adds a one-month trigger for provisional action.

This means:

• the authority should ordinarily respond earlier than one month;
• one month is not the normal response target;
• it is the point at which the statutory urgency consequence becomes available.

40. Provisional measures remain national and temporary

An excluded authority may adopt a provisional measure only within its own territory.

Illustration

The Spanish authority is wrongly excluded from an operation involving a platform substantially affecting Spanish users. It may impose a temporary protective measure in Spain, subject to Article 55 and Article 66. It does not automatically obtain power to issue a permanent EEA-wide decision or take control of the entire case. Possible provisional measures include:

• temporary processing restriction;
• local suspension;
• urgent local order;
• territorial ban for a limited period. The measure must remain:
• necessary;
• proportionate;
• connected to the risk;
• temporary;
• reviewable.

---

41. Opinion or urgent binding decision

Article 62(7) differs from Article 61(8).

Article 61(8), concerning silence on mutual assistance, refers to an urgent binding EDPB decision.

Article 62(7) expressly refers to an opinion or an urgent binding decision under Article 66(2).

The supplied commentary incorrectly states that Article 62(7) necessarily requires a binding decision and leaves no choice. The statutory text allows either:

• an urgent opinion; or
• an urgent binding decision.

Which route is appropriate depends on whether the requesting authority seeks:

• rapid interpretive guidance; or
• a binding measure requiring action throughout the European cooperation framework.

42. Presumed urgency does not mean unlimited power

Failure to invite or respond creates a presumption of urgent need. It does not automatically establish:

• the merits of the alleged infringement;
• the lawfulness of every proposed measure;
• territorial competence beyond Article 55;
• entitlement to a permanent ban;
• entitlement to a particular fine.

[!example] Illustration A lead authority fails to answer a participation request concerning a minor privacy-notice inconsistency. The excluded authority may rely on the statutory urgency route, but it still must choose a measure proportionate to the actual risk. Shutting down the controller’s entire service would ordinarily be excessive.

43. Distinguishing Article 62 joint operations from coordinated enforcement

The EDPB also operates a Coordinated Enforcement Framework under which authorities choose an annual priority and conduct coordinated fact-finding, investigations or follow-up activities using common methodologies.

Examples

have included:

• public-sector cloud use;
• designation and position of DPOs;
• handling of access rights;
• implementation of erasure rights. The framework is designed to streamline cooperation, but participation in annual coordinated actions is generally voluntary. Not every coordinated enforcement action is necessarily an Article 62 joint operation.

Coordinated but separate activity

Authorities use a common survey and investigate different national organisations independently.

Article 62 joint operation

Officials from several authorities participate in the same investigation or enforcement operation, potentially exercising powers on the host state’s territory.

The distinction matters because Article 62 activates specific rules concerning:

• participation rights;
• host guidance;
• visiting personnel;
• applicable law;
• liability;
• provisional measures.

44. Joint operation involving a processor

Article 62 applies to controllers and processors.

Illustration

Hundreds of EEA controllers use the same cloud processor. A security flaw at the processor affects data throughout Europe. A joint operation may focus on:

• processor security;
• subprocessor governance;
• breach response;
• access controls;
• deletion;
• controller instructions;
• cross-border transfers. The processor’s lead authority may coordinate the processor-focused operation, but individual controller cases may have different lead authorities. The operation plan must define whether it concerns:
• processor obligations;
• one controller’s instructions;
• several controllers;
• systemic service design. A joint operation should not blur separate legal responsibilities.

---

45. Joint controllers

Where several entities jointly determine purposes and means, the relevant authorities may need to investigate:

• common decisions;
• allocation of responsibilities;
• transparency;
• exercise of rights;
• technical implementation.

Illustration

A French retailer and German advertising platform jointly design in-store tracking. A joint operation may be appropriate because:

• evidence about purpose is in France;
• technical means are controlled in Germany;
• users are affected in several states. The authorities must still determine:
• each entity’s controller role;
• whether an Article 26 arrangement exists;
• which establishment implemented decisions;
• which authority leads the Article 60 procedure. Article 62 assists fact-finding. It does not itself determine controllership.

---

46. Joint operations and courts

Article 55(3) excludes ordinary supervisory authorities from supervising courts acting in their judicial capacity.

A joint operation cannot circumvent that limitation.

[!example] Illustration Several authorities want to inspect the judicial case-management system used by courts during adjudication. Article 62 does not create competence that Article 55 removes. Judicial oversight structures and national law must be considered. Administrative court processing, such as payroll or procurement, may still fall within ordinary supervisory competence, depending on the operation.

47. Joint operations and non-EEA controllers

A controller outside the EEA may be subject to Article 3(2) without having a qualifying EEA main establishment.

In such cases, the normal lead-authority mechanism may not apply. Article 62(2)’s invitation rule refers to an authority competent under Article 56(1) or (4), which may be absent.

However, authorities may still cooperate through:

• Article 61;
• coordinated national investigations;
• Article 50 international cooperation;
• other lawful mechanisms.

Article 62’s full structure is most naturally connected to cases with an EEA establishment and Article 56 competence.

Authorities should not assume that appointing an Article 27 representative creates a main establishment or lead authority.

48. A complete practical example

Assume a hotel group has:

• its main establishment in Italy;
• operational establishments in France, Germany and Spain;
• one Europe-wide facial-recognition programme;
• biometric servers in Germany;
• enrolment devices in every hotel;
• complaints in France and Spain.

Step 1: Competence

The Italian authority is identified as lead because the Italian establishment genuinely determines and implements the Europe-wide processing policy.

Step 2: Need for joint operation

A joint operation is appropriate because:

• processing occurs across several establishments;
• evidence is distributed;
• large numbers of guests are affected;
• technical infrastructure is in Germany;
• local enrolment practices vary.

Step 3: Invitations

Italy must invite the relevant French, German and Spanish authorities.

Step 4: Action plan

The authorities agree that:

• Germany hosts the technical inspection;
• France reviews guest notices;
• Spain examines consent and complaint handling;
• Italy coordinates evidence and the Article 60 procedure.

Step 5: Host-state operation

Dutch technical specialists with relevant biometric expertise are also seconded with proper authority. Germany permits them to assist under German-conferred powers.

They act:

• under German guidance;
• in the presence of German staff;
• in accordance with German law.

Step 6: Findings

The team discovers:

• templates are kept indefinitely;
• consent is bundled with check-in;
• guests cannot use a realistic alternative;
• templates are transferred abroad;
• the DPIA is incomplete.

Step 7: Evidence

Germany formally records and preserves the technical evidence. Participating authorities receive authorised copies through secure channels.

Step 8: Article 60 decision

Italy prepares a draft decision. Concerned authorities review it and may object under Article 60.

Step 9: Enforcement

The final decision requires:

• cessation of unlawful biometric processing;
• deletion of templates;
• notification to relevant recipients;
• revision of hotel procedures;
• a fine.

Step 10: Compliance operation

The authorities jointly verify implementation at selected hotels.

Step 11: Damage

During the German inspection, a seconded official negligently damages hardware.

Germany compensates the injured party under German law. The official’s seconding state reimburses Germany as required by Article 62(5).

This example demonstrates that Article 62 governs the operation and personnel, while Articles 56 and 60 govern competence and final decision-making.

49. Main grey areas

49.1 Meaning of “where appropriate”

The Article provides no fixed threshold. Authorities must assess proportionality, effectiveness and investigative need.

49.2 Meaning of “significant number”

No numeric threshold exists. Context, sensitivity and scale matter.

49.3 Scope of the participation right

The text grants a right but leaves practical participation arrangements largely to authorities.

49.4 Exercise of foreign powers

National laws differ on whether and how visiting officials may receive or use investigative powers.

49.5 Remote operations

The meaning of host “presence” in a digital investigation is not expressly defined.

49.6 Evidence

Article 62 does not harmonise chain of custody, admissibility or translation.

49.7 Liability

Allocation can become difficult where several officials or host instructions contribute to damage.

49.8 Article 62(4) wording

The reference to paragraph 1 creates textual ambiguity, but a systemic reading favours application to joint operations in which participation arises under paragraph 2.

49.9 Overall procedure

The Article does not prescribe a complete operating manual. The EDPB’s internal document fills significant practical gaps through an action-plan approach.

50. Corrections and cautions concerning the supplied commentary

Several aspects of the supplied commentary should be qualified.

First, paragraph 2 does not necessarily make the joint operation itself mandatory in every qualifying case

Paragraph 1 still says “where appropriate.” Once a joint operation is intended and paragraph 2’s conditions are met, relevant authorities receive participation rights and the competent authority must invite them.

Second, the participation right should not be reduced through unstated exceptions

Proportional operational arrangements are possible, but the text does not expressly create broad “seriousness” or convenience grounds for exclusion.

Third, home-state powers cannot automatically be exercised abroad

Host-state law must permit their exercise, and host officials must guide and remain present.

Fourth, visiting personnel are governed operationally by host law

They cannot rely on the more permissive law of their home state to avoid host safeguards.

Fifth, paragraph 4 should not be read as excluding paragraph 2 operations

Paragraph 2 regulates participation within the joint operations established by paragraph 1. A narrow contrary interpretation would undermine the liability scheme.

Sixth, Article 62(7) allows either an EDPB opinion or an urgent binding decision

Unlike Article 61(8), the text does not mandate only a binding outcome.

Seventh, joint enforcement does not bypass Article 60

Cross-border infringement findings and final corrective decisions must still follow the relevant cooperation, objection and due-process structure.

51. Practical checklist for organising a joint operation

Before commencing an operation, authorities should determine:

Legal basis

• Is Article 62 appropriate?
• Is the matter cross-border?
• Which authority is competent under Article 56?
• Which authorities have participation rights?

Necessity

• What will joint participation add?
• Can Article 61 assistance achieve the same result?
• Is simultaneous action necessary?
• Are specialist skills required?

Participation

• Which authorities must be invited?
• Have participation requests been answered?
• Is participation physical, remote or mixed?
• Are limitations objectively justified?

Powers

• Who is the host?
• Who is seconding staff?
• May host powers be conferred?
• May home-state powers be exercised?
• Has the seconding authority authorised its personnel?
• Will host officials guide and remain present?

Procedure

• Are warrants required?
• How will privilege be handled?
• What hearing rights apply?
• What evidence procedures apply?
• How will personal data be protected?

Operations

• What is the scope?
• Who directs the team?
• What is the timetable?
• What equipment may be used?
• How will incidents be managed?

Information

• What may be shared?
• What confidentiality level applies?
• How long will evidence be retained?
• What reuse is permitted?

Liability

• Which state assumes external responsibility?
• How will damage be recorded?
• What reimbursement rules apply?
• Is insurance or expert indemnity relevant?

Completion

• Who drafts the operation report?
• How do findings enter the Article 60 process?
• How will compliance be monitored?
• How may a participant withdraw?

Conclusion

Article 62 turns European data protection cooperation into operational reality. It allows supervisory authorities to:

• investigate together;
• inspect systems together;
• contribute specialist staff;
• exercise carefully controlled investigative powers across borders;
• coordinate enforcement;
• verify implementation of decisions. At the same time, it preserves national sovereignty and legal safeguards. Visiting officials cannot operate independently. They require:
• host-state permission;
• seconding-authority authorisation;
• host guidance;
• host presence;
• compliance with host-state law. Where damage occurs, the host state compensates the injured person under its own rules, while the seconding state whose staff caused the damage reimburses the host. Where a qualifying authority is excluded and the responsible authority fails to comply within one month, territorial provisional measures and the Article 66 urgency route become available. The simplest explanation is:

Article 61 allows one authority to ask another authority to do something. Article 62 allows them to do it together.

Article 62 does not create a European enforcement team floating above national law. It creates a controlled joint team operating through the host authority’s legal system. This design allows expertise and evidence to move across borders while ensuring that compulsory public powers remain supervised, lawful and accountable.

A well-run joint operation can produce:

• a stronger common factual record;
• fewer duplicated investigations;
• better technical analysis;
• more consistent enforcement;
• effective monitoring across several establishments;
• greater trust among supervisory authorities.

A poorly planned operation can create:

• unlawful evidence collection;
• competing instructions;
• confidentiality breaches;
• disputes over powers;
• uncertainty over liability;
• procedural unfairness.

For that reason, the real key to Article 62 is not simply that authorities may work together. It is that they must define, before acting, who participates, who leads, which powers are used, which law applies, how evidence is handled and who bears responsibility.