Article 69 — Independence of the Board

Article 69 guarantees that the European Data Protection Board, or EDPB, must form and express its own legal judgment when performing its statutory functions. Governments, EU institutions, national supervisory authorities, regulated companies and other interested persons may provide information or make lawful requests, but they may not instruct the Board what conclusion to reach.

In the simplest terms:

The EDPB may listen to others, but it must decide for itself.

This distinction is essential because the Board performs functions that may have substantial consequences for national regulators, businesses, public bodies and individuals. It develops Europe-wide guidance, advises the European Commission, gives consistency opinions and resolves disputes between supervisory authorities through binding decisions. Independence protects the credibility and impartiality of all those functions.

1. The two rules contained in Article 69

Article 69 contains two closely related but distinct rules.

Paragraph 1: A positive duty to act independently

The Board must exercise its tasks and powers independently.

This concerns the quality of the Board’s decision-making. It must:

• form its own assessment;
• evaluate the evidence objectively;
• interpret the law impartially;
• adopt its own priorities;
• resist political and commercial pressure;
• give reasons reflecting its own legal judgment.

Paragraph 2: A prohibition against instructions

The Board must neither:

• seek instructions from anybody; nor
• take instructions from anybody.

The second rule protects against both sides of improper dependence.

The Board cannot ask an external actor:

“What conclusion should we reach?”

Nor may an external actor lawfully command:

“This is the conclusion you must reach.”

The official text confirms that the EDPB must act independently in performing its Articles 70 and 71 functions and must neither seek nor accept instructions, subject to the Commission’s statutory power to request advice.

2. Why independence is necessary

The EDPB may decide or influence questions concerning:

• lawful bases for processing;
• valid consent;
• behavioural advertising;
• artificial intelligence;
• children’s data;
• administrative fines;
• international transfers;
• adequacy of third-country safeguards;
• data breaches;
• public-sector surveillance;
• powers of national supervisory authorities.

Many of these matters involve powerful interests.

A government may want broad access to personal data for public administration or security. A multinational platform may want a permissive interpretation of behavioural advertising. Civil-society organisations may favour the strictest possible view of processing. The Commission may have a policy interest in a digital market or international-transfer arrangement.

The Board must consider relevant legal and factual arguments from all sides. However, its conclusion must be based on:

• the GDPR;
• the EU Charter;
• applicable EU legislation;
• CJEU case law;
• evidence;
• objective reasoning.

Illustration

The Commission negotiates an international framework intended to facilitate data transfers. The framework has significant economic and diplomatic importance. The EDPB is asked to assess whether the safeguards protect individuals adequately. The Commission may explain:

• the framework’s legal structure;
• available redress mechanisms;
• government-access limitations;
• diplomatic commitments. But it cannot instruct the EDPB: “You must issue a favourable opinion because rejection would harm trade relations.” The Board must reach its own data protection conclusion, even if it is politically inconvenient.

---

3. Institutional background

Article 68 establishes the EDPB as an EU body with legal personality. It is composed primarily of the heads of national supervisory authorities, together with the European Data Protection Supervisor. The Commission may participate in the Board’s activities but has no vote. Article 69 adds the independence requirement governing how this institution must exercise its functions.

Recital 139 confirms the overall design:

• the EDPB is an independent Union body;
• it promotes consistent application of the GDPR;
• it advises the Commission;
• it supports cooperation among supervisory authorities;
• it acts independently when performing its tasks.

Independence is therefore not an incidental organisational preference. It is part of the Board’s institutional character.

4. Independence of the Board as a collective body

Article 69 protects the independence of the Board, not only the personal independence of its Chair.

The EDPB is a collegial body. Its members:

• deliberate together;
• submit views;
• vote;
• adopt collective opinions and decisions.

Independence must exist at the level of the collective outcome.

[!example] Illustration A majority of EDPB members vote for a legal interpretation because their national governments have privately instructed them to support it. Even if the vote followed the formal rules, the result would conflict with Article 69 because the collective decision arose from external governmental instructions rather than independent supervisory judgment. Conversely, strong disagreement among members does not demonstrate a lack of independence. Independence permits honest disagreement. What Article 69 prohibits is external direction, not differing legal views.

5. Independence of individual EDPB members

The Board’s institutional independence depends heavily on the independence of its members.

Most members are heads of national supervisory authorities. Article 52 separately requires national supervisory authorities to act with complete independence.

A national authority’s representative must not act as:

• a government delegate;
• a representative of domestic industry;
• a political negotiator;
• an advocate for a regulated national company.

Illustration

A national government tells its supervisory authority: “Vote against the proposed EDPB guidance because our technology sector believes it will increase compliance costs.” The representative cannot lawfully follow that instruction merely because the company is important to the national economy. The representative may independently consider:

• economic effects;
• regulatory feasibility;
• impact on innovation;
• proportionality. Those are legitimate considerations where relevant to the GDPR. But the representative must assess them independently rather than implement the government’s preferred political result.

---

6. Independence does not mean isolation

Independence should not be confused with intellectual isolation.

The EDPB may lawfully receive information from:

• national supervisory authorities;
• the Commission;
• the EDPS;
• controllers and processors;
• industry associations;
• civil-society organisations;
• academics;
• technical experts;
• data subjects;
• other EU bodies.

The Board may also:

• hold stakeholder events;
• conduct consultations;
• publish draft guidelines for comment;
• request technical studies;
• hear affected parties;
• seek expert advice.

The essential distinction is between information and instruction.

[!example] Illustration A cybersecurity expert tells the EDPB: “This encryption method is vulnerable to the following attack.” That is technical information. A technology company tells the EDPB: “You must approve our security approach because we are the market leader.” That is pressure rather than evidence. The Board may accept the first statement after evaluating its accuracy. It must not treat the second as a direction.

7. Independent judgment does not require rejection of external advice

The Board does not prove its independence by disagreeing with everyone.

It may reach the same conclusion as:

• the Commission;
• a national authority;
• an industry group;
• a civil-society organisation;
• an academic expert.

The relevant question is not whether the conclusions match. It is whether the EDPB reached its conclusion through its own lawful assessment.

[!example] Illustration The Commission asks the Board whether proposed legislation creates sufficient data protection safeguards. The Board independently analyses the proposal and agrees with the Commission. There is no Article 69 problem merely because the conclusions are identical. By contrast, if the Board approves the proposal because the Commission told it to do so, without conducting its own assessment, the independence requirement would be compromised.

8. Independence and impartiality

Independence and impartiality are related but not identical.

Independence

Independence concerns freedom from external control or influence.

Impartiality

Impartiality concerns the absence of bias or prejudgment in the decision-making process.

An institution may be formally independent but still act with bias.

[!example] Illustration The EDPB receives no instructions from governments or companies. However, it refuses to examine a controller’s submissions because certain members have publicly prejudged the case. There may be no external-instruction problem, but an impartiality and good-administration issue may remain. The EDPB’s Rules of Procedure identify independence and impartiality, good governance, integrity, collegiality, cooperation and transparency among the Board’s guiding principles.

9. Article 69(1): Independence when performing Articles 70 and 71 functions

Paragraph 1 links independence to the Board’s tasks and powers under Articles 70 and 71.

Article 70 gives the EDPB a broad range of duties, including:

• monitoring consistent application of the GDPR;
• advising the Commission;
• issuing guidelines and recommendations;
• resolving disputes under Article 65;
• encouraging codes of conduct and certification;
• advising on adequacy;
• promoting cooperation among supervisory authorities;
• maintaining consistency registers.

Article 71 requires the Board to prepare an annual report.

The Board must act independently across this entire range of functions. Article 70 itself states that the EDPB may act on its own initiative or, where relevant, at the Commission’s request.

10. Independence in guidance and recommendations

EDPB guidelines can substantially influence:

• national enforcement;
• compliance programmes;
• legal advice;
• court proceedings;
• business models;
• public-sector systems.

Although ordinary guidelines are not the same as Article 65 binding decisions, they have considerable practical and interpretive authority.

Illustration

The EDPB prepares guidance on legitimate interests in AI development. Technology companies may argue for a broad interpretation because retraining systems is expensive. Privacy groups may argue that legitimate interests should never apply. Governments may want to encourage AI investment. The EDPB must independently assess:

• Article 6;
• necessity;
• reasonable expectations;
• impact on individuals;
• safeguards;
• relevant CJEU case law. It should not adopt the most commercially convenient or politically popular conclusion simply because that position has the strongest lobbying support.

---

11. Independence in Article 65 binding decisions

Independence is particularly important where the EDPB adopts a binding decision resolving a dispute among national supervisory authorities.

An EDPB decision may determine:

• whether an infringement occurred;
• whether another infringement must be added;
• whether further investigation is required;
• whether a proposed order is sufficient;
• whether a fine must be reassessed;
• which authority is competent.

The Board must independently assess:

• the draft decision;
• relevant and reasoned objections;
• evidence;
• affected parties’ submissions;
• the limits of its own jurisdiction.

Illustration

The lead authority is responsible for a major multinational platform and proposes a modest fine. Several concerned authorities seek a much larger fine. Public commentary is intense. The EDPB should not:

• protect the lead authority from embarrassment;
• automatically support the stricter authorities;
• follow media pressure;
• protect the company because of its economic importance. It must decide whether the objections qualify under Article 4(24) and whether the proposed measure complies with the GDPR.

---

12. Independence in the annual report

Article 71 requires the EDPB to draw up an annual report.

The report may discuss:

• guidance;
• opinions;
• binding decisions;
• cooperation;
• enforcement trends;
• international activities;
• institutional challenges.

Article 69 means that the report must reflect the Board’s own assessment.

Illustration

The Board considers that cross-border enforcement suffers from inadequate resources or procedural fragmentation. The Commission or national governments may disagree. They cannot instruct the Board to remove that criticism from its annual report. The Board remains accountable for ensuring that the statements are accurate, reasoned and consistent with confidentiality obligations.

13. “Neither seek nor take instructions”

Paragraph 2 deliberately covers two different dangers.

13.1 Seeking instructions

The Board must not voluntarily make itself dependent upon another actor.

Illustration

The Chair asks the Commission: “Please tell us what legal conclusion the Board should adopt on this transfer issue.” That would be improper because the Board is asking an external executive institution to determine its legal judgment. The Board may instead ask: “Please provide the underlying documents, factual assumptions and details of the proposed legal framework.” That is a permissible request for information.

13.2 Taking instructions

The Board must not obey directions that another actor attempts to impose.

[!example] Illustration A national government tells its representative: “Vote for this Article 65 decision.” The representative must not accept the instruction. Likewise, the Commission cannot tell the Board: “Do not publish this guidance” or “Find this third country adequate.” The Board must determine its own position.

14. Meaning of “from anybody”

The word“anybody” is broad.

It includes potential instructions from:

• the Commission;
• the European Parliament;
• the Council;
• national governments;
• national parliaments;
• supervisory authorities acting outside the lawful EDPB procedure;
• the EDPS acting outside its statutory role;
• regulated companies;
• industry groups;
• political parties;
• civil-society bodies;
• academics;
• foreign governments;
• international organisations;
• private individuals.

The rule is not limited to governmental pressure.

[!example] Illustration A civil-society organisation threatens public criticism unless the EDPB adopts the strictest possible interpretation. The EDPB may consider the organisation’s legal arguments. It cannot treat the threat as an instruction. Independence protects the Board from every source of improper control, including actors whose policy objectives may be sympathetic to data protection.

15. Direct and indirect influence

Article 69 expressly prohibits instructions, but independence also protects against indirect forms of pressure.

Possible indirect influence may involve:

• threats to reduce resources;
• pressure concerning Secretariat staffing;
• promises of institutional support;
• selective access to information;
• political attacks designed to alter a decision;
• attempts to control meeting agendas;
• conflicts of interest;
• threats involving appointment or reappointment.

The CJEU’s decision in Commission v Germany concerned national supervisory authorities under the predecessor Directive. The Court explained that independence exists to ensure effective and reliable data protection supervision and requires freedom from direct and indirect external influence so authorities can act objectively and impartially. Although Article 69 concerns the EDPB rather than a national authority, the underlying reasoning provides important interpretive context.

[!example] Illustration No government formally tells the Board how to decide. Instead, officials imply that unfavourable guidance will lead to staffing cuts. The absence of an explicit command does not eliminate the independence problem. Financial pressure may influence decision-making as effectively as a direct instruction.

16. Article 69 and “complete independence” under Article 52

Article 52 says national supervisory authorities must act with complete independence. Article 69 says the EDPB must act independently.

The difference has generated debate.

One interpretation is that omission of “complete” indicates a somewhat different institutional model because:

• the EDPB is composed of national authority heads;
• the Commission participates without voting;
• the EDPS supplies the EDPB Secretariat;
• the EDPB must answer certain statutory requests.

Another interpretation is that the wording does not imply meaningful permission for external influence. Article 69(2) expressly prohibits seeking or taking instructions from anybody, which is itself a strong formulation.

The safer interpretation is:

The EDPB’s institutional arrangements differ from those of a national supervisory authority, but its substantive decision-making must remain free from external instructions and improper influence.

The word “independently” should not be weakened into mere freedom from formal commands while allowing practical political control.

17. Lessons from Commission v Germany

In Commission v Germany, the CJEU emphasised that independence serves the protection of individuals rather than conferring a privilege on the regulator. The authority must be able to act objectively and impartially and remain free from external influence, including influence from the state and not only from regulated organisations.

This reasoning is useful for Article 69 in three respects.

First, independence is functional. It exists so the Board can protect data rights effectively.

Second, independence concerns appearance as well as actual interference. A serious risk of external influence may weaken public confidence.

Third, independence is not limited to commercial capture. State and EU-level political influence can also be problematic.

[!example] Illustration The EDPB examines whether public-sector use of a new surveillance system complies with the GDPR. Independence from private companies is insufficient if governments can control the Board’s conclusion about governmental processing. The Board must be free from both public and private pressure.

18. The Commission exception in paragraph 2

Article 69(2) begins:

“Without prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2)...”

This wording means that the Commission may make certain lawful statutory requests without those requests being treated as prohibited instructions.

Article 70(1)(b) requires the EDPB to advise the Commission on any issue concerning personal data protection in the Union, including proposed amendments to the GDPR.

Article 70(2) requires the EDPB to forward its opinions, guidelines, recommendations and best practices to the Commission and to the Article 93 committee and make them public. The official Article 70 text also recognises that the Board may act on its own initiative or, where relevant, at the Commission’s request.

19. Request versus instruction

The Commission may determine the subject on which it requests advice. It cannot determine the content of the advice.

[!example] Illustration Permissible Commission request: “Please advise whether this proposed AI legislation provides adequate safeguards for personal data.” Impermissible instruction: “Issue an opinion stating that the proposed legislation fully complies with the GDPR.” The first asks the Board to exercise its statutory expertise. The second dictates the result. The Board must respond independently even when the request itself is mandatory or politically important.

20. Commission requests under Article 64(2)

The Commission may also request an EDPB opinion under Article 64(2) on:

• a matter of general application; or
• a matter producing effects in more than one Member State.

Although Article 69(2) does not expressly mention Article 64(2), such a lawful statutory request is not an instruction.

[!example] Illustration The Commission asks the EDPB to examine inconsistent national approaches to biometric identification. The Commission may explain why the issue affects the internal market. It cannot decide in advance what the EDPB’s legal answer must be. The request activates EDPB consideration. It does not control the result. The supplied commentary suggests that the EDPB cannot refuse Commission requests even if they fall outside Article 64(2). That proposition is too broad. The EDPB must assess whether the statutory conditions for the requested procedure are met. The Commission cannot enlarge the Board’s jurisdiction merely by labelling a question an Article 64(2) request.

21. Commission participation in EDPB meetings

Article 68(5) permits the Commission to participate in EDPB activities and meetings without voting rights.

Participation may be useful because the Commission can supply:

• legislative context;
• information about EU policies;
• details of adequacy arrangements;
• technical information about implementing acts;
• institutional expertise.

But Article 69 requires that participation not become control.

The absence of a Commission vote is an important safeguard. It prevents the Commission from formally determining EDPB outcomes.

Illustration

The EDPB discusses guidance criticising a Commission proposal. Commission officials may:

• explain the proposal;
• answer factual questions;
• submit legal arguments. They should not:
• threaten institutional consequences;
• prevent discussion;
• dictate draft wording;
• control the vote;
• require prior approval of the final guidance.

---

22. Should the Commission always be present?

Article 68 gives the Commission a participation right, but practical questions may arise where the Board considers:

• confidential enforcement disputes;
• litigation strategy;
• sensitive criticism of Commission policy;
• professional-secrecy material;
• questions in which the Commission has a direct institutional interest.

The GDPR does not resolve every detail of attendance and access. The Rules of Procedure and confidentiality provisions must be applied consistently with:

• Article 68 participation;
• Article 69 independence;
• Article 76 confidentiality;
• rights of defence;
• integrity of ongoing investigations.

A blanket rule excluding the Commission whenever disagreement is possible could contradict Article 68. A blanket rule giving the Commission unrestricted access to every confidential deliberation could create independence and confidentiality concerns.

A context-sensitive solution may involve:

• participation in the relevant factual discussion;
• restricted access to privileged deliberations;
• redacted documents;
• closed sessions where legally justified;
• clear records of Commission submissions.

23. Dependence on the EDPS Secretariat

Article 75 provides that the EDPS supplies the EDPB’s Secretariat.

This creates an unusual structure:

• the EDPB has separate legal personality;
• the EDPS is itself an EDPB member;
• the EDPS provides staff and administrative support;
• Secretariat staff act under the Chair’s instructions when carrying out EDPB tasks.

The EDPB’s official institutional description confirms that the Brussels-based Secretariat is provided by the EDPS and that a memorandum of understanding governs cooperation.

23.1 Does this destroy independence?

No. Administrative support from another independent data protection institution does not by itself mean that the EDPS controls EDPB decisions.

The critical safeguards are:

• functional separation;
• Chair’s authority over EDPB work;
• confidentiality;
• clear allocation of tasks;
• no EDPS instruction concerning the Board’s substantive conclusion;
• transparent administrative arrangements.

[!example] Illustration The Secretariat prepares a draft analysis for an Article 65 dispute. The EDPS cannot instruct Secretariat staff: “Draft the decision to favour this national authority.” For EDPB functions, staff must work under the EDPB’s institutional instructions and applicable procedures.

24. Budgetary and staffing independence

A body may be legally independent but practically vulnerable if it lacks adequate resources.

Relevant resources include:

• legal staff;
• technical experts;
• secure systems;
• translation;
• litigation capacity;
• administrative support;
• research and stakeholder consultation.

[!example] Illustration The EDPB must decide a complex AI dispute within a statutory deadline but has no technical experts capable of understanding the model. The resulting dependence on one external actor’s explanation may weaken practical independence. Resource independence does not require unlimited funding. It requires sufficient capacity to exercise the Board’s legal functions autonomously and effectively. Potential indirect pressure may arise if resource decisions are used to reward or punish the Board for its legal positions. Article 69 should therefore be read as protecting not only formal voting autonomy but also the practical conditions necessary for independent judgment.

25. Independence and external experts

The EDPB may consult external experts without violating Article 69.

Experts may assist with:

• cybersecurity;
• artificial intelligence;
• cryptography;
• behavioural economics;
• health research;
• children’s rights;
• international law;
• statistical analysis.

The Board must retain control over:

• questions asked;
• experts selected;
• evaluation of their work;
• final legal conclusions.

Illustration

The EDPB commissions a technical analysis of whether an anonymisation method is resistant to re-identification. The expert may explain the model and test results. The expert cannot decide:

• whether GDPR standards are legally satisfied;
• what opinion the Board must adopt;
• what final enforcement measure should be imposed. The Board should also manage:
• conflicts of interest;
• funding sources;
• confidentiality;
• transparency;
• methodology;
• reliability of evidence.

---

26. Independence and stakeholder lobbying

Stakeholder submissions can improve EDPB guidance, but unequal access may create perceptions of regulatory capture.

Illustration

The Board consults on advertising guidance. Large technology companies submit lengthy technical studies. Small consumer organisations lack similar resources. The Board should not reject industry evidence merely because it comes from industry. Nor should it adopt industry conclusions without critical examination. Fair consultation may require:

• published calls for evidence;
• transparent stakeholder meetings;
• balanced participation;
• disclosure of material submissions;
• conflict management;
• reasoned explanation of the final position. The objective is not to eliminate influence in the sense of persuasion by evidence. It is to prevent improper control and undisclosed dependency.

---

27. Independence from the Board’s own members

Article 69 may also have an internal dimension.

The EDPB is a collective body. No single national authority should dominate the Board’s conclusion outside the formal decision-making rules.

[!example] Illustration A lead supervisory authority tells other members: “You must support our draft because we control the underlying case file.” That would be inconsistent with collegial and independent assessment. The lead authority may defend its position and provide evidence. Other members must evaluate it independently. Similarly, the Chair cannot use agenda control to prevent genuine consideration of objections merely because the issue is controversial.

28. Independence does not eliminate cooperation

The Board’s core purpose includes facilitating cooperation among supervisory authorities.

Cooperation may involve:

• sharing information;
• negotiating draft language;
• discussing factual disagreements;
• reaching consensus;
• coordinating enforcement;
• adopting common positions.

None of this is inconsistent with independence.

[!example] Illustration Board members amend draft guidance after constructive discussion and reach a compromise. That compromise is legitimate if it reflects their collective legal judgment. A compromise becomes problematic only if it knowingly adopts an unlawful interpretation to satisfy political demands or avoid institutional embarrassment. Independence does not require rigidity. It requires autonomous lawful judgment.

29. Independence and accountability

A common misunderstanding is that an independent body should not be questioned.

That is wrong.

The EDPB may be subject to:

• judicial review;
• public criticism;
• parliamentary questions;
• Ombudsman scrutiny;
• access-to-document rules;
• reporting obligations;
• financial controls;
• procedural review.

The CJEU explained in the context of national supervisory authorities that independence exists to ensure effective and reliable protection, not to create an unaccountable privileged body.

The distinction is:

• accountability asks the Board to explain and legally justify what it did;
• interference tells the Board what it must decide.

[!example] Illustration A European Parliament committee asks: “Why did the EDPB take fourteen weeks to issue this opinion?” That is legitimate accountability. The committee says: “Withdraw the opinion, or we will punish members who supported it.” That would threaten independence.

30. Ex ante and ex post control

The supplied commentary suggests that scrutiny may only occur after the Board acts. That requires qualification.

Some lawful controls may operate before a final decision, including:

• procedural rules;
• consultation requirements;
• quorum and voting requirements;
• rights of affected persons to be heard;
• statutory deadlines;
• budget rules;
• conflict-of-interest safeguards.

These controls do not necessarily undermine independence because they regulate how the Board lawfully decides rather than dictating what it must decide.

Illustration

The Board must give a controller an opportunity to respond before adopting a binding adverse decision. That is an ex ante procedural safeguard. It does not instruct the Board to rule for or against the controller. The more accurate distinction is between:

• lawful procedural and institutional constraints; and
• improper substantive direction.

---

31. Judicial review does not compromise independence

EDPB decisions may be challenged before the EU Courts.

A court may review:

• competence;
• procedure;
• reasons;
• interpretation of the GDPR;
• proportionality;
• rights of defence;
• misuse of powers.

If the court annuls the decision, the EDPB must comply.

This is not an instruction prohibited by Article 69. Judicial review is part of the rule of law.

[!example] Illustration The General Court finds that the EDPB exceeded the matters covered by relevant and reasoned objections. The Board must respect the judgment and, where necessary, reconsider the matter within its lawful competence. A legally binding judgment differs fundamentally from political pressure seeking a preferred policy outcome.

32. Conflicts of interest and recusal

Article 69 does not provide a full conflict-of-interest code, but independence requires decision-makers to avoid improper personal interests.

Potential conflicts may arise where a member:

• has a financial interest;
• has a close relationship with an affected organisation;
• previously advised a party privately;
• faces another personal interest affecting impartiality.

Prior institutional involvement is more complicated.

A lead authority’s representative may have defended the draft decision now disputed under Article 65. That involvement is inherent in the one-stop-shop structure and is not automatically a disqualifying conflict.

[!example] Illustration The representative participated in the investigation as part of the authority’s official role. That does not necessarily require recusal. The representative privately owns substantial shares in the controller. That creates a materially different concern requiring disclosure and appropriate safeguards.

33. Appearance of independence

Public confidence depends not only on actual independence but also on reasonable appearance.

Illustration

The EDPB adopts guidance closely matching a private industry draft after holding only closed meetings with that industry and publishing no explanation. Even if there was no direct instruction, the process may create a reasonable perception of capture. Measures supporting the appearance of independence include:

• transparent consultation;
• disclosure of stakeholder participation;
• reasoned decisions;
• conflict declarations;
• balanced evidence;
• publication of significant inputs where lawful. Appearance cannot override confidentiality or effective decision-making, but it matters for institutional legitimacy.

---

34. What happens if Article 69 is breached?

A breach of independence may affect the legality of the resulting act.

Possible consequences include:

• annulment proceedings under Article 263 TFEU;
• pleas alleging misuse of powers;
• breach of essential procedural requirements;
• violation of the Charter;
• Ombudsman criticism;
• institutional or parliamentary scrutiny;
• reputational damage;
• reconsideration of the affected decision.

Illustration

Documentary evidence shows that the Commission secretly dictated the operative part of an Article 65 decision and the Board adopted it without independent review. An affected controller could argue that:

• Article 69 was breached;
• the EDPB failed to exercise its own statutory powers;
• the procedure was legally defective;
• the decision should be annulled. The remedy would depend on:
• nature of the act;
• standing;
• deadline;
• effect of the interference;
• applicable judicial procedure.

---

35. Practical test for Article 69 independence

When evaluating whether the EDPB acted independently, the following questions are useful:

1. Who initiated the matter?
2. Was the request authorised by the GDPR?
3. Who supplied the relevant facts?
4. Were competing views considered?
5. Did an external actor attempt to dictate the result?
6. Did the Board evaluate the law and evidence itself?
7. Were members subject to governmental or commercial instructions?
8. Were conflicts of interest addressed?
9. Were adequate resources available?

10. Did the final document contain independent reasons?

11. Were statutory voting and procedural requirements followed?

12. Can the decision be reviewed by a court?

No single factor is always decisive. The central issue is whether the Board exercised genuine autonomous judgment.

36. Full illustration

Assume the Commission asks the EDPB to advise on a proposed EU framework for processing health data for AI research.

The proposal is politically important and supported by major companies.

Permissible conduct

The Commission:

• formally requests advice;
• provides the legislative text;
• explains the policy objectives;
• answers factual questions.

The EDPB:

• consults national authorities;
• receives stakeholder submissions;
• obtains technical expertise;
• analyses the Charter and GDPR;
• identifies risks;
• proposes safeguards;
• publishes its independent opinion.

The Board may agree or disagree with the Commission.

Impermissible conduct

The Commission:

• tells the Board which conclusion to adopt;
• threatens to reduce support if the opinion is critical;
• controls the wording;
• prevents publication of concerns.

The Board:

• asks the Commission to approve its legal conclusion;
• removes findings solely to satisfy political preferences;
• adopts a position without independent analysis.

The first process respects Article 69. The second does not.

37. Key corrections and qualifications to the supplied commentary

Several points in the supplied commentary should be refined.

37.1 Article 69 is not limited to other EU bodies

The prohibition applies to instructions from anybody, including governments, companies, civil society and foreign actors.

37.2 Accountability is not necessarily only ex post

Lawful ex ante procedural safeguards, such as hearing rights and voting rules, do not undermine independence.

37.3 The omission of “complete” should not be overstated

The EDPB has a different institutional structure from national authorities, but Article 69(2) still imposes a strong no-instructions rule.

37.4 Administrative dependence on the EDPS does not automatically mean substantive dependence

Article 75 and functional arrangements place EDPB Secretariat work under the Chair’s responsibility.

37.5 Consulting experts is compatible with independence

The important requirements are control, transparency, conflict management and independent final assessment.

37.6 Commission requests do not determine EDPB answers

They may define the question lawfully submitted, but not the Board’s conclusion.

37.7 A Commission request outside the statutory conditions does not expand EDPB jurisdiction

The Board must still assess whether Article 64 or Article 70 authorises the requested procedure.

37.8 Commission participation is not itself proof of interference

The Commission has no vote. The legal question is whether participation became improper substantive influence.

Conclusion

Article 69 gives the EDPB the decisional autonomy necessary to perform its European role credibly. The Board must:

• form its own legal views;
• assess evidence independently;
• resist governmental, institutional and commercial pressure;
• avoid seeking external directions;
• refuse instructions from any source;
• preserve impartiality and integrity;
• remain accountable through reasons, transparency and judicial review. The Commission may:
• request advice or opinions where the GDPR allows;
• participate in EDPB activities;
• provide information and legal arguments. It may not:
• dictate the answer;
• control the vote;
• determine the operative part of an opinion or decision;
• punish the Board for an unfavourable legal conclusion. Similarly, national governments cannot instruct their supervisory authority representatives, and regulated organisations cannot convert consultation or technical expertise into control.

The essential distinction is:

A request asks the EDPB to exercise its judgment. An instruction tries to replace that judgment.

Independence does not mean secrecy, isolation or freedom from law. The Board must still:

• hear affected persons where required;
• follow procedural rules;
• provide reasons;
• respect deadlines;
• protect confidentiality;
• submit to judicial review;
• explain its work publicly.

In the simplest terms:

The EDPB may be informed, advised, questioned, criticised and reviewed. It may not be told what decision to make.