Article 64 — Opinion of the Board

Article 64 is the preventive review mechanism within the GDPR’s wider consistency system. It allows the European Data Protection Board, or EDPB, to examine important draft measures and broader interpretive questions before national supervisory authorities create divergent standards across Europe.

The Article’s basic logic is simple:

If a national supervisory authority proposes a measure that could influence data protection beyond its own territory, or if an important GDPR question affects several Member States, the EDPB may need to give a common European opinion before the matter proceeds.

Article 64 is therefore not ordinarily a procedure for deciding whether one particular controller should be fined. Its main role is to promote harmonisation before inconsistent national rules, approvals or regulatory positions take effect.

1. The position of Article 64 within the consistency mechanism

Article 64 must be read with:

• Article 63, which establishes the consistency mechanism;
• Article 65, which enables the EDPB to issue binding decisions in certain disputes;
• Article 66, which deals with urgent cases;
• Article 70, which lists the EDPB’s tasks;
• Articles 35, 40, 41, 43, 46 and 47, which create the specific regulatory mechanisms reviewed under Article 64(1).

The Article establishes two routes for obtaining an EDPB opinion.

The mandatory route under Article 64(1)

A competent supervisory authority intends to adopt one of six specifically listed regulatory measures. It must send its draft decision to the EDPB.

The broader request route under Article 64(2)

A supervisory authority, the EDPB Chair or the European Commission asks the EDPB to examine:

• a matter of general application; or
• a matter producing effects in more than one Member State.

Paragraphs 3 to 8 then regulate:

• whether an opinion must be issued;
• the voting requirement;
• the timetable;
• the documents to be supplied;
• translations;
• publication;
• the standstill period;
• the response required from the supervisory authority;
• escalation where the opinion is not followed.

The EDPB describes Article 64 opinions as consistency opinions addressed to national supervisory authorities. It states that authorities must request such opinions for the specified cross-border regulatory measures, while Article 64(2) permits opinions on matters of general application or issues affecting more than one Member State.

2. Why Article 64 is necessary

The GDPR is directly applicable throughout the EEA. Nevertheless, it is administered largely through national supervisory authorities.

Without a consistency procedure, authorities could develop incompatible systems for:

• deciding which processing requires a DPIA;
• approving codes of conduct;
• accrediting monitoring and certification bodies;
• adopting standard contractual clauses;
• authorising bespoke international-transfer clauses;
• approving binding corporate rules.

Illustration

Suppose the French authority approves a code of conduct for cloud providers that permits broad reuse of customer data. The code applies to members in ten Member States. At the same time, German and Dutch authorities consider the same reuse unlawful. The result would be confusion for:

• cloud providers;
• their customers;
• certification bodies;
• affected individuals;
• national regulators. Article 64 requires European review before such a transnational code is approved. The objective is neither to strip national authorities of their independence nor to make every regulatory decision in Brussels. The objective is to prevent one national authority from creating a standard with European effects without coordinated European examination.

---

3. Article 64 opinions are preventive

Article 64 usually operates before the national authority adopts the final measure.

The procedure is preventive in two senses.

First, it seeks to identify legal problems before organisations begin relying on the proposed measure.

Second, it avoids the need to correct inconsistent national systems after they have already become established.

Illustration

A supervisory authority wants to adopt standard controller-processor clauses. It would be inefficient to:

1. adopt the clauses;
2. allow ten thousand organisations to use them;
3. discover that they omit mandatory Article 28 safeguards;
4. withdraw the clauses;
5. force every organisation to amend its contracts.

Article 64 review aims to identify the omission at the draft stage.

This preventive character explains paragraph 6, under which the authority must not adopt the draft while the EDPB opinion period is running.

4. Article 64(1): Mandatory opinions

Paragraph 1 contains six categories of draft measure for which an EDPB opinion is mandatory.

The list is specific. A supervisory authority must not treat referral as optional merely because it believes that its proposal is uncontroversial.

The six categories are:

1. Article 35(4) DPIA lists;
2. transnational codes of conduct under Article 40(7);
3. accreditation criteria under Articles 41(3) and 43(3);
4. standard data protection clauses under Articles 28(8) and 46(2)(d);
5. bespoke contractual clauses under Article 46(3)(a);
6. binding corporate rules under Article 47.

The official text requires the competent supervisory authority to communicate the relevant draft decision to the Board before adopting any of these measures.

5. Paragraph 1(a): DPIA lists under Article 35(4)

A data protection impact assessment, or DPIA, is required where processing is likely to result in a high risk to individuals’ rights and freedoms.

Article 35(4) requires each supervisory authority to establish and publish a list of processing operations that require a DPIA.

Possible examples may include:

• large-scale facial recognition;
• systematic employee monitoring;
• large-scale health-data processing;
• behavioural profiling of children;
• automated decisions affecting access to credit;
• extensive location tracking;
• matching or combining sensitive databases;
• surveillance of publicly accessible areas.

Before adopting such a list, the authority must submit its draft decision to the EDPB.

5.1 Why European review is needed

A controller may operate one processing system throughout the EEA.

If the same activity:

• always requires a DPIA in France;
• never requires one in Germany;
• requires one only in certain sectors in Spain.

the European compliance framework becomes fragmented.

Article 64 review does not necessarily mean that all national lists must be word-for-word identical. National circumstances may justify some differences. But the core high-risk standards should be coherent.

Illustration

One authority proposes that any use of biometric attendance requires a DPIA. Another authority proposes that a DPIA is required only where biometric attendance is used on a large scale. The EDPB may examine:

• the sensitivity of biometric data;
• scale;
• systematic monitoring;
• vulnerability of workers;
• alternatives;
• risks of misuse;
• whether the criteria should be reformulated.

5.2 Absence from the list is not a safe harbour

An Article 35(4) list gives mandatory examples. It does not replace the general Article 35(1) test.

[!example] Illustration A new brain-computer interface is not mentioned on the national list because the technology did not exist when the list was adopted. The controller must still carry out a DPIA if the processing is likely to create a high risk. The EDPB opinion on a national list therefore does not certify that every unlisted processing operation is low risk.

6. Paragraph 1(b): Transnational codes of conduct

Article 40 permits associations and bodies representing categories of controllers or processors to prepare codes of conduct.

A code may translate general GDPR obligations into sector-specific standards concerning:

• transparency;
• lawful processing;
• children;
• security;
• retention;
• pseudonymisation;
• rights handling;
• dispute resolution;
• international transfers.

Where a draft code relates to processing activities in several Member States, Article 40(7) requires submission through the consistency mechanism.

Illustration

A European hotel association proposes a code concerning:

• passport collection;
• loyalty programmes;
• guest profiling;
• CCTV;
• employee data;
• international reservation systems. Because members operate throughout Europe, approval by one national authority could affect processing in many Member States. The EDPB should consider whether the code provides sufficient and consistent safeguards.

6.1 A code cannot reduce GDPR obligations

A code may explain how to comply. It cannot legalise what the GDPR prohibits.

Illustration

An advertising code says: “Members may retain behavioural profiles indefinitely where the information remains commercially useful.” The EDPB should identify the conflict with storage limitation and accountability. Likewise, a code cannot state that membership automatically proves compliance. Adherence may help demonstrate accountability, but the controller remains responsible for actual processing.

6.2 National and transnational codes

A code applying only within one Member State may ordinarily be approved under the national Article 40 procedure without an Article 64(1)(b) opinion.

A code covering processing in several Member States must undergo European review.

The relevant question is not merely where the sponsoring association is located. What matters is the code’s intended territorial and operational reach.

7. Paragraph 1(c): Accreditation criteria

The authority must seek an EDPB opinion where it intends to approve criteria for accrediting:

• a code-monitoring body under Article 41(3); or
• a certification body under Article 43(3).

Accreditation determines whether an organisation is sufficiently competent, independent and reliable to perform a regulatory assurance role.

Relevant criteria may cover:

• expertise;
• independence;
• impartiality;
• governance;
• financial stability;
• audit methods;
• complaints;
• conflicts of interest;
• confidentiality;
• withdrawal procedures.

Illustration

A certification company also sells consultancy services to organisations seeking its certification. Accreditation criteria should address the risk that the body:

1. designs the client’s compliance system;
2. audits its own design;
3. certifies the same client;
4. depends financially on repeat business.

The EDPB may recommend separation of functions, conflict controls or independent review.

7.1 Why criteria need consistency

If one state applies strict accreditation requirements while another accepts bodies with limited expertise or serious conflicts, the credibility of European certification may be undermined.

A certification mark issued under weak criteria may influence customers and controllers outside the approving state. European review promotes comparable assurance throughout the EEA.

The EDPB continues to publish Article 64 opinions on draft accreditation requirements and certification-related frameworks, showing the mechanism’s ongoing practical use.

8. Paragraph 1(d): Standard data protection clauses

A supervisory authority may develop standard clauses for:

• controller-processor agreements under Article 28(8); and
• international transfers under Article 46(2)(d).

Before determining such clauses, it must obtain an Article 64 opinion.

8.1 Article 28 clauses

Controller-processor clauses may cover:

• subject matter and duration;
• nature and purpose;
• categories of data and individuals;
• documented instructions;
• confidentiality;
• security;
• subprocessors;
• rights assistance;
• breach support;
• DPIAs;
• deletion or return;
• audits.

Illustration

An authority’s proposed clauses allow the processor to appoint any subprocessor without informing the controller. The EDPB may identify that the arrangement does not provide the specific or general written authorisation required by Article 28.

8.2 Article 46 standard clauses

National supervisory authorities may also adopt standard clauses providing appropriate safeguards for transfers to third countries.

These differ from standard contractual clauses adopted by the European Commission under Article 46(2)(c).

Clauses adopted by a supervisory authority under Article 46(2)(d) require the consistency mechanism to reduce the risk of conflicting national transfer standards.

8.3 Standard clauses are not automatic proof of lawful processing

Using approved clauses may satisfy an important contractual requirement. It does not cure defects elsewhere.

Illustration

A processor contract contains perfect standard terms, but the processor ignores them, uses data for its own commercial purposes and maintains weak security. The contract does not make the actual conduct lawful. Similarly, international-transfer clauses do not eliminate the need to consider:

• actual transfer practices;
• recipient-country law;
• government access;
• supplementary measures;
• suspension where safeguards cannot be respected.

---

9. Paragraph 1(e): Bespoke contractual transfer clauses

Article 46(3)(a) permits international transfers based on contractual provisions authorised by a supervisory authority.

These are bespoke clauses designed for a particular arrangement, unlike standard clauses intended for broad reuse.

Illustration

A European medical-research consortium wants to transfer genetic information to a specialised research institute outside the EEA. Its proposed agreement includes:

• strict research-purpose limits;
• pseudonymisation;
• security controls;
• participant rights;
• limits on onward transfers;
• audit rights;
• deletion;
• government-access procedures. The competent authority must submit its draft authorisation decision to the EDPB.

9.1 Why one bespoke contract needs European review

Although the contract may concern identified parties, it may affect:

• people in several Member States;
• institutions in several states;
• common European transfer standards;
• future contractual models.

The EDPB examines whether the clauses provide enforceable and effective safeguards rather than merely formal commitments.

9.2 Authorisation is not permanent immunity

If circumstances materially change, the transfer may need reassessment.

For example:

• the recipient changes its processing;
• new onward transfers begin;
• third-country surveillance law changes;
• safeguards cease to be effective;
• the recipient breaches the clauses.

The Article 64 opinion concerns the draft authorisation on the submitted facts. It is not a permanent guarantee against future non-compliance.

10. Paragraph 1(f): Binding corporate rules

Binding corporate rules, or BCRs, govern international transfers within a multinational group of undertakings or enterprises engaged in joint economic activity.

They typically address:

• binding effect;
• data subject rights;
• liability;
• complaint handling;
• audits;
• training;
• security;
• onward transfers;
• government-access requests;
• cooperation with supervisory authorities.

A competent authority intending to approve BCRs must obtain an EDPB opinion.

The EDPB regularly issues Article 64 opinions on controller and processor BCRs, demonstrating that this is one of the mechanism’s most active practical uses.

Illustration

A global corporate group has companies in:

• France;
• Germany;
• Ireland;
• Brazil;
• India;
• Singapore;
• the United States. The group proposes BCRs for employee and customer transfers. The EDPB may examine whether:
• each relevant group member is legally bound;
• employees can enforce rights;
• EU entities accept responsibility;
• training and audits are credible;
• government requests are evaluated and documented;
• violations are reported;
• BCR updates are controlled.

10.1 BCR approval does not approve every processing operation

Approved BCRs provide a transfer mechanism. They do not determine that:

• every collection is lawful;
• every purpose is compatible;
• every employee-monitoring practice is proportionate;
• every security measure is adequate.

The controller must still comply with the rest of the GDPR.

11. The list in Article 64(1) is specific

The mandatory referral categories should not be expanded casually by analogy.

For example, Article 64(1) does not state that every:

• administrative fine;
• complaint decision;
• breach investigation;
• local enforcement order;
• reprimand

must be sent to the EDPB for an opinion.

Cross-border enforcement disputes are principally governed by Articles 60 and 65.

At the same time, a matter not covered by paragraph 1 may still qualify for an Article 64(2) opinion if it has general application or effects in more than one Member State.

12. Article 64(2): Opinions on wider matters

Paragraph 2 allows a broader range of issues to be submitted to the EDPB.

The request may come from:

• any supervisory authority;
• the EDPB Chair;
• the Commission.

A controller, processor, complainant, industry association or NGO does not itself possess the formal Article 64(2) referral power. Such an actor may raise an issue with a supervisory authority, but the authority or another authorised applicant decides whether to request the opinion.

The 2025 version of the EDPB’s internal guidance examines the meaning of “general application,” “effects in more than one Member State,” admissibility requirements, written reasoning and the relationship with Articles 60 onward.

13. Matter of general application

A matter of general application raises a legal or regulatory issue relevant beyond one isolated dispute.

Examples

may include:

• when an AI model can be treated as anonymous;
• whether legitimate interests can support AI training;
• consent-or-pay models;
• processing of personal data in blockchain systems;
• use of biometric categorisation;
• obligations relating to connected vehicles;
• interpretation of children’s consent requirements;
• controller obligations for generative AI outputs.

Illustration

An authority investigates one AI developer. During the case it encounters the question: When does a trained AI model remain personal data because training data can be extracted from it? The issue arises in one investigation, but its answer may affect many AI developers and authorities. It may therefore be a matter of general application. The Irish supervisory authority used Article 64(2) to request an EDPB opinion on data protection questions concerning AI models, including anonymity, legitimate interests and consequences of unlawful training. The resulting Opinion 28/2024 illustrates how a national request can address a broad issue with Europe-wide significance.

13.1 General does not necessarily mean detached from every case

The supplied commentary suggests that the EDPB requires an abstract issue independent of particular cases. That should be qualified.

A general legal issue may emerge from a concrete investigation. The critical question is whether the request asks the EDPB to address a broader interpretive issue rather than decide the merits of the individual case as a substitute for the competent authority.

[!example] Illustration Appropriate Article 64(2) request: “What factors should authorities apply when determining whether extraction of training data from an AI model is reasonably likely?” Less appropriate request: “Did Company X violate Article 6 on 12 March, and what fine should we impose?” The second question resembles the adjudication of an individual case, which is ordinarily the role of the competent authority and, where authorities disagree, Article 65.

14. Matter producing effects in more than one Member State

The second Article 64(2) route concerns a matter with multi-state effects.

The matter need not necessarily create a universal rule for every controller. It may concern a defined system affecting several states.

Illustration

Five national health authorities create a shared patient-data infrastructure. A supervisory question arises concerning its access controls and governance. The matter may produce effects in more than one Member State even if it is limited to that health network. “Producing effects” should not be interpreted as mere technical accessibility. A national website being visible abroad does not by itself establish a meaningful multi-state effect. Relevant factors may include:

• establishments;
• affected persons;
• operational reach;
• legal consequences;
• implementation across states;
• common processing infrastructure.

---

15. Article 61 and 62 failures

Paragraph 2 specifically mentions cases where a competent authority fails to comply with:

• Article 61 mutual-assistance obligations; or
• Article 62 joint-operation obligations.

Illustration

Authority A asks Authority B to inspect a local establishment under Article 61. Authority B neither acts nor gives a lawful refusal. Authority A may use the emergency mechanism in Article 61(8), where the conditions are met. The cooperation failure may also be submitted to the EDPB as a broader consistency matter under Article 64(2). Similarly, if an authority is wrongly excluded from a joint operation, European guidance may be needed on:

• participation;
• responsibility;
• appropriate cooperation;
• corrective institutional steps. Article 64(2) therefore promotes consistency not only in substantive GDPR interpretation, but also in the conduct of supervisory authorities themselves.

---

16. Article 64(2) is broad but not unlimited

The Article should not become a general legal-advice service through which authorities refer every difficult question to the EDPB.

A proper request should explain:

• the precise legal question;
• why it is general or multi-state;
• relevant factual context;
• conflicting interpretations, if any;
• why ordinary Article 60 cooperation is insufficient;
• the practical importance of an EDPB opinion;
• any urgency or pending national action.

Poor request

“Please explain Article 5.”

Better request

“National authorities have adopted materially different approaches to whether training a generative AI model on publicly available personal data satisfies the necessity and balancing requirements under Article 6(1)(f). The question affects developers and data subjects throughout the EEA. An opinion is sought on the relevant assessment factors.”

The second request gives the EDPB a defined issue suitable for consistency guidance.

17. Difference between Article 64(2) and Article 65

Article 64(2) provides an opinion on a broad matter.

Article 65 provides a binding resolution of a defined dispute.

[!example] Illustration Several authorities want general guidance on whether consent-or-pay models can produce freely given consent. That may support an Article 64(2) opinion. A lead authority circulates a draft decision approving a particular platform’s consent model. Another authority submits a relevant and reasoned objection. The lead authority refuses to follow it. That individual cross-border dispute belongs under Article 65(1)(a). The General Court held in April 2025 that EDPB Opinion 8/2024 concerning consent-or-pay models under Article 64(2) was not, in that procedural context, an act open to direct annulment proceedings because it did not itself produce binding legal effects like an Article 65 decision. This illustrates a central distinction: Article 64 opinions guide and constrain the supervisory process, but Article 65 decisions formally bind the authorities on the dispute submitted.

18. Article 64(3): Duty to issue an opinion

Where paragraphs 1 or 2 properly apply, the Board shall issue an opinion, provided it has not already issued an opinion on the same matter.

This avoids repetitive European procedures.

18.1 What is the “same matter”?

Two requests may concern the same subject at a high level but raise materially different questions.

Illustration

An earlier opinion covers:

• when an AI model may be anonymous. A later request concerns:
• how Article 22 applies when that model makes employment decisions. Both concern AI, but they are not necessarily the same matter. Conversely, changing a few factual details should not permit an authority to request a second opinion simply because it dislikes the first. Relevant considerations include:
• legal question;
• factual assumptions;
• affected mechanism;
• technological change;
• new CJEU case law;
• material developments since the earlier opinion.

19. Eight-week period and six-week extension

The ordinary period is eight weeks.

The opinion must be adopted by simple majority of the EDPB’s members.

The period may be extended by six weeks because of the subject matter’s complexity, resulting in a potential total of fourteen weeks.

Complexity may arise from:

• difficult technology;
• extensive documents;
• multiple legal issues;
• many affected states;
• translation;
• conflicting national positions;
• interaction with other EU legislation.

The extension should respond to genuine complexity rather than routine administrative delay.

19.1 When does the period begin?

The practical starting point depends upon submission of a sufficiently complete file.

If the referring authority omits:

• the draft decision;
• material facts;
• supporting grounds;
• relevant authorities’ views.

the EDPB may need further information before meaningful examination can occur.

A referring authority should not submit an incomplete file merely to start the clock.

20. Simple majority

Article 64 opinions are adopted by simple majority.

This differs from the ordinary two-thirds threshold initially used for Article 65 binding decisions.

The difference reflects the legal character of the output:

• Article 64 produces an opinion;
• Article 65 produces a binding resolution.

Recital 136 distinguishes opinions from legally binding decisions and explains that binding decisions are intended for clearly specified disputes, especially disagreements between lead and concerned authorities about the case’s merits.

21. Non-objection procedure

Paragraph 3 provides that, for a paragraph 1 draft circulated to members, a member that does not object within the reasonable period set by the Chair is deemed to agree.

This supports efficient handling of routine or well-prepared drafts.

Illustration

A national authority submits BCRs that closely follow established requirements. The Chair circulates the draft. No member objects within the stated period. Members are deemed to agree, allowing the process to proceed without unnecessary debate.

21.1 Silence is not always substantive endorsement

Deemed agreement is a procedural rule.

It does not necessarily mean that every member conducted an exhaustive independent analysis of every clause. It means that no objection was raised within the relevant period.

21.2 The period must be reasonable

The Chair should consider:

• volume;
• complexity;
• language;
• technical content;
• prior circulation;
• urgency.

An unreasonably short period could undermine meaningful participation.

22. Article 64(4): Information submitted to the EDPB

Supervisory authorities and the Commission must communicate relevant information:

• without undue delay;
• electronically;
• using a standardised format.

The information may include:

• summary of facts;
• draft decision;
• reasons the measure is necessary;
• views of concerned authorities;
• supporting materials.

A proper submission should enable the EDPB to understand both the proposed outcome and its basis.

Illustration

A national authority submits proposed standard clauses but omits:

• an explanation of how they satisfy Article 28;
• authorities’ comments;
• the intended territorial use;
• reasons for deviations from existing clauses. The EDPB may be unable to perform meaningful review until those matters are supplied.

22.1 “Any relevant information”

The authority need not transmit every internal email or administrative document.

It should transmit material capable of affecting:

• legal assessment;
• scope;
• necessity;
• safeguards;
• cross-border effect;
• proposed wording;
• other authorities’ positions.

Withholding material disagreements would undermine the purpose of consistency review.

23. Article 64(5): Duties of the EDPB Chair and Secretariat

The Chair must inform:

• EDPB members;
• the Commission

of relevant information received.

The Secretariat must provide translations where necessary.

After adoption, the Chair must inform:

• the referring authority;
• the Commission

and make the opinion public.

23.1 Translation

Translation is essential because:

• referral documents may be in a national language;
• members must understand the issue;
• national authorities must apply the opinion;
• the public should be able to examine European consistency outcomes.

Not every supporting document necessarily requires translation into every language. The Secretariat should determine what is necessary for effective review.

23.2 Publication

Publication supports:

• transparency;
• legal certainty;
• controller compliance;
• consistent future enforcement;
• academic analysis;
• public accountability.

The public version may need redaction to protect:

• personal data;
• trade secrets;
• security details;
• privileged information;
• confidential submissions.

24. Article 64(6): Standstill obligation

A supervisory authority must not adopt its paragraph 1 draft decision during the Article 64(3) opinion period.

This is a mandatory standstill.

Illustration

An authority sends draft BCR approval to the EDPB and immediately issues final approval to the group. That action defeats the preventive review process. The authority must wait until the opinion procedure has run its course.

24.1 The prohibition applies to paragraph 1 drafts

Paragraph 6 expressly refers to a draft decision under paragraph 1.

The position is less mechanically stated for Article 64(2) matters, because an Article 64(2) request may concern a broad issue rather than a specific draft requiring suspension.

Nevertheless, sincere cooperation may require the relevant authority to avoid taking steps that would make the requested opinion meaningless.

[!example] Illustration An authority requests an Article 64(2) opinion on a European data-protection seal, then grants the seal before the opinion arrives. Even if paragraph 6 does not apply in precisely the same way, such conduct may undermine Article 63’s consistency objective and the referral’s purpose.

25. Article 64(7): “Utmost account”

After receiving the opinion, the paragraph 1 authority must take utmost account of it.

This is stronger than:

• consider;
• note;
• review;
• have regard to.

The authority must engage seriously with the EDPB’s reasoning.

It should:

1. identify the EDPB’s findings;
2. assess each material recommendation;
3. amend the draft where necessary;
4. explain any departure;
5. report its intended response.

Illustration

The EDPB concludes that proposed BCRs fail to provide enforceable rights against non-EEA group entities. The authority cannot merely retain the BCRs unchanged and state: “We considered the opinion but disagree.” It should explain:

• why it considers existing rights enforceable;
• which law supports that conclusion;
• how individuals obtain remedies;
• why the EDPB’s concern is unfounded. If the disagreement remains, paragraph 8 and Article 65 apply.

---

26. The two-week response

Within two weeks after receiving the opinion, the authority must tell the EDPB Chair whether it will:

• maintain the draft; or
• amend it.

If amended, the revised draft must be supplied electronically in the standardised format.

This deadline ensures that an EDPB opinion does not disappear into an indefinite national reconsideration process.

Illustration

The EDPB recommends five changes. The authority accepts four and rejects one. Within two weeks, it should provide:

• the amended draft;
• explanation of accepted changes;
• relevant grounds for the remaining disagreement. The authority need not necessarily complete every external implementation step within two weeks. It must communicate its regulatory position and amended text.

---

27. Article 64(8): Refusal to follow the opinion

Where the supervisory authority states that it does not intend to follow the EDPB opinion, wholly or partly, and provides reasons, Article 65(1) applies.

Article 65(1)(c) provides the binding route where a competent authority:

• failed to request a necessary Article 64(1) opinion; or
• did not follow the EDPB’s Article 64 opinion.

Any concerned supervisory authority or the Commission may communicate the matter to the EDPB for a binding decision.

27.1 The opinion is not directly binding, but departure is controlled

It is correct to say that an Article 64 opinion is not itself identical to an Article 65 binding decision.

It is misleading to say that the authority may freely ignore the opinion.

The accurate position is:

1. the opinion is not directly binding in the Article 65 sense;
2. the authority must take utmost account of it;
3. departure must be reasoned;
4. disagreement activates the binding dispute-resolution architecture.

The authority’s freedom is therefore structured and reviewable.

28. Must someone separately trigger Article 65?

The wording of Articles 64(8) and 65 should be read together.

Article 64(8) states that Article 65(1) applies where the authority communicates that it will not follow the opinion.

Article 65(1)(c) states that a concerned authority or the Commission may communicate the matter to the Board.

The procedural mechanics therefore require the disagreement to be brought into the Article 65 binding-decision process by an authorised actor.

The supplied commentary suggests that if nobody triggers Article 65, the authority may eventually proceed despite the opinion. That interpretation raises a genuine procedural grey area because the GDPR does not specify a clear waiting deadline after the paragraph 7 response.

The safer and more consistent approach is:

• the authority should not rush to adopt a conflicting measure;
• the EDPB and Commission should be given a real opportunity to react;
• the authority should cooperate on clarifying the disagreement;
• any adoption must respect Article 63, Recital 138 and the possibility of Article 65 intervention.

An authority should not exploit procedural silence to defeat the consistency mechanism.

29. Legal effect and validity

Where Article 64(1) applies, obtaining the opinion is a mandatory procedural step.

Recital 138 states that use of the consistency mechanism is a condition of lawfulness where application is mandatory.

A national decision adopted without the required opinion may therefore be vulnerable to:

• invalidation;
• judicial challenge;
• Article 65 intervention;
• Commission action;
• refusal of recognition or reliance.

However, one should distinguish:

• the unlawfulness of the final national measure;
• the status of the earlier draft;
• the legal effect of the EDPB opinion.

A draft is not usually described as “invalid” in the same sense as a final binding decision. The more precise statement is that the competent authority cannot lawfully adopt the final paragraph 1 measure without completing the mandatory Article 64 procedure.

30. Is an Article 64 opinion judicially reviewable?

The legal status of Article 64 opinions differs from Article 65 binding decisions.

In Meta Platforms Ireland v EDPB, Case T-319/24, the General Court held on 29 April 2025 that EDPB Opinion 8/2024 on consent-or-pay models was not open to direct annulment proceedings because it did not itself create binding legal effects of the type required for a challenge under Article 263 TFEU.

That does not mean an Article 64 opinion is legally irrelevant.

It may:

• shape supervisory interpretation;
• influence investigations;
• require utmost account;
• lead to Article 65 proceedings;
• affect future national decisions.

An organisation may challenge a later binding supervisory decision and raise legal arguments concerning its reliance on the opinion. The precise availability of a direct challenge depends upon the legal effects of the particular act and EU judicial-remedy rules.

This should be contrasted with Article 65 binding decisions, whose binding legal consequences are substantially stronger.

31. Article 64 and rights of defence

Article 64 is generally a regulator-to-regulator opinion procedure. It is not structured exactly like an enforcement hearing against one controller.

Nevertheless, the opinion may affect:

• an applicant for BCR approval;
• the sponsor of a code;
• a certification scheme owner;
• parties to bespoke transfer clauses;
• organisations planning reliance on standard clauses.

Fairness may require an opportunity to address material concerns, especially where the EDPB relies on:

• new facts;
• a new legal theory;
• significant deficiencies not previously raised;
• information adverse to the applicant.

Illustration

A supervisory authority proposes to approve BCRs. The EDPB identifies a serious concern about enforceability under the law of a third country. The applicant should ordinarily be able, through the competent authority, to provide:

• legal analysis;
• contractual amendments;
• evidence of enforceability;
• supplementary safeguards. Article 64 should remain efficient, but it should not create a black-box approval process.

---

32. Article 64 and supervisory-authority independence

A national authority remains independent from:

• government;
• commercial interests;
• political instruction;
• controllers and processors.

Submitting a draft to the EDPB does not violate that independence.

The EDPB procedure is required by EU law and forms part of the common regulatory framework.

Independence means the authority cannot be directed by improper external influence. It does not mean that it can disregard:

• Article 64 referral duties;
• EDPB opinions;
• Article 65 binding decisions;
• consistency obligations.

[!example] Illustration A government cannot order a supervisory authority to approve a code benefiting domestic companies. The EDPB may lawfully recommend rejection or amendment of that code under Article 64 because that review follows from the GDPR itself.

33. Article 64 and the Commission

The Commission has several functions in Article 64.

It may:

• request an Article 64(2) opinion;
• receive relevant information;
• receive the adopted opinion;
• communicate a paragraph 8 disagreement to the EDPB under Article 65(1)(c);
• exercise separate Treaty powers where relevant.

The Commission does not vote as an EDPB member and does not replace supervisory authorities as the ordinary GDPR investigator.

[!example] Illustration Several authorities apply conflicting rules to cloud-service certification. The Commission may request an Article 64(2) opinion because the divergence affects the internal market and GDPR consistency. It cannot simply write the final national certification decision itself.

34. A complete practical illustration: BCR approval

Assume a multinational group seeks approval for controller BCRs.

Stage 1: Preparation

The applicant works with the competent supervisory authority and submits:

• scope;
• group structure;
• binding mechanisms;
• data subject rights;
• liability;
• audit programme;
• training;
• complaint process;
• government-access rules.

Stage 2: Draft decision

The authority concludes provisionally that the BCRs satisfy Article 47 and prepares a draft approval decision.

Stage 3: Article 64 referral

Because paragraph 1(f) applies, the authority submits the draft and relevant materials electronically to the EDPB.

Stage 4: EDPB review

The EDPB examines whether:

• rights are enforceable;
• all group entities are bound;
• transfers are described accurately;
• liability is clear;
• audit and training are effective;
• updates are controlled.

Stage 5: Opinion

The EDPB issues an opinion within the applicable period and recommends amendments.

Stage 6: National response

Within two weeks, the authority sends:

• its response;
• revised draft;
• explanation of any point it proposes not to follow.

Stage 7: Agreement or escalation

If the authority follows the opinion, it may proceed after completing the process.

If it refuses to follow a material recommendation, the matter may move to Article 65.

Stage 8: Final decision

The competent authority approves or refuses the BCRs through its final national decision.

This example shows that the EDPB gives the European consistency view, while the competent national authority normally adopts the final approval decision.

35. A second practical illustration: Article 64(2) AI opinion

A national authority encounters repeated questions concerning personal data in AI models.

It asks:

• when can a model be considered anonymous;
• can legitimate interests support model development;
• how should the balancing test work;
• what happens if training data were processed unlawfully?

These questions affect developers, deployers and individuals throughout the EEA.

The authority submits a reasoned Article 64(2) request.

The EDPB issues an opinion explaining common assessment factors. That opinion does not itself decide that every AI model is lawful or unlawful. National authorities must apply the guidance to the facts of individual cases.

Opinion 28/2024 followed this general model and stressed that anonymity of an AI model requires case-by-case assessment, including the likelihood of extracting or obtaining personal data from the model.

36. Main grey areas

36.1 Meaning of the “same matter”

A previous opinion may address part of a new question but not later technology, facts or law.

36.2 Scope of Article 64(2)

The boundary between a general interpretive issue and an individual-case dispute can be difficult to draw.

36.3 Waiting period after disagreement

The GDPR does not provide a perfectly clear final deadline between a paragraph 8 notification and Article 65 escalation.

36.4 Rights of affected applicants

Article 64 does not fully harmonise participation rights for code owners, BCR applicants or certification scheme owners.

36.5 Completeness of the file

The Article does not expressly define when the eight-week period begins if essential documents are missing.

36.6 National law interaction

A proposal may involve GDPR standards and national rules permitted by the GDPR. The EDPB must respect legitimate national differences while preserving common EU interpretation.

36.7 Consequences of procedural defects

Failure to obtain a mandatory opinion undermines lawfulness, but the exact remedy may depend on the nature of the national measure and applicable judicial procedure.

37. Key corrections to the supplied commentary

The supplied commentary provides a useful structure, but several propositions need qualification.

First, the EDPB opinion does not make the national authority’s final decision automatically “valid”

The authority retains responsibility for:

• the final wording;
• lawful procedure;
• competence;
• underlying evidence;
• compliance with national and EU law.

Second, Article 64(2) is not necessarily confined to issues entirely detached from cases

A broad question may arise from a concrete investigation, provided the request seeks a general or multi-state interpretation rather than adjudication of the individual merits.

Third, the EDPB does not necessarily issue a separate full opinion only when one member objects

Paragraph 3 permits deemed agreement for a paragraph 1 draft where no member objects within the Chair’s reasonable period. The procedural form must be understood through the EDPB’s rules and practice.

Fourth, refusal to follow an opinion is not simply free national discretion

The authority must:

• take utmost account;
• respond within two weeks;
• give reasons;
• accept possible Article 65 binding resolution.

Fifth, an unreviewed draft is not best described as legally ineffective in itself

The accurate point is that the authority cannot lawfully adopt the paragraph 1 measure without completing the mandatory consistency process.

Sixth, direct judicial challenge against an Article 64 opinion is not automatically available

The General Court’s 2025 ruling concerning Opinion 8/2024 found that the opinion did not itself produce the necessary binding legal effects for a direct annulment action in that case.

Conclusion

Article 64 is the GDPR’s system of preventive European quality control. It requires an EDPB opinion before a supervisory authority adopts specified measures concerning:

• DPIA lists;
• transnational codes of conduct;
• accreditation criteria;
• standard clauses;
• bespoke transfer agreements;
• binding corporate rules. It also allows supervisory authorities, the EDPB Chair and the Commission to request opinions on:
• matters of general application;
• matters affecting more than one Member State;
• serious failures of mutual assistance or joint-operation duties. The procedure requires:
• a complete draft and relevant information;
• electronic and standardised communication;
• an opinion normally within eight weeks;
• possible extension by six weeks;
• simple-majority adoption;
• translation where necessary;
• public availability;
• suspension of adoption for paragraph 1 drafts;
• utmost account of the opinion;
• a response within two weeks;
• escalation under Article 65 where the authority refuses to follow the opinion. The simplest way to understand Article 64 is:

A national supervisory authority prepares the measure, the EDPB checks its European consistency, and the national authority then adopts the final decision in light of the EDPB’s opinion.

The EDPB opinion is not ordinarily a final enforcement order against a controller. But it is much more than informal advice. It forms part of a mandatory consistency procedure, and a national authority cannot lawfully treat it as optional commentary.

Article 64 therefore prevents a national regulator from establishing European standards in isolation. It preserves national administrative responsibility while ensuring that measures with wider consequences are tested against one common interpretation of the GDPR.