Article 63 — Consistency mechanism

Article 63 is only one sentence long, but it establishes one of the GDPR’s most important institutional safeguards. It ensures that the GDPR is not interpreted as twenty-seven substantially different national laws merely because national supervisory authorities enforce it.

The Article creates the foundation for a European-level consistency system. Through that system, supervisory authorities cooperate with one another, the European Data Protection Board gives opinions or binding decisions, and the European Commission participates where relevant. Article 63 is therefore best understood as the gateway to Articles 64, 65 and 66, rather than as a self-contained procedure.

1. The text and its basic meaning

Article 63 provides:

“In order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities shall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set out in this Section.”

In plain language, it means:

National data protection authorities must use a European cooperation and review system when an issue is likely to affect GDPR interpretation or enforcement beyond one Member State.

The Article contains five important ideas:

1. the objective is consistent GDPR application;
2. consistency is required throughout the Union;
3. supervisory authorities must cooperate;
4. the Commission participates where relevant;
5. the detailed mechanism is found in the following provisions.

The provision is framed in mandatory language. Supervisory authorities“shall cooperate.” Where the conditions in Articles 64, 65 or 66 are met, the relevant authority cannot simply decide that European consistency review is inconvenient.

2. Why the consistency mechanism was necessary

Before the GDPR, EU data protection was principally governed by Directive 95/46. A directive required national implementation. Member States could therefore produce materially different national laws and enforcement practices.

The GDPR changed the legal structure. It is directly applicable throughout the EEA. But directly applicable legal text does not automatically produce uniform interpretation.

Different supervisory authorities may still disagree about:

• what constitutes valid consent;
• when a DPIA is required;
• whether an organisation is a controller or processor;
• how administrative fines should be calculated;
• whether a code of conduct provides sufficient safeguards;
• whether contractual transfer clauses should be authorised;
• where a controller has its main establishment;
• whether a particular processing operation infringes the GDPR.

[!example] Illustration The French authority considers that a particular advertising model requires consent. The German authority considers that legitimate interests may be used. The Irish authority approves the model under contract. The Spanish authority prohibits it entirely. If the processing model is used throughout Europe, these divergent interpretations create two serious problems. First, individuals receive different levels of protection depending upon where they live. Second, controllers face inconsistent legal requirements within a market that is supposed to operate under one Regulation. Article 63 and the provisions following it address this risk. The EDPB describes the consistency mechanism as a system ensuring that certain national decisions are consistent with one another and with the GDPR interpretation shared by supervisory authorities. Its public register includes consistency opinions, binding decisions and related national decisions.

3. Consistency does not mean complete uniformity in every national detail

The GDPR seeks consistent application, but this does not mean that every national authority must reach identical conclusions in factually different cases.

The Regulation itself allows Member States to adopt more specific rules in areas such as:

• employment processing;
• freedom of expression;
• health data;
• professional secrecy;
• national identification numbers;
• public access to official documents;
• research and archiving.

National procedural law also continues to regulate matters not fully harmonised by the GDPR, including:

• administrative hearings;
• evidence;
• court appeals;
• limitation periods;
• enforcement procedures;
• access to administrative files.

Consistency therefore means that the common GDPR rules and concepts should be interpreted coherently. It does not mean that every national legal difference disappears.

Illustration

Two employers monitor workers in different countries. In Country A, specific employment legislation permits limited monitoring subject to worker representation. Country B has stricter employment-data rules under Article 88. The national outcomes may differ without necessarily violating Article 63. What must remain consistent is the application of shared concepts such as:

• necessity;
• transparency;
• proportionality;
• data minimisation;
• security;
• accountability. The consistency mechanism should prevent contradictory interpretations of the GDPR, not erase lawful national specifications expressly permitted by the Regulation.

---

4. Article 63 is a framework provision

Article 63 does not itself explain:

• who refers a matter;
• when referral is mandatory;
• when referral is optional;
• whether the EDPB issues an opinion or binding decision;
• applicable deadlines;
• voting requirements;
• what happens in urgent cases.

Those details appear in Articles 64 to 66.

The consistency mechanism has three principal pathways.

Pathway 1: EDPB opinions under Article 64

The EDPB gives an opinion on specified draft measures or on other matters of general application or multi-state effect.

Pathway 2: Binding dispute resolution under Article 65

The EDPB adopts a binding decision where supervisory authorities cannot resolve specified disagreements.

Pathway 3: Urgent action under Article 66

A supervisory authority may take temporary territorial action in exceptional circumstances and seek an urgent EDPB opinion or binding decision.

Article 63 supplies the common purpose connecting these mechanisms: consistent GDPR application throughout the Union.

5. The cooperation mechanism and consistency mechanism are different

A crucial distinction is between:

• cooperation under Articles 60 to 62; and
• consistency under Articles 63 to 66.

They overlap, but they are not the same.

Cooperation

Cooperation concerns authorities working together in handling cases. It includes:

• lead-authority cooperation;
• information exchange;
• mutual assistance;
• joint investigations;
• joint operations.

Consistency

Consistency concerns formal European review or dispute resolution where:

• a draft regulatory measure has wider European importance;
• a matter of general application requires an EDPB opinion;
• authorities disagree in a one-stop-shop case;
• authorities disagree about competence;
• a required opinion was not requested or followed;
• urgent European-level action is needed.

[!example] Illustration The Dutch authority asks the Belgian authority to inspect a processor’s Belgian office. That is Article 61 mutual assistance. The Dutch authority prepares national standard contractual clauses intended for broad use. That draft must be referred to the EDPB for an Article 64 opinion. The Irish lead authority and German concerned authority disagree about whether an online platform infringed Article 6. That dispute may move from Article 60 cooperation to an Article 65 binding decision. The first situation is operational assistance. The next two engage formal consistency procedures.

6. Recital 135 and measures producing legal effects

Recital 135 states that the consistency mechanism should apply particularly where a supervisory authority intends to adopt a measure producing legal effects concerning processing that substantially affects a significant number of data subjects in several Member States.

Two elements are important:

1. the measure is intended to produce legal effects; and
2. the processing has substantial multi-state impact.

6.1 Measure producing legal effects

A measure produces legal effects where it changes, determines or authoritatively affects legal rights or obligations.

Examples

include:

• approval of binding corporate rules;
• authorisation of bespoke transfer clauses;
• adoption of standard contractual clauses;
• approval of certification criteria;
• approval of a European code of conduct;
• a binding enforcement order;
• an administrative fine;
• a definitive processing prohibition. By contrast, a general educational leaflet usually does not itself change legal rights or obligations.

Illustration

A supervisory authority publishes a non-binding blog post explaining its preliminary view of website cookies. The post may influence behaviour, but it does not necessarily produce binding legal effects. If the same authority formally adopts standard clauses that controllers may rely upon for international transfers, that measure has clear legal consequences and may require Article 64 review.

6.2 Substantial effect on a significant number of individuals

The recital addresses measures with more than marginal cross-border importance.

A substantial effect may involve:

• denial of services;
• behavioural profiling;
• processing of sensitive data;
• automated employment decisions;
• large-scale public surveillance;
• exposure to identity theft;
• loss of confidentiality;
• serious restriction of data subject rights.

A “significant number” has no fixed numerical threshold. The assessment depends on:

• the service;
• affected population;
• sensitivity;
• seriousness;
• geographical reach;
• vulnerability of affected persons.

[!example] Illustration A draft measure concerns genetic-data processing affecting 20,000 rare-disease patients across eight Member States. The number may not be enormous compared with a large social network, but it may still be significant because the group is specific and the data particularly sensitive.

7. Recital 138: Mandatory use as a condition of lawfulness

Recital 138 contains an especially important rule:

Where use of the consistency mechanism is mandatory, its application is a condition for the lawfulness of the supervisory authority’s measure.

This means that mandatory referral is not a minor administrative formality.

Illustration

A supervisory authority adopts standard contractual clauses under Article 46(2)(d) without obtaining the required Article 64 opinion. Even if the authority believes its clauses are substantively excellent, the measure suffers from a serious procedural defect because the mandatory European consistency step was omitted. The principle can be expressed simply: If European review is legally required before the national authority acts, the authority cannot lawfully skip that review. Recital 138 also clarifies that not every cross-border matter requires the formal consistency mechanism. Ordinary cases may remain within:

• Article 60 lead-authority cooperation;
• Article 61 mutual assistance;
• Article 62 joint operations. The consistency mechanism is therefore a targeted escalation tool, not a mandatory EDPB review of every GDPR investigation.

---

8. Article 64(1): Mandatory EDPB opinions

Article 64(1) lists draft measures that must be submitted to the EDPB for an opinion.

These include measures concerning:

1. DPIA lists under Article 35(4);
2. transnational codes of conduct under Article 40(7);
3. accreditation criteria for code-monitoring or certification bodies;
4. standard data protection clauses under Articles 28(8) and 46(2)(d);
5. authorisation of bespoke contractual clauses under Article 46(3)(a);
6. approval of binding corporate rules under Article 47.

The EDPB must issue an opinion on these specified draft decisions. Article 64 also establishes electronic submission, standardised information, voting and timing rules.

9. Why these measures require consistency review

The listed measures can have effects beyond one national case.

9.1 DPIA lists

A national authority must establish a list of processing operations requiring a DPIA.

If each authority uses radically different criteria, the same Europe-wide processing could require a DPIA in one country but not another.

Illustration

France places large-scale employee location monitoring on its DPIA list. Germany excludes it. Spain applies the requirement only to public employers. The EDPB opinion process helps prevent unjustified inconsistency.

9.2 Transnational codes of conduct

A code of conduct may apply to controllers or processors in several Member States.

A weak code approved in one state could influence processing throughout the EEA.

Illustration

A European cloud-industry association drafts a code covering security, subprocessors and international transfers. The approval cannot be treated as purely national because organisations throughout Europe may rely upon it.

9.3 Accreditation criteria

Certification and monitoring bodies may operate or influence trust across borders. Different standards of independence and expertise could undermine confidence.

9.4 Standard contractual clauses

Clauses adopted by one authority may be used broadly by controllers and processors.

European review reduces the risk of incompatible national contract sets.

9.5 Bespoke transfer clauses

A transaction-specific clause may nevertheless affect data subjects or establishments in several states. The EDPB examines whether the safeguards provide a consistent level of protection.

9.6 Binding corporate rules

BCRs govern internal transfers across multinational groups. By their nature, they normally involve multiple jurisdictions.

The EDPB continues to issue Article 64 opinions on draft BCR decisions and similar consistency instruments. Its public documents register includes numerous such opinions and binding decisions.

10. Article 64 opinions are not the same as binding Article 65 decisions

An Article 64 opinion and an Article 65 binding decision perform different legal functions.

Article 64 opinion

The EDPB advises on the proposed measure before final national adoption.

The competent authority must take utmost account of the opinion and communicate whether it will maintain or amend its draft.

Article 65 decision

The EDPB resolves a specified dispute and its decision is binding on the supervisory authorities concerned.

[!example] Illustration The French authority submits draft accreditation criteria. The EDPB recommends additional independence safeguards. That is an Article 64 opinion. The Irish lead authority refuses to follow Germany’s relevant and reasoned objection concerning unlawful profiling. The EDPB resolves the disagreement under Article 65. That is a binding decision. The supplied commentary correctly distinguishes broad advisory consistency from binding dispute resolution, but the difference should not be expressed as if an Article 64 opinion were merely optional advice. An authority must take utmost account of it, and refusal to obtain or follow a required opinion may itself trigger Article 65(1)(c).

11. Article 64(2): Optional referral of general or multi-state matters

Article 64(2) provides a broader opinion route.

A request may be made by:

• any supervisory authority;
• the Chair of the EDPB;
• the European Commission.

The matter must be:

• of general application; or
• capable of producing effects in more than one Member State.

The EDPB’s internal guidance treats these as distinct but potentially overlapping conditions and examines their relationship with the ordinary cooperation procedures.

11.1 Matter of general application

A matter has general application where it goes beyond one organisation or individual dispute and raises a question relevant to a broader class of processing.

Examples

may include:

• interpretation of legitimate interests for AI training;
• consent-or-pay models;
• controller responsibility for connected devices;
• use of biometric identification in public spaces;
• international transfers under a new type of contract;
• handling of rights requests involving large language models.

Illustration

A national authority encounters one complaint about an AI assistant reproducing personal information. If the case raises a general question about how access, rectification and erasure apply to generative systems, the authority may request an Article 64(2) opinion. The matter originates in one case but has broader legal application.

11.2 Matter producing effects in more than one state

A matter may not create a universal rule but may still affect several Member States.

[!example] Illustration A cross-border health-data infrastructure is used in six states. A proposed supervisory measure concerns only that network. The issue may not be “general” for all controllers, but it clearly produces effects in more than one Member State.

12. Failure of mutual assistance or joint operations

Article 64(2) expressly identifies non-compliance with:

• Article 61 mutual assistance; or
• Article 62 joint-operation obligations

as examples of matters that may be submitted to the EDPB.

[!example] Illustration The Swedish authority repeatedly asks another authority to inspect a local establishment. The requested authority neither acts nor gives a lawful refusal. The Swedish authority may use the Article 61 emergency route where applicable. It or another entitled actor may also request an EDPB opinion under Article 64(2) concerning the broader cooperation failure. Likewise, a qualifying authority improperly excluded from an Article 62 operation may seek European-level scrutiny. This shows that the consistency mechanism does not address only substantive privacy law. It also supports consistent and effective regulator-to-regulator cooperation.

13. Conditions for an Article 64(2) request

An Article 64(2) request should not be a disguised attempt to obtain an abstract advisory opinion on every difficult question.

A proper request should explain:

• the matter;
• its general or multi-state character;
• material facts;
• legal questions;
• existing supervisory views;
• reasons EDPB examination is needed;
• relationship with any pending cooperation case;
• practical consequences.

Poor request

“What does fairness mean under the GDPR?”

That question is too broad and abstract.

More appropriate request

“Several supervisory authorities have adopted conflicting positions on whether a subscription alternative can make behavioural-advertising consent freely given. The issue affects platforms operating in twelve Member States. An EDPB opinion is requested on the relevant voluntariness factors.”

The EDPB should not ordinarily repeat an opinion already issued on the same matter. Article 64(3) reflects the need to avoid unnecessary duplication.

14. Timing and adoption of Article 64 opinions

The EDPB normally adopts an Article 64 opinion:

• within eight weeks;
• by simple majority.

The period may be extended by six additional weeks because of the matter’s complexity.

Relevant information must be communicated electronically in a standardised format. It may include:

• a summary of facts;
• draft decision;
• reasons for the proposed measure;
• views of concerned authorities.

The EDPB Chair informs members and the Commission, and adopted opinions are made public.

14.1 Quality of the referral file

The EDPB cannot give a sound opinion if the referring authority provides:

• an incomplete draft;
• missing facts;
• no legal reasoning;
• no explanation of cross-border effects;
• no other authorities’ views.

Consistency requires a decision-ready file, not merely a request for the Board to perform the referring authority’s entire investigation.

15. What happens after an Article 64 opinion?

The competent authority must take the EDPB opinion into account to the high standard prescribed by the GDPR.

It should:

1. examine each material recommendation;
2. amend its draft where appropriate;
3. explain its response;
4. communicate the intended action to the EDPB Chair.

Illustration

The EDPB states that proposed certification criteria inadequately address:

• subprocessor oversight;
• high-risk transfers;
• complaint handling. The national authority should not simply say: “Opinion noted.” It should show whether and how the criteria were changed. If it refuses to follow the opinion, it must provide a reasoned position and face the possibility of Article 65(1)(c) dispute resolution.

---

16. Article 65: Binding dispute resolution

Article 65 is the authoritative branch of the consistency mechanism.

The EDPB must adopt a binding decision in three principal situations.

16.1 Unresolved relevant and reasoned objections

A concerned authority objects to a lead authority’s Article 60 draft, and the lead authority:

• does not follow the objection; or
• says the objection is not relevant or reasoned.

16.2 Conflict about competence

Authorities have conflicting views about which authority is competent for the main establishment.

16.3 Required opinion omitted or ignored

A competent authority:

• fails to request a mandatory Article 64(1) opinion; or
• fails to follow an Article 64 opinion.

Article 65 therefore enforces both substantive consistency and compliance with the consistency procedure itself.

17. Disputes over a lead authority’s draft

Suppose the Irish authority is lead for an online platform. It circulates a draft finding only a minor transparency infringement.

The German authority objects that:

• the platform also lacks a lawful basis;
• sensitive inferences are processed;
• the proposed corrective measure is ineffective.

If Ireland does not follow the relevant and reasoned objection, the matter goes to the EDPB.

The EDPB first determines whether the objection satisfies Article 4(24):

• Is it directly connected to the draft?
• Is it supported by factual and legal reasoning?
• Does it concern infringement or proposed action?
• Does it demonstrate significant risk?

If the threshold is met, the EDPB addresses the merits of the disputed issue.

The EDPB’s Article 65 Guidelines explain that its binding decision concerns all matters that are the subject of qualifying objections. Objections that fail the relevant-and-reasoned threshold do not open the merits to binding EDPB resolution under Article 65(1)(a).

18. Limits on the EDPB’s Article 65 role

The EDPB is not given unlimited power to redesign the entire national investigation.

Under Article 65(1)(a), its binding decision must concern matters that are the subject of relevant and reasoned objections.

Illustration

The draft concerns unlawful advertising and retention. A concerned authority properly objects to the retention analysis. The EDPB may decide the disputed retention issue. It should not automatically decide an unrelated cybersecurity matter that:

• did not appear in the draft;
• was not investigated;
• was not raised through a qualifying objection;
• was never put to the controller. This limitation protects:
• due process;
• rights of defence;
• institutional competence;
• the integrity of Article 60. However, an objection may identify that the lead authority failed to investigate an essential complaint issue. The EDPB may then require appropriate amendment or further consideration within the disputed scope.

---

19. Competence disputes under Article 65(1)(b)

Supervisory authorities may disagree over:

• where the main establishment is located;
• which establishment makes processing decisions;
• whether an EEA establishment can implement those decisions;
• which authority should serve as lead.

Illustration

A company claims Luxembourg is its main establishment because it is formally incorporated there. The French authority argues that:

• all relevant senior managers are in France;
• processing policies are approved in France;
• implementation authority lies in France;
• Luxembourg performs only administrative tasks. If the authorities cannot agree, the EDPB may issue a binding competence decision. This prevents controllers from benefiting from regulator forum shopping and prevents authorities from conducting competing lead-authority procedures.

---

20. Failure to seek or follow an Article 64 opinion

Article 65(1)(c) makes the consistency system enforceable.

Without this provision, a national authority might:

• adopt a measure;
• ignore the mandatory referral;
• proceed despite the EDPB opinion;
• undermine EEA consistency.

Any concerned supervisory authority or the Commission may communicate such a matter to the EDPB.

[!example] Illustration A national authority adopts standard contractual clauses without sending the draft to the EDPB. Another authority discovers that the clauses are being used throughout Europe. The issue may be escalated under Article 65. The EDPB’s binding intervention protects the mandatory nature of Article 64.

21. Procedure for binding decisions

Under Article 65:

• the EDPB normally has one month;
• that period may be extended by one further month because of complexity;
• the decision normally requires a two-thirds majority;
• if the EDPB cannot decide within the extended period, it has two more weeks and decides by simple majority;
• where votes are equally divided, the Chair’s vote decides.

The decision must:

• be reasoned;
• be addressed to the lead and concerned authorities;
• bind those authorities.

The supervisory authority then adopts its final national decision on the basis of the EDPB decision.

This creates a composite administrative process:

1. national investigation;
2. European-level dispute resolution;
3. final national implementation.

22. Procedural fairness in Article 65 proceedings

A binding EDPB decision may determine:

• whether an infringement occurred;
• whether an additional infringement must be found;
• whether corrective action is sufficient;
• whether a larger fine is required.

The procedure must therefore respect fundamental safeguards.

The EDPB’s Guidelines address:

• the right to good administration;
• right to be heard;
• access to the file;
• duty to give reasons;
• judicial remedies;
• completeness of the referral file.

Illustration

A concerned authority raises a new objection that the controller unlawfully processed health data. The controller has never been informed of that allegation. Before a binding outcome definitively relies on that issue, the controller should have a meaningful opportunity to respond to:

• the factual basis;
• legal characterisation;
• evidence;
• potential corrective consequences. Consistency cannot be achieved by sacrificing due process.

---

23. Judicial review of consistency decisions

Article 65 decisions are acts of an EU body. National supervisory decisions implementing them may also be challenged before national courts under Article 78.

A significant procedural issue has concerned whether an organisation can directly challenge an EDPB binding decision before the EU Courts, or only challenge the later national implementing decision.

On 10 February 2026, the CJEU held in Case C-97/23 P, WhatsApp Ireland v EDPB, that an organisation may directly challenge an Article 65 binding decision where the applicable standing conditions are satisfied. The Court treated such a decision as an EU act producing legal effects rather than merely an internal preparatory step, and referred the case back for examination on the merits.

This development reflects the composite nature of GDPR enforcement:

• the EDPB conclusively resolves specified European disputes;
• the lead authority adopts the final national decision;
• legal review may occur at EU level and national level in relation to the respective acts.

The two review tracks must be managed carefully to avoid contradictory judgments and duplication.

24. Article 66: Urgent consistency

Article 66 applies in exceptional circumstances where urgent action is necessary to protect individuals.

A supervisory authority may adopt provisional territorial measures without first completing the ordinary Article 63 process.

Such measures are generally:

• limited to the authority’s territory;
• temporary;
• valid for a maximum period prescribed by Article 66;
• communicated to the other authorities, EDPB and Commission.

The authority may request:

• an urgent EDPB opinion; or
• an urgent binding decision.

Illustration

A platform suddenly exposes live location data of protected witnesses across one Member State. Waiting for the full Article 60 and 65 sequence may create immediate danger. The local authority may temporarily restrict the processing and ask the EDPB for urgent action. Article 66 balances:

• immediate local protection; and
• eventual European consistency. It prevents formal harmonisation procedures from becoming a reason for regulatory paralysis.

---

25. Article 61 and Article 62 presumptions of urgency

The consistency framework also interacts with failures of cooperation.

Under Article 61(8), where a requested authority fails for one month to provide results or meaningful progress on mutual assistance:

• the requesting authority may adopt a territorial provisional measure;
• urgency is presumed;
• an urgent binding EDPB decision is required.

Under Article 62(7), where a qualifying authority is not properly invited into a planned joint operation or its participation request is not addressed within one month:

• it may adopt territorial provisional measures;
• urgency is presumed;
• it may seek an EDPB opinion or urgent binding decision.

These mechanisms show that consistency does not protect only controllers against fragmented regulation. It also protects individuals and authorities against obstruction or silence within the supervisory network.

26. The Commission’s role

Article 63 says authorities shall cooperate with the Commission“where relevant.”

The Commission is not an ordinary supervisory authority. It does not replace national DPAs in investigating private controllers under the GDPR.

Its role may include:

• requesting an Article 64(2) opinion;
• referring Article 65(1)(c) failures;
• participating in EDPB procedures without voting rights;
• receiving relevant information;
• exercising Treaty powers;
• proposing legislation;
• monitoring Member State compliance with EU law.

Recital 135 expressly states that the consistency mechanism is without prejudice to measures the Commission may take under the Treaties.

[!example] Illustration Several authorities systematically fail to cooperate, and national law appears to prevent effective GDPR enforcement. The Commission may participate through the consistency framework where relevant. Separately, it may consider infringement proceedings against the Member State under the Treaties. Article 63 does not replace the Commission’s constitutional enforcement powers.

27. The EDPB’s institutional role

The EDPB is not simply an informal meeting of national authorities. It is an EU body established under Article 68.

Within the consistency mechanism, it may:

• issue Article 64 opinions;
• adopt Article 65 binding decisions;
• issue urgent Article 66 opinions or decisions;
• publish consistency outcomes;
• maintain a register;
• develop common interpretation through guidance.

The EDPB’s documents register identifies outputs including:

• Article 64 opinions;
• Article 65 binding decisions;
• guidelines;
• national follow-up decisions.

The register’s function is to make European consistency activity visible and usable.

27.1 The EDPB is not a general first-instance regulator

The EDPB ordinarily does not:

• receive and investigate every individual complaint;
• replace the lead authority’s evidence-gathering role;
• issue every national fine;
• perform routine national inspections.

Its consistency role is triggered through the procedures provided in the GDPR.

28. Opinions, guidelines and binding decisions

These three EDPB outputs should not be confused.

Guidelines

Guidelines provide general interpretation and best practices. They are highly persuasive but not normally binding in the same way as an Article 65 decision.

Article 64 opinions

Opinions address specified draft measures or referred matters. Authorities must take them very seriously and, in the specified procedure, take utmost account of them.

Article 65 decisions

These are legally binding upon the supervisory authorities to which they are addressed.

[!example] Illustration The EDPB publishes guidance on legitimate interests. That guidance informs all authorities. The EDPB issues an Article 64 opinion on national standard clauses. The proposing authority must take utmost account of it. The EDPB issues an Article 65 decision resolving whether a platform unlawfully processed data. The relevant authorities are legally bound. The form of the document affects its legal consequence.

29. Consistency does not give controllers a right to choose the most favourable interpretation

A controller cannot argue:

“One authority previously took a lenient view, so every other authority must adopt that view for consistency.”

Consistency seeks the correct and coherent application of the GDPR. It does not freeze the weakest national interpretation.

Authorities and the EDPB may:

• refine earlier interpretations;
• respond to CJEU case law;
• correct previous errors;
• distinguish different facts;
• update an approach because of technological change.

Illustration

One national authority informally accepted consent obtained through a particular interface in 2019. Later EDPB guidance and CJEU case law clarify that the interface is manipulative. Consistency may require stricter future enforcement, not continuation of the earlier mistake. Legal certainty may still require authorities to consider legitimate expectations, fair notice and proportionality where appropriate.

30. Consistency and supervisory-authority independence

Article 52 guarantees supervisory independence. Article 63 requires cooperation and, in some cases, compliance with EDPB outcomes.

These principles are compatible.

Independence means freedom from:

• government instruction;
• commercial pressure;
• political interference;
• improper external influence.

It does not mean freedom to disregard binding EU-law procedures.

[!example] Illustration A national government cannot order its supervisory authority to approve a transfer mechanism. But where the authority submits the mechanism under Article 64, it must participate in the EDPB procedure. If an Article 65 binding decision follows, the authority must comply because that duty arises from EU law, not political command.

31. Applicable law is not the same as consistency

Article 63 does not create a complete choice-of-law system.

A cross-border case may involve:

• the directly applicable GDPR;
• national employment law under Article 88;
• national health-data rules;
• national procedural law;
• sector-specific EU legislation.

The consistency mechanism addresses correct and coherent GDPR application. It does not automatically determine which national substantive rule applies.

[!example] Illustration A lead authority reviews employee monitoring across several states. The EDPB may resolve a common GDPR issue concerning transparency or proportionality. The authorities may still need to apply specific national employment provisions validly adopted under Article 88. Consistency and national legal diversity must therefore be reconciled rather than treated as mutually exclusive.

32. Does Article 63 directly impose duties on controllers?

Article 63 is principally addressed to:

• supervisory authorities;
• the EDPB;
• the Commission where relevant.

It does not directly require an ordinary controller to submit an Article 64 referral.

However, controllers and processors are indirectly affected.

They may be required to:

• provide information for a consistency procedure;
• respond to new legal issues raised by concerned authorities;
• participate in a right-to-be-heard process;
• implement a final decision shaped by an EDPB opinion or binding decision;
• adjust compliance across all EEA establishments.

Illustration

A company applies for approval of BCRs. The competent authority must obtain an EDPB opinion. The company may need to revise:

• enforceability clauses;
• data subject rights;
• audit arrangements;
• government-access procedures;
• accountability structures. Article 63’s immediate duty falls on regulators, but its practical effects reach the applicant.

---

33. Remedies of complainants

A complainant does not ordinarily make a direct Article 63 referral to the EDPB.

The complainant may:

• lodge a complaint with a supervisory authority;
• provide evidence;
• challenge a supervisory decision under Article 78;
• challenge supervisory inaction under Article 78(2);
• participate to the extent provided by applicable procedure.

If authorities disagree, the Article 60 and 65 mechanisms operate institutionally.

[!example] Illustration A French complainant believes the Irish lead authority’s draft is too narrow. The French supervisory authority may raise a relevant and reasoned objection. The complainant does not personally obtain the same formal objection power. The complainant can nevertheless contest the final rejection or inadequate treatment through the appropriate judicial remedy.

34. Transparency and publication

EDPB opinions and binding decisions are generally made public, subject to appropriate redaction.

Publication supports:

• legal certainty;
• controller compliance;
• academic and professional analysis;
• accountability;
• consistent future decisions;
• understanding of enforcement trends.

However, consistency files may contain:

• complainant identities;
• trade secrets;
• security information;
• confidential evidence;
• personal data;
• privileged material.

The EDPB must balance transparency with:

• professional secrecy;
• rights of defence;
• data protection;
• legitimate confidentiality;
• integrity of ongoing proceedings.

A public decision may therefore contain redactions or anonymisation.

35. A complete practical example

Assume a multinational social-media platform has its main establishment in Ireland. It processes health-related inferences for behavioural advertising across the EEA.

Step 1: Complaint and investigation

Users complain in France, Germany and Spain.

The Irish authority acts as lead. The other authorities become concerned authorities.

Step 2: Article 60 cooperation

The authorities exchange evidence. France supplies interface screenshots, Germany provides technical analysis and Spain provides user-impact evidence.

Step 3: Draft decision

Ireland proposes to find only a transparency infringement and impose a modest fine.

Step 4: Relevant and reasoned objection

Germany objects that:

• health inferences constitute special-category data;
• Article 9 applies;
• no valid exception exists;
• the proposed fine and remedy are ineffective.

France objects that the platform also lacks an Article 6 legal basis.

Step 5: No agreement

Ireland rejects the objections as unpersuasive.

Step 6: Article 65 referral

The matter is referred to the EDPB under the consistency mechanism.

Step 7: EDPB assessment

The EDPB determines:

• whether the objections satisfy Article 4(24);
• whether health inferences are being processed;
• whether additional infringements must be found;
• whether corrective action must be changed.

Step 8: Binding decision

The EDPB adopts a reasoned binding decision requiring the lead authority to amend its draft.

Step 9: Final national decision

Ireland adopts a final decision based on the EDPB ruling and notifies the controller.

Step 10: Implementation

The controller must change the processing throughout its EEA establishments.

This example shows the full chain:

Article 60 provides cooperation, Article 63 provides the consistency framework, and Article 65 resolves the deadlock.

36. A second example: Mandatory Article 64 opinion

The Polish supervisory authority develops standard Article 28 controller-processor clauses.

Drafting stage

Poland prepares the clauses and supporting reasons.

Consistency referral

Because Article 64(1) applies, Poland sends the draft to the EDPB.

EDPB review

The EDPB examines whether the clauses sufficiently address:

• instructions;
• confidentiality;
• subprocessors;
• security;
• rights assistance;
• deletion;
• audit rights.

Opinion

The EDPB recommends stronger provisions on subprocessor changes and audit evidence.

National response

Poland takes utmost account of the opinion and revises the clauses before adoption.

This preventive mechanism avoids incompatible national standard clauses before widespread reliance begins.

37. Main grey areas

37.1 Meaning of “general application”

There is no exhaustive definition. A matter may begin with one case but raise an issue relevant to many organisations.

37.2 Threshold for multi-state effects

Article 64(2) requires effects in more than one Member State but does not define their necessary intensity.

37.3 Boundary between Articles 60 and 64

Authorities may disagree over whether an issue should remain in ordinary one-stop-shop cooperation or be referred for a broader EDPB opinion.

37.4 Scope of an Article 65 decision

The EDPB must remain within the matters covered by qualifying objections while still resolving the dispute effectively.

37.5 Rights of defence

New issues arising at EDPB level must be handled in a way that gives affected parties a meaningful opportunity to respond.

37.6 Relationship between EU and national judicial review

An EDPB decision and a national implementing decision may be challenged in different courts. The 2026 WhatsApp ruling has made the existence of a direct EU-level challenge especially significant.

37.7 Procedural duration

Consistency review improves harmonisation but can extend the time required for final resolution.

37.8 Opinions versus binding force

An Article 64 opinion is not identical to an Article 65 decision, but an authority cannot treat it as inconsequential advice.

38. Corrections and qualifications to the supplied commentary

The supplied commentary captures the broad structure, but several points require refinement.

First, Article 64(1) is not a general mechanism for every measure affecting many data subjects

Article 64(1) contains a specified list of mandatory draft decisions. Recital 135 describes the broader purpose, while Article 64(2) provides the route for other general or multi-state matters.

Second, standard clauses and BCRs are not merely examples of the recital’s general test

They are expressly listed mandatory Article 64(1) categories.

Third, Article 64 opinions are not ordinary informal recommendations

The authority must take utmost account of the opinion, and failure to seek or follow the required opinion may trigger Article 65(1)(c).

Fourth, Article 65 does not allow the EDPB to decide every aspect of a case

For Article 65(1)(a), the binding decision concerns matters covered by relevant and reasoned objections.

Fifth, Article 66 does not simply “derogate” permanently from the one-stop shop

It permits exceptional, provisional and usually territorial action, followed by European-level control.

Sixth, the consistency mechanism does not apply to every cross-border case

Many cases are handled through Articles 60 to 62 without formal Article 64 or 65 involvement.

Seventh, consistency does not eliminate valid national law

National specifications permitted by the GDPR may continue to produce different outcomes where the underlying national legal context differs.

Conclusion

Article 63 is the constitutional bridge between national data protection enforcement and a genuinely European GDPR. It requires supervisory authorities to cooperate through a formal consistency mechanism so that:

• comparable cases receive comparable legal treatment;
• national regulatory instruments do not conflict;
• disputes between lead and concerned authorities are resolved;
• jurisdictional conflicts do not create parallel enforcement;
• mandatory European opinions are obtained and respected;
• urgent national action remains subject to European coordination. The consistency mechanism has three principal legal forms:

1. Article 64 opinions, which provide preventive consistency review;
2. Article 65 binding decisions, which resolve defined disputes;
3. Article 66 urgent procedures, which allow temporary protection while maintaining European oversight.

The European Commission contributes where relevant, while the EDPB serves as the central consistency body. National authorities remain independent, but independence does not permit them to disregard binding EU procedures.

In the simplest terms:

Articles 60 to 62 help national regulators work together. Article 63 and the provisions following it make sure that, after working together, they apply the GDPR as one European law rather than as a collection of conflicting national rules.

Consistency does not mean mechanical uniformity. It means coherent interpretation, comparable protection and a structured method for resolving genuine disagreements.

Article 63 is short because it does not contain the machinery itself. Its function is to activate and explain the purpose of that machinery. It tells every supervisory authority that national independence must operate inside a common European legal order, and that where a national decision may influence privacy protection across borders, European consistency is not optional.