Article 75 — Secretariat

Article 75 creates the administrative and analytical machinery that enables the European Data Protection Board, or EDPB, to function in practice. The Board’s members take the formal decisions, but the Secretariat performs much of the continuous legal, technical, administrative and logistical work needed to prepare those decisions, organise meetings, communicate with institutions and publish the Board’s outputs.

In simple terms:

The EDPB is the decision-making body. The Secretariat is the professional support structure that keeps the Board operating from day to day.

Article 75 also addresses a delicate institutional problem. The EDPB has its own legal personality and must act independently, but it does not operate a wholly separate personnel administration. Its Secretariat is supplied by the European Data Protection Supervisor, or EDPS. Article 75 therefore creates safeguards intended to ensure that Secretariat staff support the EDPB under the authority of the EDPB Chair, rather than being directed by the EDPS in relation to the substance of EDPB work.

---

1. Why the EDPB needs a Secretariat

The EDPB is a collegial body composed primarily of the heads of national supervisory authorities and the EDPS. These members meet periodically and vote on formal outputs. They do not collectively perform every piece of research, translation, scheduling, drafting and publication themselves.

The Board’s work includes:

• Article 64 consistency opinions;
• Article 65 binding dispute-resolution decisions;
• Article 66 urgent opinions and decisions;
• guidelines, recommendations and best practices;
• advice on proposed legislation;
• adequacy-related opinions;
• binding corporate rules;
• enforcement cooperation;
• stakeholder consultations;
• annual reports;
• public registers;
• litigation before the EU Courts.

These activities require permanent professional support.

Illustration

A national supervisory authority submits a draft decision concerning binding corporate rules. Before the EDPB can issue an Article 64 opinion, someone must:

1. register the matter;
2. review whether the file is complete;
3. circulate the documents;
4. organise translations;
5. identify the relevant legal issues;
6. coordinate the expert subgroup;
7. prepare the draft opinion;
8. arrange the vote;
9. communicate the adopted opinion;

10. publish the final text.

The EDPB members provide the legal direction and adopt the opinion. The Secretariat makes the institutional process workable.

This is why Article 75 does not describe the Secretariat as performing only clerical work. Paragraph 5 expressly assigns it analytical, administrative and logistical support. The EDPB’s official description likewise states that its Brussels-based Secretariat prepares, drafts, translates and publishes EDPB opinions and binding decisions, organises meetings, supports communications and supplies information technology solutions.

---

2. Article 75(1): The Board must have a Secretariat

Paragraph 1 states:

“The Board shall have a secretariat.”

The word“shall” makes the Secretariat mandatory. The EDPB cannot lawfully be left as a meeting forum with no stable professional support.

The guarantee serves several purposes:

• continuity between plenary meetings;
• institutional memory;
• consistent legal drafting;
• management of strict statutory deadlines;
• secure handling of dispute files;
• communication with national authorities;
• independence from ad hoc external assistance.

Illustration

Without a permanent Secretariat, responsibility for preparing each Article 65 decision might fall informally to whichever national authority had the most staff available. That could create several problems:

• the lead authority might shape the draft in its own favour;
• smaller authorities might have little influence;
• confidential information might be handled inconsistently;
• deadlines might be missed;
• the quality of decisions could vary significantly. A permanent Secretariat gives the Board a common professional infrastructure rather than leaving it dependent on individual national authorities.

3. Why the EDPS provides the Secretariat

Article 75(1) states that the Secretariat is provided by the EDPS.

The EDPS is the independent authority responsible for supervising the processing of personal data by EU institutions, bodies, offices and agencies under Regulation (EU) 2018/1725.

The decision to use the EDPS rather than the European Commission has an institutional logic.

The EDPS:

• is an independent data protection authority;
• possesses specialised data protection knowledge;
• has an established administrative structure;
• is itself an EDPB member;
• operates within the EU institutional framework;
• can provide staff, premises and financial administration.

By contrast, the Commission:

• proposes legislation;
• adopts certain implementing and adequacy decisions;
• may have policy interests in matters considered by the EDPB;
• participates in EDPB activity without voting rights.

Placing the Secretariat directly under Commission control could create an appearance that the EU executive controlled the day-to-day support structure of a body that may criticise Commission legislation or international-transfer arrangements.

---

4. The EDPB and EDPS remain separate legal actors

The fact that the EDPS supplies the Secretariat does not make the EDPB a department of the EDPS.

They remain distinct institutions with different functions.

The EDPB

The EDPB:

• ensures consistent application of European data protection law;
• coordinates national supervisory authorities;
• issues guidance;
• adopts consistency opinions;
• makes binding decisions in specified disputes.

The EDPS

The EDPS:

• supervises EU institutions;
• investigates complaints concerning EU bodies;
• exercises corrective powers under Regulation 2018/1725;
• advises on EU legislation and policy;
• performs its own independent statutory tasks.

The Secretariat arrangement therefore creates administrative interdependence without legal merger.

[!example] Illustration The EDPS may take one view on a legal issue affecting an EU institution. The EDPB may later adopt a different collective interpretation on a corresponding GDPR issue. Secretariat staff preparing the EDPB document must support the position adopted by the EDPB. They cannot substitute the EDPS’s separate institutional view merely because they are formally employed by the EDPS.

5. Article 75(2): Exclusive instructions of the Chair

Paragraph 2 provides:

“The secretariat shall perform its tasks exclusively under the instructions of the Chair of the Board.”

The word“exclusively” is central.

For EDPB work, substantive and operational direction comes from the EDPB Chair, not from:

• the EDPS acting in its separate supervisory capacity;
• the Commission;
• a national government;
• an individual national supervisory authority;
• a regulated company;
• an outside organisation.

The official EDPB description confirms that Secretariat staff are employed by the EDPS but work under the instructions of the EDPB Chair.

[!example] Illustration The Board has initiated work on guidance concerning the use of personal data by EU institutions and private controllers. The EDPS holds an institutional view that differs from the emerging EDPB majority. The EDPS cannot instruct Secretariat staff: “Draft the EDPB guidance to reflect the EDPS position.” For the EDPB assignment, staff must follow the EDPB’s institutional process and the Chair’s lawful instructions.

6. The Chair’s authority is functional, not personal

Paragraph 2 does not turn Secretariat staff into the Chair’s personal employees.

The Chair’s authority concerns the performance of EDPB tasks. It does not give the Chair unrestricted control over:

• employment contracts;
• personal leave;
• salary;
• disciplinary law;
• pension rights;
• recruitment rules;
• EU staff regulations.

Those administrative matters remain within the applicable EDPS and EU employment framework, subject to the Memorandum of Understanding and separation safeguards.

Illustration

The Chair may instruct the Secretariat: “Prepare an initial legal analysis of the objections in this Article 65 matter.” The Chair cannot instruct an employee: “Perform unrelated private work for me.” Similarly, the Chair cannot lawfully require staff to:

• conceal evidence;
• change an adopted decision;
• disclose protected information;
• disregard judicial orders;
• discriminate against a colleague. The Chair’s instructions must be:
• lawful;
• connected to EDPB tasks;
• consistent with Board decisions;
• consistent with the Rules of Procedure;
• respectful of professional duties.

---

7. The Secretariat serves the Board through the Chair

The phrase “under the instructions of the Chair” should not be misunderstood as meaning that the Chair may use the Secretariat against the Board’s collective will.

The Chair is the operational point of direction, but the Secretariat ultimately supports the EDPB as a body.

Illustration

The EDPB adopts a guideline by majority. The Chair personally disagreed with one section. The Chair cannot instruct the Secretariat to publish a modified version deleting that section. The Secretariat must publish the text adopted by the Board. The institutional sequence is:

1. the Board establishes the position;
2. the Chair directs the supporting process;
3. the Secretariat prepares and implements the necessary work;
4. the final text must remain faithful to the Board’s decision.

The Chair manages the machinery. The Chair does not own the EDPB’s substantive position.

---

8. Direct and indirect influence by the EDPS

The legislative structure clearly prevents the EDPS from directly instructing Secretariat staff on EDPB work.

The more difficult question concerns indirect influence.

Secretariat staff may remain dependent on the EDPS for matters such as:

• employment status;
• career progression;
• salary administration;
• performance management;
• promotion;
• workplace resources;
• disciplinary structures.

This creates a potential structural tension.

Illustration

A Secretariat lawyer prepares an EDPB analysis that strongly criticises an EDPS policy position. The lawyer may reasonably wonder whether that work will affect career progression within the EDPS administration. Even if no actual pressure occurs, the institutional arrangement could create an appearance or risk of indirect influence. Article 75 addresses this risk through:

• exclusive Chair instructions for EDPB work;
• separate reporting lines;
• a published Memorandum of Understanding;
• functional separation;
• the EDPB’s independent legal personality. These safeguards reduce the risk. They do not make institutional dependence disappear entirely.

---

9. Article 75(3): Separate reporting lines

Paragraph 3 requires EDPS staff performing EDPB tasks to have separate reporting lines from staff performing EDPS tasks.

A reporting line identifies:

• who assigns work;
• who receives work products;
• who supervises performance;
• who gives operational directions;
• who handles escalation;
• who controls access to information.

Separate reporting lines help ensure that EDPB work is not managed through the EDPS’s ordinary supervisory hierarchy.

Illustration

One EDPS unit investigates an EU institution. At the same time, the EDPB Secretariat prepares guidance on a related legal question. Without separate reporting lines, the EDPS investigator might:

• direct the EDPB draft;
• obtain confidential EDPB deliberations;
• influence the timing;
• prevent publication of a conflicting interpretation. Separate reporting lines are meant to prevent such cross-institutional control.

---

10. Separate reporting lines do not necessarily mean separate premises

Functional separation can exist even where staff share:

• a building;
• some administrative systems;
• common HR services;
• procurement functions;
• security infrastructure.

What matters is whether the EDPB Secretariat has adequate separation regarding:

• instructions;
• case files;
• access permissions;
• decision-making;
• reporting;
• confidentiality.

Illustration

EDPB and EDPS staff work in the same office building. That fact alone does not violate Article 75. A problem would arise if EDPS officials who are not assigned to EDPB work can freely access:

• confidential Article 65 drafts;
• voting records;
• stakeholder submissions;
• litigation strategy;
• internal EDPB deliberations. Physical proximity is different from functional control.

---

11. Confidentiality within the shared structure

The shared administrative arrangement makes information barriers particularly important.

EDPB Secretariat staff may handle:

• confidential disputes among national authorities;
• controller submissions;
• complainant identities;
• trade secrets;
• security vulnerabilities;
• draft binding decisions;
• litigation strategy;
• internal voting material.

Such information should be accessible only to people who need it for authorised EDPB work.

Illustration

The EDPS is an EDPB member but lacks voting rights in a particular Article 65 matter because Article 68(6) applies. The Secretariat should carefully manage access and participation consistently with:

• the EDPS’s membership rights;
• the particular voting restriction;
• professional secrecy;
• procedural fairness;
• the Rules of Procedure. Separate reporting lines are therefore not simply an organisational chart. They must be reflected in:
• information systems;
• permissions;
• document management;
• confidentiality practices.

---

12. Relationship with Commission v Austria

The supplied commentary relies on the CJEU’s judgment in Commission v Austria, Case C-614/10.

That case concerned the independence of Austria’s former national data protection authority. The CJEU found that Austria had not ensured complete independence because, among other matters:

• the managing member was a federal official subject to supervision;
• the authority’s office was integrated into the Federal Chancellery;
• the Federal Chancellor had an unconditional right to information about its work.

The judgment supports the broader principle that formal freedom from instructions may be insufficient if staffing and organisational arrangements create a risk of indirect external influence.

However, the case should not be treated as deciding Article 75 directly.

There are important differences:

• Commission v Austria concerned a national supervisory authority;
• Article 75 expressly creates separate EDPB reporting lines;
• both the EDPB and EDPS are independent data protection bodies;
• the EDPB Chair, not the EDPS, directs Secretariat work.

The case supplies interpretive context about structural independence. It does not prove that the Article 75 arrangement is inherently unlawful.

---

13. Secretariat staff are not merely “seconded temporarily”

The commentary describes Secretariat staff as formally employed by the EDPS and only temporarily made available to the EDPB.

That description should be used carefully.

The important legal facts are:

• the EDPS provides the Secretariat;
• staff are employed within the EDPS administrative structure;
• they work under the EDPB Chair’s instructions for EDPB functions;
• separate reporting lines apply;
• the Memorandum of Understanding regulates cooperation.

Whether every employee is technically “seconded” in the legal employment sense depends on the individual staffing arrangement. Article 75 does not use the language of secondment.

A more accurate formulation is:

Secretariat personnel are administratively employed through the EDPS but functionally assigned to support the EDPB under separate reporting lines and the Chair’s instructions.

---

14. Article 75(4): Memorandum of Understanding

Paragraph 4 allows the EDPB and EDPS, where appropriate, to establish and publish a Memorandum of Understanding, or MoU.

The parties signed an MoU on 25 May 2018. The EDPB publishes it together with information explaining that it determines the terms of EDPB-EDPS cooperation and applies to Secretariat staff supplied by the EDPS.

The MoU is important because the GDPR establishes the institutional principles but does not regulate every operational detail.

The MoU can address:

• staffing;
• reporting lines;
• performance appraisal;
• recruitment;
• leave;
• disciplinary matters;
• budget administration;
• workspace;
• IT systems;
• document separation;
• access controls;
• confidentiality;
• communication;
• financial arrangements;
• resolution of institutional difficulties.

---

15. Meaning of “where appropriate”

Article 75(4) says the EDPB and EDPS shall establish an MoU“where appropriate.”

This language appears discretionary. In practice, the shared staffing and administrative arrangement made a formal agreement highly appropriate.

Without an MoU, recurring questions would arise:

• Who selects Secretariat staff?
• Who evaluates their EDPB work?
• Who controls access to EDPB files?
• How are budgets prepared?
• What happens when the Chair and EDPS disagree?
• How are staff reintegrated into other EDPS roles?
• Who authorises expenditure?

The MoU converts the Article’s broad separation principles into an operational arrangement.

---

16. Legal status of the MoU

The MoU cannot amend or override the GDPR.

It must be interpreted consistently with:

• Articles 68 to 76;
• EDPB independence;
• EDPS independence;
• EU staff law;
• general principles of good administration;
• professional secrecy;
• EU financial rules.

Illustration

Suppose the MoU stated: “The EDPS may approve the substance of every EDPB Article 65 decision before publication.” That provision would conflict with:

• Article 69 independence;
• Article 75(2) exclusive Chair instruction;
• the Board’s collective decision-making authority. The GDPR would prevail. The MoU fills administrative gaps. It cannot transfer statutory decision-making power.

---

17. Publication of the MoU

Article 75 specifically contemplates publication.

Transparency is important because the public and regulated organisations should be able to understand:

• how the EDPB remains independent;
• how EDPS staff serve the EDPB;
• how reporting lines are separated;
• how resources are managed.

Publication helps reduce concerns that the relationship is governed by undisclosed informal arrangements.

However, operational security details may require appropriate protection. For example, the public MoU need not reveal sensitive information about:

• cybersecurity architecture;
• access credentials;
• specific vulnerabilities;
• protected staff information.

Transparency should explain institutional governance without creating security risks.

---

18. Can the MoU fully eliminate dependence?

No administrative agreement can remove every practical dependency.

The EDPS may still be involved in:

• human resources;
• budget administration;
• premises;
• procurement;
• employment status;
• technical infrastructure.

The real question is whether safeguards make the EDPB sufficiently autonomous in performing its statutory tasks.

Relevant indicators include:

• whether the Chair controls work priorities;
• whether EDPB files are protected;
• whether performance appraisal respects EDPB reporting lines;
• whether resources are adequate;
• whether the EDPS refrains from substantive interference;
• whether disputes can be escalated and resolved transparently.

The effectiveness of independence safeguards must be assessed in practice rather than assumed from the existence of an MoU alone.

---

19. Article 75(5): Analytical, administrative and logistical support

Paragraph 5 identifies three broad categories of support:

1. analytical;
2. administrative;
3. logistical.

These categories overlap.

19.1 Analytical support

Analytical support may include:

• legal research;
• review of national positions;
• analysis of objections;
• examination of technical evidence;
• comparison of Member State law;
• preparation of draft opinions;
• preparation of binding decisions;
• assessment of international-transfer safeguards;
• litigation analysis.

19.2 Administrative support

Administrative support may include:

• registering files;
• maintaining records;
• tracking deadlines;
• organising consultations;
• keeping correspondence;
• managing publication workflows;
• coordinating approvals;
• maintaining institutional archives.

19.3 Logistical support

Logistical support may include:

• arranging meetings;
• videoconferencing;
• travel coordination;
• room booking;
• interpretation;
• document circulation;
• technical voting tools;
• secure access systems.

The express inclusion of analytical support shows that the Secretariat is not simply an administrative office.

---

20. Analytical support does not give the Secretariat decision-making power

The Secretariat may research and draft, but the Board decides.

Illustration

Secretariat lawyers analyse whether an objection is relevant and reasoned under Article 4(24). They prepare a draft concluding that the objection does not satisfy the threshold. The EDPB members may:

• accept the analysis;
• revise it;
• reject it;
• request more evidence;
• adopt a different conclusion. The published binding decision is an act of the EDPB, not of the Secretariat. This distinction protects democratic and institutional accountability within the EDPB structure. A Secretariat draft is:
• preparatory;
• internal;
• subject to Board instruction;
• not automatically the EDPB’s final view.

---

21. Drafting influence is still significant

Although the Secretariat lacks formal voting power, the person who prepares the first draft may shape:

• issue framing;
• structure;
• selection of authorities;
• factual summary;
• proposed legal reasoning;
• apparent range of options.

This creates a form of practical influence.

Illustration

An Article 65 dispute contains twenty objections. The Secretariat’s initial assessment identifies only five as relevant and reasoned. That selection may strongly influence later discussion, even though the Board retains final power. Safeguards should include:

• member review;
• transparent identification of objections;
• reasoned analysis;
• affected-party submissions;
• expert input;
• plenary voting;
• version control. The answer is not to deny the Secretariat any analytical function. The answer is to ensure that its analytical work remains reviewable and accountable.

---

22. Article 75(6): The list is illustrative, not exhaustive

Paragraph 6 says that the Secretariat is responsible“in particular” for the listed tasks.

This means the list is not exhaustive.

The Secretariat may perform other support tasks reasonably connected with the Board’s legal mandate.

Possible additional tasks include:

• stakeholder consultation management;
• litigation support;
• public-document requests;
• maintenance of registers;
• preparation of annual reports;
• support for expert pools;
• coordination of enforcement initiatives;
• data protection compliance for the EDPB itself;
• support for the Coordinated Supervision Committee.

The EDPB’s tasks page states that the Board supports cooperation, adopts guidance and binding decisions and provides the Secretariat to the Coordinated Supervision Committee.

The supplied commentary’s description of Article 75(6) as an “exhaustive” list is therefore incorrect. The phrase “in particular” clearly indicates examples within a broader support mandate.

---

23. Article 75(6)(a): Day-to-day business

The first specific task is the Board’s day-to-day business.

This may include:

• incoming correspondence;
• case registration;
• deadline tracking;
• document filing;
• work-programme monitoring;
• internal coordination;
• publication updates;
• stakeholder requests;
• administrative follow-up;
• preparation of routine communications.

Illustration

A national authority submits an Article 64 draft decision. The Secretariat may:

1. register it;
2. assign an internal reference;
3. confirm receipt;
4. check whether essential documents are present;
5. alert the relevant team;
6. calculate the procedural timeline;
7. inform the Chair;
8. prepare circulation to members.

These activities may appear routine, but a mistake could have substantial consequences.

For example:

• failure to record the correct receipt date could disrupt deadlines;
• failure to circulate the document could prevent member participation;
• misclassification could direct the matter into the wrong legal procedure.

---

24. Day-to-day business and institutional discretion

Routine work does not necessarily mean mechanical work.

The Secretariat may need to decide preliminary administrative questions such as:

• which procedure appears relevant;
• whether a file is complete;
• which expert subgroup should review it;
• whether translation is needed;
• whether the matter is urgent.

Those assessments should be subject to:

• Chair supervision;
• Board procedures;
• correction by members;
• objective criteria.

[!example] Illustration A request is labelled “urgent,” but the file contains no explanation of immediate harm. The Secretariat may identify the deficiency and ask for supporting reasons. It cannot finally decide that Article 66 has no application if that determination belongs to the Board. It can perform the preliminary assessment needed to organise the procedure.

25. Article 75(6)(b): Communication among members, Chair and Commission

The Secretariat is responsible for communication between:

• EDPB members;
• the Chair;
• the Commission.

This may include:

• meeting notices;
• draft circulation;
• requests for comments;
• voting information;
• deadline reminders;
• institutional correspondence;
• adopted texts;
• Commission requests.

Illustration

The Commission asks the EDPB for advice on proposed AI legislation. The Secretariat may:

• register the request;
• inform the Chair;
• circulate it to members;
• identify the requested deadline;
• coordinate preparation;
• transmit the EDPB’s adopted response.

25.1 Communication is not control

The Secretariat may transmit Commission views. It must not treat those views as instructions.

The Commission participates in EDPB activity without voting rights. Article 69 prevents the Board from taking instructions from external actors.

[!example] Illustration The Commission sends comments supporting a particular interpretation. The Secretariat should circulate those comments accurately where relevant. It should not rewrite the EDPB draft to comply with the Commission’s preferences unless the Board independently agrees with the reasoning.

26. EEA/EFTA communications

The literal text mentions members, the Chair and the Commission. Under the EEA arrangements, communications may also involve:

• EEA/EFTA supervisory authorities;
• the EFTA Surveillance Authority where relevant.

This additional participation arises from the EEA legal framework, not from rewriting Article 75 itself.

The key practical requirement is that EEA participants receive the information necessary for effective participation in GDPR-related EDPB work, subject to their modified voting and office-holding rights.

---

27. Article 75(6)(c): Communication with other institutions and the public

The Secretariat manages communication with:

• EU institutions;
• national bodies;
• courts;
• international organisations;
• supervisory authorities;
• stakeholders;
• journalists;
• the general public.

Possible outputs include:

• press releases;
• website content;
• consultation notices;
• public statements;
• responses to institutional requests;
• annual-report communications;
• hearing arrangements.

Illustration

The EDPB adopts guidance on children’s data. The Secretariat may:

• publish the guidance;
• issue a news notice;
• make translations available;
• respond to press questions;
• direct members of the public to the consultation record.

27.1 Communication must reflect adopted positions

The Secretariat is not an independent spokesperson with power to create EDPB policy.

It must distinguish between:

• adopted EDPB positions;
• draft texts;
• pending matters;
• technical background;
• staff interpretation.

Illustration

A journalist asks whether a particular company has infringed the GDPR while an Article 65 procedure is pending. The Secretariat should not announce a conclusion before the Board decides and before the formal national process is completed. Premature statements could:

• prejudice the proceeding;
• harm rights of defence;
• create reputational damage;
• undermine confidentiality.

28. Article 75(6)(d): Electronic communication

The Secretariat is responsible for using electronic means for internal and external communication.

This includes systems supporting:

• one-stop-shop cooperation;
• Article 64 submissions;
• Article 65 dispute files;
• Article 66 urgent requests;
• document circulation;
• secure voting;
• communication among authorities;
• publication.

The Internal Market Information System is used extensively for GDPR regulatory cooperation, while Article 67 permits standardised electronic arrangements.

Illustration

A concerned authority submits a formal objection electronically. The system should establish:

• sender;
• recipient;
• date and time;
• legal procedure;
• version;
• attachments;
• acknowledgment. This matters because the objection may be subject to a four-week deadline and may later trigger Article 65.

28.1 Security requirements

The system may contain:

• sensitive personal data;
• confidential complaints;
• evidence;
• commercial secrets;
• security vulnerabilities;
• draft fines;
• internal deliberations.

Electronic communication therefore requires:

• strong authentication;
• encryption;
• role-based access;
• audit logs;
• secure storage;
• incident response;
• reliable backup;
• version control.

A Secretariat supporting data protection enforcement must itself follow strong data protection and security practices.

---

29. System outages and urgent procedures

The Secretariat should maintain contingency processes for:

• system outages;
• cyber incidents;
• corrupted files;
• failed delivery;
• urgent deadlines.

Illustration

An Article 66 urgent filing must be submitted, but the normal electronic system is unavailable. The Secretariat may need to support:

• a secure alternative channel;
• immediate confirmation;
• later formal registration;
• preservation of the original timestamp;
• reconciliation of file versions. An ordinary unsecured email should not become the default simply because it is convenient. Emergency channels should be controlled and documented.

---

30. Article 75(6)(e): Translation

The EDPB operates across a multilingual legal area.

The Secretariat must translate relevant information where necessary.

Material may include:

• complaints;
• draft decisions;
• objections;
• national legal provisions;
• technical reports;
• submissions;
• opinions;
• binding decisions;
• guidance;
• summaries.

Illustration

A concerned authority submits an Article 65 objection in Spanish. The lead authority works in English, while other members require a common working version. The Secretariat may need to translate:

• the objection;
• relevant evidence;
• the lead authority’s response;
• operative parts of the draft decision.

30.1 Not every document requires complete translation into every language

Translation should be proportionate.

Relevant considerations include:

• legal importance;
• volume;
• urgency;
• affected audience;
• working language;
• publication obligations;
• need for precise legal review.

Illustration

A 2,000-page technical annex contains only twenty pages relevant to the dispute. It may be sufficient to translate:

• the twenty relevant pages;
• an accurate summary of the rest;
• key technical terminology. However, reliance on untranslated material that members or affected parties cannot understand may undermine:
• deliberation;
• fairness;
• judicial review.

---

31. Translation errors

A mistranslation can materially change the legal meaning.

Examples

include confusion between:

• “shall” and “may”;
• “controller” and “processor”;
• “anonymous” and “pseudonymous”;
• “restriction” and “prohibition”;
• “likely” and “possible.”

Illustration

A translated objection says that an authority “may” impose a ban, while the original says it “must” impose a ban. That difference could affect the EDPB’s understanding of the dispute. The Secretariat should use:

• qualified legal translators;
• terminology databases;
• expert verification;
• correction procedures;
• access to original texts. Translation supports communication, but the original text may remain important where interpretation is disputed.

---

32. Article 75(6)(f): Preparation and follow-up of meetings

Before a meeting, Secretariat work may include:

• scheduling;
• document circulation;
• agenda preparation;
• invitations;
• confirmation of representatives;
• voting-entitlement checks;
• interpretation;
• room or video arrangements;
• technical support;
• confidentiality classification.

During the meeting, it may include:

• attendance records;
• minutes;
• document display;
• amendment tracking;
• voting support;
• technical assistance.

After the meeting, it may include:

• minutes;
• revised drafts;
• action lists;
• deadline monitoring;
• notification;
• publication;
• archival work.

Illustration

The Board adopts an Article 64 opinion subject to three amendments. The Secretariat must ensure that:

1. the amendments are incorporated accurately;
2. the correct version is approved;
3. translations are updated;
4. the opinion is transmitted;
5. the final document is published;
6. the file is archived.

A failure during follow-up could result in publication of a version that the Board never adopted.

---

33. Minutes and records

Meeting documentation is vital for:

• proof of adoption;
• voting records;
• institutional memory;
• implementation;
• judicial review;
• accountability.

Minutes should accurately reflect:

• attendance;
• agenda;
• documents considered;
• decisions taken;
• voting outcomes;
• agreed follow-up.

They need not reproduce every confidential statement verbatim.

Illustration

A controller later argues that an Article 65 decision did not receive the required majority. The EDPB should possess reliable records showing:

• who was entitled to vote;
• who participated;
• how votes were counted;
• the result;
• final adopted text. Weak recordkeeping can threaten the defensibility of the decision.

---

34. Article 75(6)(g): Drafting EDPB outputs

Point (g) is among the Secretariat’s most important functions.

It prepares, drafts and publishes:

• Article 64 opinions;
• Article 65 decisions;
• Article 66 urgent decisions;
• guidelines;
• recommendations;
• best practices;
• statements;
• legislative advice;
• annual reports;
• other Board texts.

The official EDPB page confirms that the Secretariat prepares, drafts, translates and publishes opinions, binding decisions and other texts.

34.1 Preparation

Preparation may involve:

• collecting facts;
• identifying legal issues;
• examining submissions;
• researching case law;
• comparing national approaches;
• consulting expert groups;
• planning the document structure.

34.2 Drafting

Drafting converts the analysis into:

• factual background;
• competence assessment;
• legal reasoning;
• response to objections;
• operative conclusions;
• procedural instructions.

34.3 Publication

Publication may involve:

• final verification;
• redaction;
• translation;
• accessibility;
• metadata;
• website upload;
• register links;
• archival preservation.

---

35. Authority over the final text

The Secretariat may draft, but the EDPB adopts.

The final text must reflect the Board’s vote.

Illustration

The Board decides:

• Objection A qualifies and succeeds.
• Objection B does not qualify.
• The lead authority must reassess the fine. The Secretariat cannot publish a text stating that both objections succeed. Where the Board adopts amendments orally or during voting, careful version control is essential. Possible safeguards include:
• tracked amendments;
• final reading;
• formal confirmation;
• authoritative version designation;
• electronic integrity checks.

---

36. Redaction before publication

Many EDPB decisions contain confidential information.

Before publication, the Secretariat may need to redact:

• personal data;
• complainant identities;
• protected business information;
• security details;
• privileged material;
• confidential internal communication.

Illustration

An Article 65 decision contains an annex describing an exploitable security vulnerability. Publishing the full technical detail could create further risk. The public version may explain the legal issue while redacting the exploit mechanism. Redaction must be balanced. Excessive redaction could make the decision:

• unintelligible;
• impossible to scrutinise;
• useless for future guidance;
• unfair to affected parties. The ideal public version contains enough information to explain:
• the facts;
• legal reasoning;
• decision;
• implications.

---

37. The Secretariat and litigation

Article 75(6) does not expressly list litigation, but “in particular” leaves room for related support.

The Secretariat may assist with:

• actions challenging Article 65 decisions;
• court pleadings;
• document preparation;
• legal research;
• coordination with external counsel;
• case-file management;
• implementation of judgments.

The official Secretariat structure includes a Litigation and International Affairs Sector.

Illustration

A controller challenges an EDPB binding decision before the EU Courts. Secretariat staff may:

• reconstruct the administrative record;
• explain the procedural history;
• help prepare the defence;
• identify confidential material;
• ensure compliance with court deadlines. The Secretariat supports the EDPB as a litigant. The EU Courts determine the legality of the challenged decision.

---

38. The Secretariat’s own data protection obligations

The Secretariat itself processes personal data concerning:

• complainants;
• controllers’ employees;
• supervisory authority personnel;
• stakeholders;
• consultation respondents;
• experts;
• visitors;
• staff.

Because the EDPB is an EU body, its own processing is governed principally by Regulation 2018/1725 rather than by the GDPR in the same manner as an ordinary private controller.

Relevant obligations include:

• lawful processing;
• transparency;
• security;
• data minimisation;
• retention;
• rights handling;
• breach response;
• accountability.

Illustration

The EDPB conducts a public consultation and publishes stakeholder submissions. The Secretariat should provide information about:

• the purpose of collection;
• publication;
• retention;
• contact details;
• rights;
• legal basis. The fact that the consultation supports a public regulatory task does not eliminate the EDPB’s own data protection obligations.

---

39. The Secretariat’s accountability

Secretariat staff may not have formal votes, but their work can affect:

• how disputes are framed;
• which evidence is summarised;
• whether deadlines are met;
• what gets published;
• how stakeholders understand decisions.

Accountability mechanisms may include:

• Chair supervision;
• Board review;
• Rules of Procedure;
• internal controls;
• version management;
• audit;
• judicial review of final acts;
• document-access procedures;
• professional ethics;
• data protection oversight.

[!example] Illustration A Secretariat draft omits an affected party’s central legal argument. Board members should be able to identify and correct the omission before adoption. If the omission survives into an adopted binding decision and affects the right to be heard, the decision could face judicial challenge. The Secretariat’s lack of formal decision-making power does not make the quality of its work legally irrelevant.

40. A complete practical example

Assume the EDPB receives an Article 65 dispute concerning a Europe-wide social-media platform.

The dispute involves:

• lawful basis;
• sensitive-data inferences;
• children’s profiling;
• erasure;
• administrative fines.

Stage 1: Registration

The Secretariat:

• records the referral;
• assigns a case number;
• identifies the relevant authorities;
• confirms receipt;
• checks the file.

Stage 2: Completeness review

It examines whether the file contains:

• draft decision;
• relevant and reasoned objections;
• lead authority’s response;
• evidence;
• controller submissions;
• hearing materials.

Missing information is identified promptly.

Stage 3: Analytical preparation

Secretariat lawyers:

• map each objection;
• assess the Article 4(24) threshold;
• identify relevant CJEU judgments;
• prepare an initial legal analysis;
• coordinate with expert subgroups.

Stage 4: Procedural fairness

The Secretariat helps ensure that the controller receives a reasonable opportunity to respond to issues that may adversely affect it.

Stage 5: Draft decision

A draft Article 65 decision is prepared under the Chair’s instructions and member guidance.

Stage 6: Meeting

The Secretariat:

• circulates the agenda;
• distributes documents;
• organises translation;
• supports deliberation;
• records attendance and voting.

Stage 7: Board adoption

The EDPB members amend and adopt the decision.

The Secretariat itself does not vote.

Stage 8: Finalisation

The Secretariat incorporates adopted amendments and verifies:

• operative part;
• reasons;
• voting record;
• annexes;
• references.

Stage 9: Notification

The Chair formally notifies the supervisory authorities, supported by the Secretariat.

Stage 10: Publication and litigation

After the national final decision is notified, the Secretariat prepares the public version, performs necessary redactions and publishes it.

If the decision is challenged, the Secretariat supports the EDPB’s litigation response.

This example shows why Article 75 includes analytical, administrative and logistical support. All three are necessary for a lawful European decision.

---

41. Corrections and qualifications to the supplied commentary

Several points in the supplied commentary require refinement.

41.1 The Secretariat’s functions are not mainly administrative

Article 75(5) expressly includes analytical support, and paragraph 6(g) assigns preparation and drafting of opinions and binding decisions.

41.2 The tasks in paragraph 6 are not exhaustive

The phrase“in particular” means that the list gives important examples rather than a closed catalogue.

41.3 The EDPS does not lose every form of authority over employees

The EDPS remains the employing institution for administrative and employment matters. What it lacks is substantive instruction authority over EDPB tasks.

41.4 Staff are not necessarily “seconded” in the technical legal sense

They are provided through the EDPS and operate under separate EDPB reporting lines.

41.5 Separate reporting lines do not automatically create total institutional separation

Their effectiveness depends on:

• access controls;
• performance management;
• budget arrangements;
• information barriers;
• actual practice.

41.6 Commission v Austria is relevant by analogy

The judgment concerned a national authority under the predecessor Directive, not the Article 75 EDPB-EDPS arrangement itself.

41.7 Communication with the public is not inherently analytical

It may involve administrative and strategic elements. The categories in paragraph 5 overlap and should not be treated as rigid boxes.

41.8 The MoU cannot override the GDPR

It operationalises cooperation but cannot alter:

• EDPB independence;
• Chair authority;
• Board voting;
• EDPS statutory powers;
• rights of affected persons.

---

Conclusion

Article 75 supplies the EDPB with the permanent professional support required to function as a genuine European regulatory body. The provision creates a carefully balanced arrangement:

• the EDPS provides the staff and administrative platform;
• the EDPB remains legally and functionally separate;
• the Chair exclusively directs Secretariat work relating to EDPB tasks;
• separate reporting lines protect against EDPS control over EDPB work;
• a published Memorandum of Understanding regulates practical cooperation;
• the Secretariat supplies analytical, administrative and logistical support. Its work includes:
• daily case administration;
• regulatory communication;
• secure electronic systems;
• translation;
• meeting organisation;
• legal analysis;
• drafting;
• publication;
• litigation support;
• institutional recordkeeping. The Secretariat is more than a clerical office. It is an influential professional support body whose staff may shape the first drafts of important European guidance and binding decisions. However, it is not itself the EDPB’s decision-maker. The institutional division is: The EDPS supplies the Secretariat. The Chair directs it for EDPB work. The Secretariat prepares and supports. The Board deliberates, amends, votes and adopts.

The arrangement inevitably creates some practical dependence on the EDPS for staffing, finance and administration. Article 75 does not pretend otherwise. Instead, it manages that dependence through functional separation, exclusive Chair instructions, separate reporting lines, publication of the MoU and collective Board control over final outcomes.

In the simplest terms:

The Secretariat keeps the EDPB running, but it must do so for the EDPB, under the Chair, and independently from the EDPS’s separate supervisory agenda.