Article 68 — European Data Protection Board

Article 68 gives the European Data Protection Board, commonly called the EDPB or the Board, its formal legal existence and establishes its membership structure. The provision explains what kind of institution the EDPB is, who represents it, who sits on it, how Member States with several data protection authorities participate, and the limited roles of the European Commission and European Data Protection Supervisor.

In simple terms:

Article 68 creates the EDPB as an independent EU body through which national data protection authorities collectively coordinate the consistent application of European data protection law.

Article 68 does not itself list all the Board’s powers. Those appear mainly in Articles 64 to 66 and Article 70. Instead, Article 68 answers the institutional questions that must be settled before the Board can exercise those functions.

1. Why the EDPB was needed

The GDPR is a single European Regulation, but it is primarily enforced by national supervisory authorities.

This creates a structural challenge. A single cross-border processing operation may involve:

• a controller headquartered in one Member State;
• a processor in another;
• technical systems in a third;
• individuals in many more Member States;
• complaints filed with several national authorities.

Without a European coordinating body, national authorities could interpret the same GDPR provisions differently.

Illustration

Suppose a social-media platform uses the same advertising system throughout Europe. The French authority might conclude that user consent is required. The Irish authority might conclude that legitimate interests apply. The German authority might find that the system processes special-category data. The Spanish authority might require deletion of the profiles. If each authority acted entirely independently, the organisation could face contradictory legal obligations. More importantly, individuals would receive different standards of protection depending upon where they lived. The EDPB helps prevent this fragmentation by:

• issuing guidelines and recommendations;
• adopting Article 64 consistency opinions;
• resolving disputes through Article 65 binding decisions;
• adopting urgent decisions under Article 66;
• encouraging cooperation among national authorities;
• advising the Commission;
• promoting consistent GDPR interpretation. The EDPB describes itself as an independent European body with legal personality that ensures consistent application of the GDPR and the Law Enforcement Directive and supports cooperation, including enforcement cooperation.

---

2. The EDPB replaced the Article 29 Working Party

Before the GDPR, the principal European data protection coordination body was the Article 29 Working Party, commonly called WP29. It had been established under Directive 95/46.

WP29 issued influential opinions and guidance, but the GDPR created a more formal and powerful institutional system. Recital 139 expressly states that the EDPB should replace WP29 and should act as an independent Union body with legal personality.

The difference is important.

WP29 was predominantly advisory. The EDPB can still issue:

• guidelines;
• recommendations;
• best practices;
• advisory opinions.

However, the EDPB may also issue legally binding decisions under Article 65 when supervisory authorities cannot resolve specified disputes.

Illustration

Under the former system, if two national authorities disagreed over a cross-border case, the European coordinating body could express a view, but it did not possess the modern Article 65 power to bind those authorities through a formal dispute-resolution decision. Under the GDPR, the EDPB can resolve:

• whether a relevant and reasoned objection should be followed;
• which authority is competent as lead authority;
• whether a mandatory Article 64 opinion has been wrongly ignored. Article 68 therefore represents a move from relatively informal coordination to an institutionalised European enforcement structure. It would nevertheless be an overstatement to blame the entire fragmented application of Directive 95/46 on WP29’s lack of legal personality. Fragmentation also arose because a directive required national implementation and left considerable room for national procedural and substantive variation. The EDPB’s stronger status forms only one part of the GDPR’s broader harmonisation framework.

---

3. Article 68(1): Establishment as a body of the Union

Paragraph 1 provides:

“The European Data Protection Board is hereby established as a body of the Union.”

The words“is hereby established” mean that the EDPB derives its existence directly from the GDPR.

It was not created:

• by an informal agreement between regulators;
• by a decision of the Commission;
• by delegation from national governments;
• by a contract between Member States.

Its institutional legitimacy comes directly from EU legislation.

This matters because the EDPB exercises functions that may significantly affect:

• national supervisory authorities;
• controllers;
• processors;
• complainants;
• cross-border enforcement;
• international transfers;
• interpretation of the GDPR.

A body capable of adopting binding decisions requires a clear legal basis defining its:

• existence;
• membership;
• independence;
• voting arrangements;
• tasks;
• accountability.

Article 68 supplies the foundational part of that legal basis. Article 69 guarantees independence, while Articles 70 to 76 govern the Board’s tasks, reports, procedures, chairmanship, Secretariat and confidentiality.

The official text confirms that the Board is an EU body with legal personality, composed of the national supervisory authorities’ heads and the EDPS, with the Commission participating without a vote.

4. Is the EDPB an EU institution?

Article 68 calls the EDPB a“body of the Union.” It does not make the EDPB one of the EU institutions listed in Article 13 of the Treaty on European Union.

The main EU institutions include bodies such as:

• the European Parliament;
• the European Council;
• the Council;
• the European Commission;
• the Court of Justice;
• the European Central Bank;
• the Court of Auditors.

The EDPB is instead a Union body created by secondary EU legislation.

This distinction does not make the EDPB informal or powerless. It means that its authority is specialised and limited to the functions assigned by the GDPR and related legislation.

Illustration

The EDPB may:

• adopt a binding decision resolving an Article 65 dispute;
• issue guidance on interpreting the GDPR;
• advise the Commission on data protection. It may not:
• amend the GDPR;
• adopt a general EU budget;
• prosecute criminal offences;
• replace the European Parliament;
• exercise powers that the GDPR has not conferred upon it. The EDPB is therefore a specialised European regulatory body rather than a general law-making institution.

---

5. Article 68(1): Legal personality

Paragraph 1 also provides that the EDPB“shall have legal personality.”

Legal personality means that the Board is recognised by law as an entity separate from:

• its individual members;
• national supervisory authorities;
• the European Commission;
• the EDPS.

This permits the EDPB to act in its own institutional name.

Depending upon the relevant legal framework, legal personality supports the Board’s ability to:

• be a party to judicial proceedings;
• defend its decisions before the EU Courts;
• enter into necessary institutional arrangements;
• hold rights and obligations;
• establish a distinct institutional identity;
• be legally accountable for its acts.

Illustration

A controller brings an action before the EU Courts seeking annulment of an EDPB binding decision. The defendant is the EDPB as a Union body. It is not necessary to sue every national supervisory authority whose representative participated in the vote. The Board’s legal personality allows it to represent and defend the European-level act in its own name.

5.1 Legal personality and binding powers are connected but distinct

The supplied commentary suggests that legal personality is what allows the Board to adopt binding decisions. This requires qualification.

The EDPB can adopt binding decisions because the GDPR expressly grants that power in:

• Article 65;
• Article 66;
• Article 70.

Legal personality supports the Board’s capacity to act as an identifiable legal body, but legal personality alone does not create substantive decision-making power.

Illustration

A private company has legal personality. That does not give it power to issue binding regulatory decisions. Conversely, the EDPB’s binding authority arises because the EU legislature expressly assigned that authority to it. The correct distinction is:

• legal personality answers who the Board is in law;
• statutory powers answer what the Board may lawfully do.

---

6. Practical consequences of legal personality

The EDPB’s independent legal identity has several consequences.

6.1 Judicial proceedings

EDPB acts may be reviewed by the EU Courts where the conditions of Article 263 TFEU are met.

For example, an Article 65 binding decision may be challenged because it allegedly:

• exceeds the EDPB’s competence;
• infringes procedural rights;
• misinterprets the GDPR;
• lacks adequate reasons;
• is disproportionate.

In February 2026, the CJEU confirmed in WhatsApp Ireland v EDPB that an Article 65 binding decision can constitute a reviewable EU act producing legal effects, rather than merely an internal preparatory step in a later national decision.

6.2 Institutional responsibility

The EDPB must respect legal requirements such as:

• the Charter;
• good administration;
• rights of defence;
• professional secrecy;
• transparency;
• duty to provide reasons;
• judicial remedies.

Its independence does not place it above the law.

6.3 Representation

The EDPB acts institutionally through its Chair, rather than through every member acting separately.

7. Accountability of the EDPB

The Board’s legal personality and independence do not mean that it is unaccountable.

The EDPB is subject to several forms of control.

7.1 Judicial accountability

Its legally reviewable acts may be challenged before the EU Courts under the conditions of Article 263 TFEU.

National courts may also encounter EDPB acts when reviewing final supervisory decisions based upon them. A national court cannot itself invalidate an EDPB decision, but it may refer a validity question to the CJEU under Article 267 TFEU where the legal conditions are met.

7.2 Administrative accountability

The Board must follow:

• its Rules of Procedure;
• applicable EU administrative-law principles;
• Charter requirements;
• its own statutory time limits and voting rules.

7.3 Transparency and reporting

The Board publishes:

• opinions;
• guidelines;
• binding decisions;
• annual reports;
• relevant consistency records.

Publication may be limited where necessary to protect:

• personal data;
• confidential evidence;
• trade secrets;
• professional secrecy;
• ongoing investigations.

7.4 Democratic and financial accountability

As an EU body, the EDPB operates inside the broader EU institutional framework. However, its precise administrative and financial arrangements are unusual because Article 75 provides that the EDPS supplies the Board’s Secretariat, with the Secretariat’s staff acting under the Chair’s instructions for EDPB tasks.

It is therefore too simplistic to describe every EDPB administrative or budgetary matter as though the Board were a fully separate decentralised EU agency with an entirely independent staff and budget.

8. Article 68(2): Representation by the Chair

Paragraph 2 provides:

“The Board shall be represented by its Chair.”

The Chair is the Board’s formal institutional representative.

The Chair’s detailed responsibilities are found in Article 74 and the EDPB Rules of Procedure. Article 68(2) establishes the foundational principle that, when the Board needs a single representative, the Chair performs that role.

The EDPB’s official page identifies the Board as being led by a Chair and two Deputy Chairs elected for five-year terms. As of August 2026, the official EDPB page identifies Anu Talus as Chair, with Jelena Virant Burnik and Zdravko Vukić as Deputy Chairs.

9. Public and legal functions of the Chair

The Chair’s representational role has both public and formal dimensions.

9.1 Public representation

The Chair may represent the EDPB:

• before the European Parliament;
• in public conferences;
• in press communications;
• in discussions with other EU bodies;
• in international data protection forums.

9.2 Formal representation

The Chair may act for the Board in connection with:

• notification of opinions and decisions;
• communication with the Commission;
• judicial proceedings;
• formal institutional correspondence;
• operation of EDPB decision-making procedures.

Illustration

The EDPB adopts a binding decision concerning a dispute among supervisory authorities. The Chair:

• represents the adopted institutional position;
• ensures formal notification;
• may represent the Board if that decision is challenged before the EU Courts. The Chair speaks for the EDPB as an institution, not merely in a personal capacity.

---

10. Limits on the Chair’s power

The Chair is not a one-person EDPB.

The Chair cannot ordinarily:

• replace the Board’s collective vote;
• create new EDPB powers;
• issue binding Article 65 decisions personally;
• disregard the Rules of Procedure;
• direct national supervisory authorities outside the GDPR framework.

The Board is collegial. Its members deliberate and vote according to Articles 64, 65 and 72 and the Rules of Procedure.

Illustration

The Chair publicly believes a platform infringed the GDPR. That opinion does not become an Article 65 binding decision unless:

• the matter properly falls within Article 65;
• procedural requirements are met;
• the Board adopts the decision under the applicable voting rules. Article 65(3) gives the Chair a casting role where Board members are evenly split at the final fallback voting stage. That is a specific statutory power, not a general power to decide cases unilaterally.

---

11. Article 68(3): Composition of the Board

Paragraph 3 provides that the Board consists of:

• the head of one supervisory authority from each Member State; and
• the European Data Protection Supervisor;

or their respective representatives.

This composition is designed to combine:

1. national enforcement experience;
2. European institutional supervision;
3. high-level collective decision-making.

It also reflects the reality that the EDPB does not sit above national authorities in an ordinary administrative hierarchy. It is largely composed of their heads.

12. Why the heads of national authorities sit on the Board

The participation of national supervisory authority heads gives the EDPB practical and institutional legitimacy.

These members bring experience concerning:

• complaints;
• investigations;
• enforcement;
• courts;
• technological risks;
• national procedural systems;
• sector-specific problems;
• local effects on individuals.

The arrangement also strengthens implementation.

Illustration

The heads of national authorities collectively approve EDPB guidance on access rights. When those same authorities later handle national access complaints, they cannot reasonably treat the adopted guidance as though it came from an unrelated external commentator. This does not mean that every EDPB guideline is legally binding in every case. It means that the national authorities themselves participate in developing the common European position.

12.1 A high-level body

Requiring the head of an authority, or an authorised representative, signals that the EDPB is intended to take institutionally significant decisions.

The Board’s work includes:

• cross-border dispute resolution;
• opinions on binding corporate rules;
• transfer questions;
• guidance affecting millions of data subjects;
• advice on proposed EU legislation.

These are not merely technical administrative exchanges.

13. “One supervisory authority of each Member State”

Paragraph 3 does not necessarily mean that only one data protection authority may exist within each Member State.

Some states have multiple authorities because of:

• federal constitutional structures;
• regional governments;
• specialised public-sector competence;
• language or territorial arrangements.

Article 68 accommodates this possibility through paragraph 4.

At Board level, however, each Member State must have a coherent representative position.

The purpose is to prevent a multi-authority state from having:

• multiple votes;
• disproportionate influence;
• contradictory representations;
• difficulty identifying who speaks for that state.

14. Representatives of the head

The head of the national authority or the EDPS may appoint or use a respective representative.

This ensures continuity where the head:

• cannot attend;
• has a conflict of interest;
• is temporarily unavailable;
• delegates attendance under the applicable rules.

The representative should possess sufficient authority to:

• participate meaningfully;
• express the member’s position;
• vote where entitled;
• respect confidentiality;
• communicate the outcome internally.

Illustration

A national authority’s head cannot attend an urgent Article 66 meeting. An authorised senior official may act as representative. The representative is not attending as a personal observer. The person acts for the national member within the authority granted. A substitute should not be confused with:

• an invited expert;
• an observer;
• a Commission representative;
• Secretariat staff. Those participants may contribute but do not necessarily hold the member’s voting rights.

---

15. Individual heads or Member State representation?

The structure has two dimensions.

First, the Board is composed of heads of independent supervisory authorities, not government delegates.

Second, the composition follows a one-representative-per-Member-State model.

A national EDPB member should not act on instructions from:

• a minister;
• parliament;
• a regulated company;
• a political party.

Article 69 requires the Board to act independently.

[!example] Illustration A government wants the EDPB to approve a lenient position benefiting a major domestic employer. It cannot lawfully instruct the national authority’s head how to vote merely because that head represents the Member State’s supervisory system at Board level. The representative brings national supervisory experience, but remains part of an independent data protection structure.

16. Article 68(4): Member States with several supervisory authorities

Paragraph 4 provides:

Where more than one supervisory authority is responsible within a Member State, a joint representative shall be appointed under that Member State’s law.

This is particularly important in federal and decentralised systems.

Illustration

A Member State has:

• a federal authority;
• regional authorities;
• a specialist public-sector authority. National law must determine:
• who represents them at the EDPB;
• how the representative is selected;
• how the authorities coordinate their position;
• how relevant information is shared;
• how voting instructions are agreed without compromising independence. The EDPB should not have to resolve an internal constitutional dispute every time that state participates.

---

17. The joint representative is not necessarily the sole domestic authority

The EDPB joint representative does not become the country’s only supervisory authority.

Regional and specialist authorities may continue to exercise:

• investigative powers;
• corrective powers;
• complaint-handling responsibilities;
• local enforcement competence.

The representative’s function is to present a unified participation point at EDPB level.

[!example] Illustration A regional German supervisory authority leads a domestic investigation. Germany’s EDPB representative may communicate Germany’s position in a Board discussion. This does not transfer the regional authority’s statutory national powers to the representative. Internal national coordination and external EDPB representation are separate questions.

18. Internal disagreement among several national authorities

Article 68 does not prescribe how a Member State must resolve internal disagreement among its authorities.

National law may use:

• a designated federal contact point;
• rotating representation;
• consultation mechanisms;
• majority voting;
• issue-specific mandates;
• a conference of supervisory authorities.

Whatever system is chosen should allow:

• timely participation;
• accurate communication;
• respect for each authority’s competence;
• compliance with short EDPB deadlines;
• a single national vote.

Illustration

Regional Authority A believes an objection is relevant and reasoned. Regional Authority B disagrees. The Member State must use its internal mechanism to determine the position communicated through the joint representative. Internal complexity cannot justify missing:

• Article 60 objection deadlines;
• Article 64 review periods;
• Article 65 votes;
• urgent Article 66 procedures.

---

19. Article 68(5): European Commission participation

Paragraph 5 gives the Commission the right to participate in the EDPB’s activities and meetings.

The Commission:

• designates a representative;
• may participate in discussions;
• receives information about the Board’s activities;
• has no voting right.

The absence of a vote is deliberate. It protects the EDPB from direct executive control while recognising that the Commission has important responsibilities regarding:

• EU legislation;
• Treaty enforcement;
• adequacy decisions;
• international relations;
• coherence of EU policy;
• proposals affecting data protection.

The official Article 68 text expressly distinguishes Commission participation from Board membership by denying the Commission a vote.

20. Why the Commission participates

The Commission’s participation may provide:

• information about proposed EU legislation;
• explanations of Commission measures;
• knowledge concerning adequacy frameworks;
• institutional coordination;
• awareness of internal-market implications;
• information concerning implementation of EU law.

Illustration

The EDPB discusses an opinion concerning a proposed transfer framework. The Commission may explain:

• the relevant legal instrument;
• international negotiations;
• existing Commission decisions;
• institutional context. The EDPB remains free to reach an independent data protection conclusion.

20.1 Participation does not equal control

The Commission cannot:

• vote;
• direct the EDPB’s conclusion;
• instruct national authorities through the Board;
• veto an EDPB decision;
• replace the Chair.

The Commission may make legal or policy submissions, but the Board’s members decide.

21. Does Commission participation undermine independence?

The mere presence of the Commission does not by itself undermine EDPB independence.

Several structural safeguards matter:

• no Commission vote;
• Article 69 independence;
• national supervisory-authority membership;
• collective EDPB voting;
• judicial review;
• published outputs;
• Commission role defined by legislation.

However, practical concerns may arise where:

• the EDPB evaluates a Commission initiative;
• the Commission has a strong policy interest in the outcome;
• the Commission possesses information unavailable to other participants;
• discussions involve possible EU Treaty enforcement.

The solution is not necessarily exclusion from every discussion. It is procedural integrity.

Relevant safeguards may include:

• clear agendas;
• accurate minutes;
• conflict awareness;
• independent deliberation;
• reasoned outputs;
• appropriate confidentiality;
• recusal or restricted attendance where legally justified.

22. Communication of Board activities to the Commission

Paragraph 5 requires the Chair to communicate the Board’s activities to the Commission.

This may include institutional information concerning:

• adopted opinions;
• guidelines;
• binding decisions;
• work programmes;
• legislative advice;
• consistency procedures;
• annual reporting.

This duty does not mean that the Chair must disclose every confidential investigative detail.

The communication obligation must be reconciled with:

• Article 76 confidentiality;
• professional secrecy;
• protection of ongoing cases;
• individual rights;
• rights of defence.

Illustration

The Board may inform the Commission that it is considering a general issue concerning international-transfer safeguards. It should not necessarily disclose:

• confidential whistleblower identities;
• privileged submissions;
• security vulnerabilities;
• non-public evidence unless a lawful and necessary basis exists.

---

23. Article 68(6): The EDPS

The European Data Protection Supervisor is the independent authority responsible for supervising the processing of personal data by EU institutions, bodies, offices and agencies under Regulation (EU) 2018/1725. That Regulation aligns the data protection rules for EU institutions substantially with the core framework of the GDPR.

The EDPS is a member of the EDPB under Article 68(3).

This makes institutional sense because data protection questions may involve:

• national public authorities;
• private organisations;
• EU institutions;
• systems shared between EU and national bodies;
• corresponding principles under two related Regulations.

The EDPS brings experience concerning the EU institutional sphere while national supervisory authorities bring Member State enforcement experience.

24. Limited EDPS voting rights in Article 65 cases

Paragraph 6 limits the EDPS’s voting rights in Article 65 dispute-resolution cases.

The EDPS may vote only where the decision concerns principles and rules applicable to Union institutions, bodies, offices and agencies that correspond in substance to GDPR principles and rules.

This reflects the EDPS’s specialised supervisory mandate.

Illustration

The EDPB resolves an Article 65 dispute concerning:

• lawful basis;
• transparency;
• security;
• data subject rights. Equivalent principles apply under Regulation 2018/1725 to EU institutions. The EDPS may have voting rights because the issue concerns corresponding substantive rules. By contrast, a dispute may involve a highly specific national procedural issue or national rule with no substantive counterpart in the Union-institution framework. The EDPS may participate in discussions but lack voting rights on that decision.

---

25. Meaning of “correspond in substance”

The rules do not need to have identical Article numbers or wording.

The proper question is whether they regulate materially corresponding data protection principles.

Possible corresponding areas include:

• lawfulness;
• fairness;
• transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• security;
• access rights;
• erasure;
• accountability;
• breach notification.

Illustration

A dispute concerns whether a controller’s security measures were appropriate. The GDPR regulates security under Article 32. Regulation 2018/1725 contains corresponding security obligations for EU institutions. The provisions correspond in substance even if their institutional scope and precise wording differ.

25.1 The restriction remains meaningful

The supplied commentary suggests that the EDPS may be eligible to vote in most cases because the two regulatory frameworks are closely aligned. That may often be true for general principles, but the limitation should not be treated as meaningless.

Each Article 65 decision must be assessed according to:

• matters submitted;
• objections;
• relevant legal rules;
• whether the EU-institution rules genuinely correspond.

The EDPS should not vote merely because the GDPR and Regulation 2018/1725 are generally related.

26. EDPS voting outside Article 65

Paragraph 6 expressly restricts EDPS voting“in the cases referred to in Article 65.”

The limitation therefore concerns Article 65 binding dispute resolution.

For other EDPB functions, such as:

• ordinary guidance;
• recommendations;
• best practices;
• Article 64 opinions;

the voting framework is governed by the other GDPR provisions and the Board’s Rules of Procedure.

This textual limitation should not be expanded automatically into a general restriction upon every EDPB vote.

27. EEA participation

The GDPR has been incorporated into the EEA framework, meaning the supervisory authorities of Norway, Iceland and Liechtenstein participate in the wider EDPB system.

The EDPB’s official description states that it is composed of the heads of data protection authorities from the EEA countries together with the EDPS. Its role includes promoting consistent application in EU countries and Norway, Iceland and Liechtenstein.

However, the exact voting and office-holding rights of EEA/EFTA participants arise from the EEA legal arrangements and the EDPB Rules of Procedure, not simply from the wording of Article 68, which refers to Member States.

The general structure should be understood as:

• participation in EDPB work;
• cooperation and obligations within the EEA framework;
• modifications concerning voting on binding EU acts and certain institutional offices.

The EDPB Rules of Procedure govern membership, participation, observers, guests, voting arrangements and internal decision-making.

28. The EDPB is not a super-regulator for every complaint

The Board does not replace national supervisory authorities as the normal first point of contact.

An individual should ordinarily:

• contact the controller;
• lodge a complaint with a national supervisory authority;
• use national judicial remedies where appropriate.

The EDPB does not normally:

• investigate every complaint directly;
• answer individual access requests;
• impose every administrative fine;
• inspect local premises;
• act as an ordinary appeal tribunal from every DPA decision.

The official EU description directs individuals toward the relevant organisation, national data protection authority or national court.

Illustration

A hotel refuses to correct a guest’s email address. The guest should not normally file the complaint directly with the EDPB. The national authority handles the complaint. The EDPB may become relevant if:

• the processing is cross-border;
• authorities disagree;
• a consistency issue arises;
• an Article 65 dispute is triggered. The EDPB’s role is structural and European, not routine first-instance complaint handling.

---

29. Relationship between the EDPB and national authorities

The relationship is not a straightforward hierarchy.

The EDPB does not ordinarily command national authorities in every matter. National authorities remain independent and retain their own:

• investigative powers;
• corrective powers;
• complaint responsibilities;
• national competence;
• judicial accountability.

But in defined situations, the EDPB may issue legally binding decisions.

[!example] Illustration A national authority independently decides whether to audit a local retailer. The EDPB does not supervise that daily operational choice. If a cross-border Article 60 dispute is referred under Article 65, the resulting EDPB decision binds the lead and concerned authorities on the submitted matters. The best description is: The EDPB coordinates independent authorities and has binding powers only where the GDPR specifically gives them.

30. Collective decision-making and responsibility

Because the EDPB consists largely of national authority heads, it is a collegial body.

This produces both benefits and tensions.

Benefits

• practical enforcement knowledge;
• national perspectives;
• shared ownership of guidance;
• institutional legitimacy;
• easier national implementation;
• stronger mutual trust.

Tensions

• members may defend previous national positions;
• the lead authority may be voting on a dispute concerning its own draft;
• national legal traditions may differ;
• large and small authorities may have different resources;
• consensus may be difficult.

The Rules of Procedure address principles including:

• independence and impartiality;
• good governance;
• integrity;
• collegiality;
• cooperation;
• transparency;
• efficiency.

Illustration

The Irish authority’s draft decision is disputed under Article 65. Its representative participates in an EDPB system that evaluates the disagreement. The structure must ensure that:

• the relevant voting rules are followed;
• affected parties are heard;
• the decision is reasoned;
• institutional positions do not replace legal analysis.

---

31. Conflict of interest

Article 68 does not contain a detailed conflict-of-interest code.

Potential concerns may arise where a member:

• represents the lead authority whose draft is disputed;
• was involved in the underlying investigation;
• has previously expressed a strong public conclusion;
• faces a related domestic proceeding.

Not every prior involvement creates an impermissible conflict. The EDPB is designed precisely to resolve disputes among authorities that have already taken positions.

However, procedural fairness requires:

• transparency about roles;
• compliance with voting rules;
• impartial assessment;
• avoidance of personal or financial conflicts;
• reasoned conclusions;
• judicial review.

A national authority defending its legal interpretation is institutionally expected. A decision-maker having a private interest in the outcome would be a different and more serious concern.

32. Secretariat and institutional reality

Article 68 creates the Board, but the EDPB’s daily work depends on its Secretariat.

Under Article 75, the Secretariat is provided by the EDPS. The EDPB’s official description confirms that its Brussels-based Secretariat is provided by the EDPS and operates under arrangements set out in a memorandum of understanding.

The Secretariat supports:

• meeting preparation;
• legal drafting;
• document management;
• Article 64 opinions;
• Article 65 decisions;
• public communications;
• translations;
• consistency registers;
• cooperation systems.

This creates an unusual arrangement:

• the EDPB has its own legal personality;
• the EDPS is an EDPB member;
• the EDPS provides the Secretariat;
• Secretariat staff work under the Chair’s instructions for EDPB tasks.

The institutional separation between EDPB and EDPS must therefore be preserved in practice.

Illustration

The EDPS takes a supervisory position concerning an EU institution. The EDPB Secretariat may simultaneously support Board work on a related European policy question. Internal arrangements should ensure that:

• responsibilities are clear;
• confidential information is protected;
• instructions for EDPB work come from the EDPB Chair;
• the EDPS’s own supervisory functions remain distinct.

---

33. Article 68 and the Law Enforcement Directive

Article 68 formally appears in the GDPR, but the EDPB also contributes to consistent application of Directive (EU) 2016/680, the Law Enforcement Directive.

The EDPB’s official description expressly identifies consistent application of both the GDPR and the Law Enforcement Directive among its functions.

This does not mean that every GDPR mechanism applies identically under the Directive. The legal bases and tasks must be examined separately.

It does mean that the Board serves as an important European forum for data protection beyond ordinary commercial and administrative processing.

34. Does legal personality permit the EDPB to impose fines?

No.

The EDPB can adopt binding decisions directing supervisory authorities on specified disputed matters. The final national authority may then impose:

• a fine;
• a processing ban;
• an erasure order;
• another corrective measure.

The EDPB does not ordinarily send the controller a direct administrative fine under Article 58.

Illustration

The EDPB decides under Article 65 that:

• a fine must be reassessed;
• certain aggravating factors apply;
• the lead authority’s proposed action is insufficient. The lead authority then adopts and notifies the final national decision imposing the fine. The distinction matters for:
• competence;
• notification;
• enforcement;
• national appeal;
• EU-level judicial review.

---

35. Does the EDPB make legislation?

No. The EDPB may issue guidance, opinions and binding decisions within the GDPR framework, but it is not the EU legislature.

[!example] Illustration The EDPB publishes guidance stating that certain design practices may undermine freely given consent. That guidance can be legally influential and may guide enforcement. It does not amend Article 4(11) or Article 7. Similarly, an Article 65 decision binds the authorities in the specific dispute. It is not a legislative amendment applicable abstractly in the same way as an EU Regulation. The EDPB must interpret the GDPR rather than create powers or obligations with no foundation in the legislative text.

36. Practical illustration of Article 68’s institutional design

Assume a platform with its main establishment in Ireland operates throughout the EEA.

A complaint concerning children’s profiling is filed in France. Germany and Spain are also concerned authorities.

National stage

The Irish authority leads the investigation.

France, Germany and Spain provide evidence and legal views.

Draft decision

Ireland concludes that there was only a minor transparency violation.

Germany objects that:

• children’s data were unlawfully profiled;
• consent was invalid;
• the proposed corrective action was inadequate.

EDPB stage

The disagreement is referred under Article 65.

The EDPB acts through the institutional structure created by Article 68:

• national authority heads or representatives participate;
• the EDPS participates subject to the voting rule in paragraph 6;
• the Commission may attend but cannot vote;
• the Chair represents and directs the Board’s institutional process;
• the Secretariat supports preparation;
• the Board adopts a binding decision according to the voting rules.

Final stage

Ireland adopts its final national decision on the basis of the EDPB’s binding decision.

This example shows why Article 68 matters. Without legal personality, formal membership, representation and voting rules, the Article 65 mechanism would have no stable institutional decision-maker.

37. Important corrections and qualifications to the supplied commentary

Several statements in the supplied commentary require refinement.

37.1 Legal personality does not itself create binding powers

The GDPR’s express provisions, particularly Articles 65, 66 and 70, create those powers.

37.2 Board membership is not strictly limited to heads personally attending every meeting

Article 68(3) expressly permits their respective representatives.

37.3 Commission participation does not automatically undermine independence

The Commission cannot vote. Whether its presence creates a practical problem depends on the procedure, subject matter and safeguards.

37.4 The EDPS voting limitation should not be treated as practically irrelevant

A case-specific assessment is required to determine whether the Article 65 decision concerns corresponding principles and rules.

37.5 The EDPB is not simply superior to national authorities

It has binding authority in specified cases. Ordinary national investigative and corrective functions remain with national supervisory authorities.

37.6 Accountability descriptions must reflect the Board’s unusual structure

The EDPB has legal personality, but the EDPS supplies its Secretariat. Its administrative and financial arrangements should not automatically be equated with those of a fully separate decentralised agency.

37.7 Legal remedies go beyond a simple “appeal”

An Article 263 action is an action for annulment before the EU Courts, subject to standing, time limits and reviewability requirements. It is not an ordinary merits appeal in the same sense as some national appellate procedures.

37.8 Article 41 of the Charter and the Ombudsman are distinct mechanisms

Article 41 protects the right to good administration. Complaints to the European Ombudsman arise through the Treaty and Ombudsman framework. One should not describe Article 41 itself as the direct legal basis making the EDPB “accountable to the Ombudsman.”

38. Main grey areas

38.1 One representative in multi-authority states

Article 68 leaves national law to determine how internally divided authorities establish one position.

38.2 Representation and voting mandates

The GDPR does not itself set out all formal requirements for substitutes and representatives. The Rules of Procedure and national arrangements fill the gap.

38.3 EDPS voting rights

Determining whether a rule “corresponds in substance” may be difficult where the GDPR issue combines general principles with specific national law.

38.4 Commission participation

Tension may arise where the EDPB examines a Commission policy or decision while the Commission participates in Board activity.

38.5 Institutional separation

The EDPS supplies the Secretariat while also being a Board member and exercising separate supervisory powers. Practical safeguards must preserve functional separation.

38.6 Judicial accountability

Article 65 decisions may influence a controller through both:

• the EDPB act;
• the later national act.

This can produce coordinated but complex EU and national judicial proceedings.

Conclusion

Article 68 is the EDPB’s institutional birth certificate. It establishes the Board as:

• a body of the European Union;
• an entity with legal personality;
• a collegial body represented by its Chair;
• a forum composed of national supervisory authority heads and the EDPS;
• an institution in which each Member State has one coordinated representation;
• a body open to Commission participation without Commission voting control;
• a system in which the EDPS has limited voting rights in Article 65 cases. The provision transforms European data protection cooperation from an informal network into a legally constituted regulatory structure. Its essential balance is:
• national expertise, through supervisory authority membership;
• European consistency, through collective decision-making;
• institutional independence, through separation from Commission control;
• legal accountability, through reasoned acts and judicial review;
• practical operation, through the Chair and Secretariat. In the simplest terms: National supervisory authorities remain the front-line GDPR regulators, but Article 68 brings them together inside one legally recognised European body capable of developing common positions and resolving defined cross-border disputes.

The EDPB is not an EU legislature, not a general complaints authority and not a universal superior of national regulators. Its authority is powerful but function-specific.

Article 68’s deeper significance is that a single European data protection law requires more than common legal wording. It requires a permanent institution capable of turning national independence into coordinated European enforcement.