Article 72 — Procedure

Article 72 provides the basic constitutional rules governing how the European Data Protection Board makes decisions and controls its internal working procedures. Although the Article contains only two paragraphs, it determines whose votes count, what majority is normally required, when a higher threshold applies, and how far the Board may regulate its own organisation.

In simple terms:

The EDPB normally decides by a simple majority. For the more fundamental act of adopting its own Rules of Procedure, it needs a two-thirds majority.

This balance allows the Board to take ordinary decisions efficiently while requiring wider agreement before settling the rules that govern its own institutional functioning.

1. Purpose of Article 72

The EDPB is a collective EU body. It consists principally of:

• one representative for each EU Member State’s supervisory system; and
• the European Data Protection Supervisor, or EDPS.

The European Commission may participate in the Board’s activities and meetings, but it has no vote. EEA/EFTA supervisory authorities participate under the EEA arrangements, but they do not possess voting or office-holding rights equivalent to EU Member State representatives.

Because the Board has many members, it needs rules governing:

• how proposals are adopted;
• whose votes count;
• whether unanimity is required;
• what happens when a stronger majority is prescribed;
• how meetings and written procedures operate;
• how internal procedural rules are created and amended.

Article 72 supplies the basic framework. Paragraph 1 establishes the default voting rule. Paragraph 2 grants the Board procedural autonomy, subject to a higher two-thirds threshold for adopting its Rules of Procedure. The official text confirms this division.

2. Article 72(1): The default rule of simple majority

Paragraph 1 provides:

“The Board shall take decisions by a simple majority of its members, unless otherwise provided for in this Regulation.”

This is the EDPB’s default voting rule.

A simple majority ordinarily means more than half of the members entitled to vote in the relevant decision.

The rule avoids two undesirable extremes.

First, it avoids allowing a small minority to block ordinary work.

Second, it avoids giving any single Member State or institution a veto.

Illustration

Assume that 27 Member State representatives are entitled to vote and the EDPS is not entitled to vote on the particular matter. More than half of 27 is 14. Therefore:

• 14 votes in favour can constitute a simple majority;
• 13 votes in favour cannot. If the EDPS is also entitled to vote, there may be 28 voting members. More than half of 28 is 15. Therefore, 15 affirmative votes would be needed. This calculation is subject to the EDPB’s applicable Rules of Procedure, including quorum, abstention and voting-entitlement provisions.

---

3. Majority of members, not merely members present

Article 72 refers to a simple majority“of its members.”

It does not say:

• a majority of votes cast;
• a majority of members present;
• a majority of those who do not abstain.

The wording therefore points to the total membership entitled to vote on the relevant matter, rather than only those who happen to attend or cast a vote.

This distinction is important.

Illustration

Suppose there are 27 voting members. At a meeting:

• 18 members attend;
• 10 vote in favour;
• 6 vote against;
• 2 abstain. The proposal has a majority among those who cast a positive or negative vote because 10 exceeds 6. But 10 is not a simple majority of 27 members. On the Article 72 wording, the proposal would not be adopted. This interpretation prevents important EDPB positions from being determined by a small group simply because several members were absent or abstained. Why abstention matters If the threshold is calculated by reference to all voting members, abstention does not reduce the number of affirmative votes needed. An abstention therefore has a practical effect similar to withholding support.

Illustration

With 27 voting members:

• 13 vote in favour;
• 2 vote against;
• 12 abstain. Although far more members support than oppose the proposal, it does not receive the required 14 affirmative votes. This can make abstention strategically important. A member who cannot support the text but does not wish to oppose it may still prevent adoption if the proposal falls below the required threshold.

---

4. Who counts as a member?

Under Article 68, the Board includes:

• the head of one supervisory authority of each Member State, or a representative;
• the EDPS, or a representative.

Where a Member State has several supervisory authorities, it must appoint one joint representative under national law.

The Commission is not an EDPB member for voting purposes. It may participate but expressly has no voting right.

[!example] Illustration Germany has several data protection authorities reflecting its federal structure. Germany does not obtain a separate EDPB vote for every federal and regional authority. It participates through the joint-representation mechanism and has one voting position. This preserves equality among Member States and prevents a state with several domestic authorities from having disproportionate voting power.

5. The EDPS and variable voting entitlement

The EDPS is an EDPB member, but Article 68(6) limits its voting right in Article 65 disputes.

In an Article 65 case, the EDPS may vote only where the decision concerns principles and rules applicable to EU institutions, bodies, offices and agencies that correspond in substance to GDPR principles and rules.

Therefore, the total number of members entitled to vote may differ depending on the legal subject matter.

Illustration

The EDPB considers general guidance on data minimisation. The ordinary voting arrangements apply to the EDPS. Later, the Board considers an Article 65 dispute involving a highly specific national procedural issue with no corresponding rule for EU institutions. The EDPS may lack a vote in the second matter. This changes the relevant denominator and potentially the number of affirmative votes required. “Correspond in substance” The rules need not have identical wording or Article numbers. The relevant question is whether they regulate substantially equivalent matters. For example, principles concerning:

• lawfulness;
• transparency;
• data minimisation;
• security;
• data subject rights

generally have corresponding rules in Regulation (EU) 2018/1725 governing EU institutions.

By contrast, a question turning entirely on a distinctive Member State procedural rule may not.

6. EEA/EFTA participation without voting rights

The supervisory authorities of Norway, Iceland and Liechtenstein participate in EDPB work because the GDPR forms part of the EEA framework.

They participate fully in the one-stop-shop and consistency mechanisms and generally receive the information needed for meaningful participation. However, the EEA incorporation decision excludes:

• voting rights;
• eligibility for election as Chair;
• eligibility for election as Deputy Chair.

Illustration

An EDPB issue substantially affects Norway. The Norwegian authority may:

• participate in discussions;
• provide evidence;
• offer legal and technical analysis;
• take part in relevant subgroups;
• receive necessary information. But its position does not count as a formal vote under Article 72. This arrangement reflects the EEA institutional structure while preserving the effectiveness of EEA-wide GDPR cooperation.

---

7. One member, one vote

Article 72 does not weight votes according to:

• population;
• number of complaints;
• size of the national economy;
• amount of personal data processed;
• size of the supervisory authority;
• number of affected data subjects.

Each voting member has one vote.

Illustration

The representative of a Member State with one million residents has the same formal voting weight as the representative of a Member State with eighty million residents. This differs from certain Council voting systems, where population may affect the result. Why equal voting can be justified The Board consists of independent supervisory authorities, not representatives of national electorates in an ordinary legislative chamber. Equal voting reflects:

• legal equality among national supervisory systems;
• the shared duty to protect the same European fundamental right;
• the technical and independent character of the Board;
• the need to avoid domination by the largest states. The democratic-legitimacy concern A coalition of smaller Member States may adopt a position opposed by authorities representing most of the EU population.

This concern is real, especially where EDPB guidance or binding decisions have broad consequences. However, several safeguards reduce the risk:

• the EDPB acts under legislation adopted by Parliament and Council;
• its jurisdiction is legally limited;
• members are independent supervisory authorities;
• decisions must be reasoned;
• affected persons may have hearing rights;
• legally binding acts are subject to judicial review;
• consultation may be required;
• the Board cannot amend the GDPR through voting.

The legitimacy of an EDPB decision therefore comes from the GDPR’s legal framework, institutional independence and reasoned procedure, not from population-weighted voting alone.

8. Meaning of “decisions”

“Decisions” in Article 72 should be understood broadly as formal acts through which the Board adopts an institutional position.

It may include adoption of:

• guidelines;
• recommendations;
• best practices;
• Article 64 opinions;
• Article 65 binding decisions;
• Article 66 urgent opinions or decisions;
• annual reports;
• statements;
• internal resolutions;
• procedural arrangements.

However, not every administrative or preparatory action requires a plenary majority vote.

Illustration

An expert subgroup prepares a first draft of guidance. The subgroup’s draft is not yet the EDPB’s adopted position. The EDPB becomes institutionally responsible for the document when the Board adopts it through the procedure required by the GDPR and its Rules of Procedure. Similarly, the Secretariat’s technical correction of a spelling error does not necessarily require a fresh plenary vote. A substantive alteration of the legal analysis may. The difference depends on whether the act:

• changes the Board’s official position;
• affects legal or procedural rights;
• has external significance;
• falls within delegated editorial authority.

---

9. “Unless otherwise provided for”

Article 72 establishes a default rule, but specialised GDPR provisions may replace it.

This is the principle that a specific rule prevails over the general rule.

The most important exceptions concern:

• ordinary Article 65 binding decisions;
• Article 65 fallback voting;
• urgent Article 66 decisions;
• adoption of the Rules of Procedure;
• election of the Chair and Deputy Chairs.

10. Article 64 opinions

Article 64(3) expressly states that an EDPB opinion is adopted within the applicable period by a simple majority.

That rule is consistent with Article 72’s default.

The repetition is useful because Article 64 sets out a self-contained consistency procedure and makes the voting threshold immediately visible.

[!example] Illustration A national authority submits proposed standard data protection clauses to the EDPB. The Board considers whether the clauses comply with the GDPR. Unless another applicable rule changes the threshold, the Article 64 opinion is adopted by simple majority. The repetition in Article 64 does not mean that Article 72 is irrelevant. It confirms the default rule within that specific procedure.

11. Article 65 binding decisions

Article 65 contains the principal departure from simple majority.

An ordinary Article 65 binding decision must initially be adopted by a two-thirds majority.

This higher threshold reflects the significance of the act.

An Article 65 decision may:

• override the lead authority’s position;
• resolve whether a GDPR infringement occurred;
• require further investigation;
• alter corrective action;
• require reassessment of a fine;
• determine which authority is competent;
• resolve failure to seek or follow an Article 64 opinion.

Because the decision binds the lead and concerned supervisory authorities, the GDPR requires broader agreement than for ordinary guidance.

[!example] Illustration The Irish lead authority finds only a transparency infringement. Several concerned authorities argue that the controller also lacked a lawful basis. The EDPB’s decision may require Ireland to include an additional infringement in the final national decision. A two-thirds requirement gives such an intervention stronger institutional support.

12. Article 65 fallback rule

Article 65 also prevents deadlock.

If the EDPB cannot obtain the two-thirds majority within the initial one-month period or permitted extension, it must decide within a further two weeks by simple majority.

If the members are equally divided at that final stage, the Chair’s vote determines the outcome.

This is a carefully limited casting-vote rule.

Illustration

During the first two months, the Board repeatedly fails to reach the required two-thirds majority. At the fallback stage:

• 14 vote for one outcome;
• 14 vote for the other;
• the Chair’s vote resolves the split. The Chair’s casting role is expressly linked to Article 65(3). It should not automatically be treated as a general rule for every tie under Article 72.

---

13. Article 66 urgent procedure

Article 66 requires an urgent opinion or urgent binding decision to be adopted:

• within two weeks;
• by simple majority.

The simple-majority rule is important for binding decisions because it departs from Article 65’s normal two-thirds requirement.

The reason is urgency.

Illustration

Sensitive medical information is being exposed across several states and immediate EEA-wide action is required. Waiting to build a two-thirds majority over one or two months could defeat the protective purpose. Article 66 therefore prioritises rapid protective action, while still requiring majority support. The lower threshold does not remove:

• the need for reasons;
• rights of defence;
• jurisdictional limits;
• necessity;
• proportionality;
• judicial review.

---

14. Election of the Chair and Deputy Chairs

Article 73 provides that the EDPB elects its Chair and two Deputy Chairs by simple majority.

This is consistent with Article 72.

The better interpretation is that the majority normally concerns the EDPB’s voting membership, not simply those present, unless a legally valid procedural rule expressly provides otherwise within the GDPR’s limits.

The election procedure may use:

• secret ballots;
• successive rounds;
• nomination procedures;
• candidacy rules.

Those operational details are addressed in the Rules of Procedure.

15. What happens in an ordinary tie?

Article 72 does not expressly state what happens if an ordinary proposal receives equally divided votes.

Article 65(3) contains a specific Chair’s casting-vote rule, but only for its final fallback process.

The existence of that express special rule suggests that a general casting vote should not be invented for every Article 72 tie.

Illustration

In an ordinary vote:

• 14 members support a proposal;
• 14 oppose it. If 28 members are entitled to vote, 14 is not more than half. No simple majority exists. The proposal therefore fails unless a specific GDPR or valid procedural provision supplies another result. The Chair’s ordinary vote counts like the vote of any other entitled member. The Chair should not automatically receive a second, decisive vote merely because the result is tied. Extending Article 65’s casting vote by analogy to all decisions would be legally questionable because Article 72 says that simple majority is the rule and Article 65 deliberately creates a specific exception.

---

16. Are there blocking minorities?

Article 72 does not create a formal blocking-minority system comparable to some Council voting procedures.

No Member State has:

• a veto;
• population-weighted blocking power;
• a special right to stop a decision because the case concerns a controller headquartered in its territory.

However, members can practically prevent adoption by:

• voting against;
• abstaining where affirmative votes fall below the threshold;
• persuading others that the proposal should not pass.

[!example] Illustration The lead supervisory authority strongly opposes an Article 64 opinion concerning its draft decision. It cannot veto the EDPB opinion merely because it submitted the draft. Its vote has the same formal weight as other voting members, subject to the GDPR’s specific procedures.

17. Article 72(2): Procedural autonomy

Paragraph 2 provides:

“The Board shall adopt its own rules of procedure by a two-thirds majority of its members and organise its own operational arrangements.”

This grants the EDPB a significant degree of internal autonomy.

The Board does not need the Commission to write its meeting rules. Nor does each procedural amendment require a new EU Regulation.

The Board may regulate matters such as:

• meetings;
• agendas;
• voting;
• written procedures;
• secret ballots;
• membership and representation;
• observers;
• experts;
• subgroups;
• consultation;
• document preparation;
• confidentiality;
• Secretariat support;
• publication;
• operational workflow.

The EDPB’s official register identifies Version 8 of its Rules of Procedure, adopted on 6 April 2022, as the current published version. Earlier versions and the initial rules adopted on 25 May 2018 are also available.

18. Why a two-thirds majority is required

The Rules of Procedure determine how the Board will exercise its powers in future cases.

They may affect:

• all members;
• voting rights;
• participation;
• efficiency;
• confidentiality;
• preparation of binding decisions;
• procedural rights of affected persons;
• institutional balance between the Chair, members and Secretariat.

A bare simple majority should not easily redesign the system for everyone.

Illustration

A proposal would amend the Rules of Procedure to:

• shorten review periods;
• change written-voting procedures;
• modify the role of expert subgroups;
• alter confidentiality rules. Requiring two-thirds support ensures that such foundational changes reflect broad institutional agreement. The two-thirds requirement protects procedural stability and reduces the risk that a temporary majority will rewrite the rules to suit one dispute.

---

19. Rules of Procedure versus operational arrangements

Paragraph 2 refers separately to:

1. adopting Rules of Procedure; and
2. organising operational arrangements.

These concepts overlap but are not identical.

Rules of Procedure

These are general and durable rules governing how the Board works.

Examples

include:

• member participation;
• voting rules;
• Chair and Deputy Chair procedures;
• adoption of documents;
• confidentiality;
• expert subgroups;
• written procedure.

Operational arrangements

These concern the practical organisation of work.

Examples

include:

• meeting calendars;
• document deadlines;
• technical platforms;
• subgroup assignments;
• rapporteur allocation;
• translation arrangements;
• administrative workflows;
• division of preparatory tasks.

[!example] Illustration A general rule that all written procedures must remain open for a specified minimum period belongs naturally in the Rules of Procedure. A decision that a particular expert subgroup will meet on 15 September is an operational arrangement. This distinction matters because Article 72 expressly requires a two-thirds majority for adopting the Rules of Procedure, while it does not clearly require a two-thirds vote for every routine operational decision.

20. The Board cannot evade the two-thirds rule through labels

The EDPB should not classify a substantive procedural amendment as an “operational arrangement” merely to avoid the two-thirds threshold.

The correct classification depends on substance, not title.

Illustration

The Board adopts a resolution stating: “For all future Article 65 cases, affected controllers will never receive access to objections.” Although labelled an operational arrangement, this is a general procedural rule with major consequences for rights of defence. It cannot escape the requirements applicable to procedural rules merely because of its title. By contrast, selecting a videoconferencing platform for one meeting is genuinely operational. A sound distinction asks:

• Is the arrangement general or case-specific?
• Is it intended to govern future cases?
• Does it affect member rights?
• Does it affect third-party procedural rights?
• Does it alter voting or participation?
• Does it have enduring institutional significance?

---

21. Limits on the Board’s rule-making autonomy

The EDPB’s Rules of Procedure are subordinate to:

• the GDPR;
• the EU Treaties;
• the Charter;
• CJEU case law;
• applicable EU legislation;
• general principles of EU law.

The Board cannot use Article 72(2) to amend primary or secondary law.

The Board cannot change:

• its statutory membership;
• the Commission’s no-vote status;
• EDPS voting restrictions;
• Article 64 deadlines;
• Article 65 voting thresholds;
• Article 66 urgency rules;
• Article 71 reporting duties;
• judicial remedies;
• rights of defence;
• the requirement of independence.

[!example] Illustration The Rules of Procedure state: “Article 65 binding decisions may be adopted immediately by one-quarter of the members.” That rule would conflict with Article 65 and Article 72 and would be unlawful. Likewise, the Board cannot adopt a rule giving the Commission a vote because Article 68(5) expressly denies it voting rights. Procedural autonomy means freedom within the law, not freedom to change the law.

22. Internal rules cannot create new substantive powers

The Rules of Procedure may explain how existing powers are used. They cannot create entirely new regulatory competence.

Illustration

The Board adopts an internal rule authorising itself to:

• inspect companies directly;
• impose administrative fines;
• seize servers;
• hear every individual complaint. The GDPR assigns ordinary investigation and enforcement principally to national supervisory authorities. Article 72 cannot be used to transfer those powers to the EDPB. The distinction is:
• permissible: regulate the process for adopting an Article 65 decision;
• impermissible: create a new category of EDPB enforcement power.

---

23. Main content of the Rules of Procedure

The published EDPB Rules of Procedure address areas including:

• the Board’s identity and mission;
• guiding principles;
• membership and participation;
• Chair and Deputy Chairs;
• observers and experts;
• Article 64 opinions;
• Article 65 binding decisions;
• urgent procedures;
• Secretariat and organisation;
• meetings;
• written procedures;
• expert subgroups;
• consultation;
• confidentiality;
• final provisions.

The published Version 8 was adopted on 6 April 2022.

The Rules’ guiding principles include:

• independence and impartiality;
• good governance;
• integrity;
• good administrative behaviour;
• collegiality;
• inclusion;
• cooperation;
• transparency;
• efficiency;
• modernisation;
• proactivity.

These principles help interpret procedural gaps but cannot override express GDPR rules.

24. Plenary meetings and preparatory work

The EDPB generally makes its formal decisions through the plenary.

Preparatory work may be performed by:

• the Secretariat;
• expert subgroups;
• rapporteurs;
• task forces;
• designated members.

The official EU description explains that plenary decisions are based on preparatory work by expert subgroups and the EDPB Secretariat.

Illustration

An expert subgroup prepares draft guidance on anonymisation. The subgroup may:

• study case law;
• collect national experience;
• consult technical experts;
• prepare draft text. But the subgroup cannot ordinarily transform the draft into an adopted EDPB guideline by itself. The plenary must adopt the document under the applicable voting procedure. This distinction preserves institutional accountability. The body legally responsible for the document must make the final decision.

---

25. Written and electronic procedures

The EDPB’s work cannot depend exclusively on physical meetings.

Cross-border cases may involve:

• short Article 64 deadlines;
• urgent Article 66 requests;
• rapid technical corrections;
• time-sensitive statements;
• members located throughout the EEA.

The Rules of Procedure therefore support written and electronic working arrangements.

Illustration

An urgent opinion must be adopted within two weeks. Waiting for the next scheduled physical plenary may make compliance impossible. A secure written procedure can allow members to:

• receive the draft;
• submit comments;
• propose amendments;
• vote electronically;
• create a reliable record. Written procedure must still preserve:
• voting entitlement;
• quorum;
• confidentiality;
• adequate deliberation;
• rights of affected parties;
• verifiable voting results. Efficiency cannot justify a process so compressed that members cannot understand what they are voting on.

---

26. Quorum and majority are different

A quorum determines whether enough members are participating for the Board to conduct valid business.

A majority determines how many votes are required to adopt the proposal.

These must not be confused.

[!example] Illustration Assume the Rules of Procedure require a particular quorum and that the quorum is met. That does not automatically mean that a proposal passes by receiving more votes in favour than against among those present. Article 72 still requires the applicable majority of members, subject to the proper interpretation of the membership and voting rules. Conversely, a proposal might theoretically receive enough affirmative written votes, but if the required procedural conditions for the meeting or written procedure were not met, validity may still be questioned.

27. Secret ballots

Secret ballots may be appropriate for:

• election of the Chair;
• election of Deputy Chairs;
• dismissal decisions;
• sensitive internal matters.

They may reduce pressure and protect members’ freedom of choice.

However, secrecy creates a transparency tension.

Illustration

A secret ballot allows members to elect the Chair without governmental or institutional pressure. That supports independence. But where the Board adopts a legally binding Article 65 decision affecting a controller, secrecy about the voting process may make institutional accountability more difficult. The GDPR does not generally require publication of each member’s individual vote. The EDPB may publish the numerical outcome rather than a roll-call vote, subject to its Rules and applicable transparency law. The key distinction is between:

• secrecy protecting free voting;
• secrecy hiding the reasons for the institutional decision. Even where individual votes are confidential, the decision itself must be adequately reasoned.

28. Ad hoc procedural decisions

The Board will occasionally face a procedural issue not fully addressed by the GDPR or the Rules of Procedure.

It may need to decide matters such as:

• speaking order;
• extension of an internal drafting period;
• use of a secure technical platform;
• appointment of a rapporteur;
• sequence of voting on amendments.

Article 72(2)’s reference to operational arrangements gives the Board flexibility to resolve such matters.

Illustration

A highly technical Article 64 opinion requires two expert subgroups to work jointly. The Board may decide how the drafting responsibility will be divided without formally amending the Rules of Procedure. However, an ad hoc decision must not:

• contradict existing rules;
• evade a higher voting threshold;
• prejudice hearing rights;
• alter a statutory deadline;
• decide the merits under the guise of procedure.

---

29. Can the Board suspend its own Rules?

A procedural body may sometimes need flexibility, but it cannot casually disregard the Rules it adopted.

The principle of good administration generally requires an institution to follow its own procedural rules, especially where they protect:

• members’ participation;
• affected parties;
• voting integrity;
• legal certainty.

[!example] Illustration The Rules require circulation of an important draft sufficiently before voting. The Chair circulates a completely new text minutes before the vote without genuine urgency. Affected members may argue that they were deprived of meaningful participation. The Board may be able to adopt carefully framed exceptions where its Rules permit them. It cannot disregard mandatory safeguards merely because following them is inconvenient.

30. Procedure and rights of defence

Article 72 is internal in form, but its operation may affect external parties.

An Article 65 or 66 decision may influence:

• infringement findings;
• fines;
• processing bans;
• erasure orders;
• competence of a lead authority.

Therefore, the Board’s procedures must respect:

• right to be heard;
• access to relevant material;
• impartiality;
• adequate reasons;
• meaningful time to respond;
• professional secrecy.

[!example] Illustration A concerned authority raises a new Article 9 allegation during an Article 65 dispute. The controller has never been shown the relevant objection or evidence. The Board cannot use an internal voting rule to bypass the controller’s right to answer a materially adverse allegation. A procedurally valid majority vote does not cure a fundamental breach of due process.

31. Judicial review of procedural defects

EDPB acts may be challenged before the EU Courts where Article 263 TFEU requirements are met.

A procedural defect may justify annulment where it concerns:

• competence;
• an essential procedural requirement;
• rights of defence;
• improper voting;
• incorrect majority;
• failure to give reasons;
• breach of the Rules of Procedure;
• misuse of powers.

[!example] Illustration An Article 65 decision is adopted with only a simple majority during the initial period, although the GDPR required two-thirds. That defect concerns a statutory voting threshold and could materially affect validity. By contrast, a harmless typographical error in an internal agenda may not justify annulment if it had no effect on the outcome or procedural rights. The seriousness of the defect, its legal character and its effect on the decision must be assessed.

32. Relevant recitals

Recital 136

Recital 136 is directly relevant.

It explains that:

• EDPB opinions should be issued within defined periods;
• binding decisions should resolve disputes between supervisory authorities;
• Article 65 decisions should, in principle, be adopted by a two-thirds majority.

This supports Article 72’s structure:

• simple majority as the general rule;
• stronger majority for binding dispute resolution;
• fallback rules to prevent deadlock.

Recital 139

Recital 139 is also directly relevant.

It explains the EDPB’s:

• legal personality;
• composition;
• independence;
• Commission participation;
• consistency function.

Procedural autonomy under Article 72 helps protect the independence described in Recital 139.

Recitals 72 and 77

Recitals 72 and 77 concern:

• profiling;
• risk guidance;
• best practices;
• compliance measures.

They illustrate substantive areas in which the EDPB may adopt guidance under Article 70. They do not directly interpret the majority rules or procedural autonomy in Article 72.

Their relevance is therefore indirect:

1. Article 70 empowers the Board to issue such guidance.
2. Article 72 determines how the Board formally adopts it.

33. Practical end-to-end example

Assume the EDPB is preparing guidance on high-risk AI profiling.

Preparation

An expert subgroup drafts the document with assistance from the Secretariat.

National supervisory authorities submit examples from:

• recruitment;
• credit scoring;
• health insurance;
• educational admissions.

Stakeholder consultation

The EDPB adopts a draft for consultation. Businesses, civil-society groups, academics and individuals submit comments.

Revision

The expert subgroup reviews the comments and prepares a revised draft.

Plenary debate

Members discuss:

• definition of profiling;
• solely automated decisions;
• significant effects;
• human intervention;
• special-category data;
• safeguards.

Vote

Unless another GDPR rule applies, the final guidance must receive a simple majority under Article 72(1).

If the required number of affirmative votes is not reached, the guidance is not adopted even if more members support it than oppose it among those voting.

Publication

Once adopted, the guidance becomes the EDPB’s official institutional position and is published under Article 70.

This example shows the relationship among:

• Article 70, which authorises the guidance;
• Article 72, which governs adoption;
• the Rules of Procedure, which organise drafting and consultation.

34. Corrections and qualifications to the supplied commentary

Several points in the supplied commentary require refinement.

34.1 There are more than two exceptions to the general voting rule

The two-thirds requirements in Articles 65(2) and 72(2) are the most prominent, but Article 65(3) creates a fallback simple-majority and casting-vote procedure, Article 66(4) expressly provides a simple-majority urgency rule, and Article 73 contains the Chair election rule.

34.2 The term is EDPB Rules of Procedure, not EDPS Rules of Procedure

Article 72(2) governs the Rules of Procedure of the European Data Protection Board. The EDPS is a separate institution with its own rules.

34.3 The Article 65 tie rule should not automatically be extended to ordinary decisions

The Chair’s casting vote is an express and exceptional rule for the Article 65 fallback stage.

34.4 A simple majority is not necessarily calculated only from attendees

The wording “of its members” points to the membership entitled to vote, subject to relevant EDPB procedural rules.

34.5 Abstentions may prevent the threshold from being reached

They are not necessarily excluded from the denominator as they might be in an ordinary “votes cast” system.

34.6 Operational arrangements cannot be used to bypass the two-thirds rule

A measure’s substance, not its label, determines whether it effectively amends the Rules of Procedure.

34.7 The Board cannot use its procedural autonomy to create substantive powers

Article 72 permits organisation of existing functions, not expansion of jurisdiction.

34.8 The latest published Rules of Procedure listed by the EDPB remain Version 8

The EDPB’s public register identifies Version 8, dated 6 April 2022, as the latest published version as of August 2026.

Conclusion

Article 72 is the EDPB’s basic decision-making constitution. It establishes two main principles. First, the Board normally decides by simple majority. This allows it to adopt:

• guidance;
• recommendations;
• opinions;
• reports;
• institutional positions without requiring unanimity. Second, the Board controls its own internal procedures. But because the Rules of Procedure shape all future decision-making, they require a broader two-thirds majority. The Article creates a balance among:
• efficiency, through simple-majority decision-making;
• stability, through a higher threshold for procedural rules;
• independence, through internal procedural autonomy;
• legality, because the Rules remain subordinate to the GDPR;
• accountability, because votes and procedures may affect validity and judicial review.

The essential practical rules are:

• there is no ordinary national veto;
• each EU Member State has one voting position;
• the Commission does not vote;
• EEA/EFTA authorities participate but do not vote;
• the EDPS’s voting rights may vary in Article 65 cases;
• Article 65 initially requires a two-thirds majority;
• Article 66 urgent action uses simple majority;
• an ordinary tie does not automatically give the Chair a casting vote;
• the Board’s internal rules cannot amend or override the GDPR.

In the simplest terms:

Article 72 tells the EDPB how to turn discussion into an official European position. Most decisions require support from more than half of the voting membership, while the rules governing the institution itself require the stronger support of two-thirds.