Overview

This article establishes the decision-making and procedural rules for the European Data Protection Board (EDPB). The Board adopts decisions by simple majority, unless otherwise specified in the Regulation. It establishes its own rules of procedure and operational arrangements by a two-thirds majority to ensure effective governance and operations.

Key Principles

  • Decision-Making: Standard decisions are adopted by simple majority, providing efficiency in governance.

  • Procedural Autonomy: The Board defines its own procedural rules and operational arrangements.

  • Qualified Majority: Rules of procedure and operational arrangements require a two-thirds majority.

  • Consistency and Accountability: Procedures ensure decisions are consistent, transparent, and properly documented.

Organizational Applicability

This article applies to:

  • The European Data Protection Board and its members.

  • Teams responsible for implementing EDPB procedures, governance, and decision-making.

  • Supervisory authorities coordinating with the Board for cross-border matters.

Implementation Requirements

  • Adopt Board decisions using simple majority unless otherwise specified by GDPR.

  • Establish and approve rules of procedure and operational arrangements by a two-thirds majority.

  • Document procedures, decision-making processes, and operational rules for accountability.

  • Ensure staff are aware of procedural and operational governance structures.

Implementation Guidance

  • Maintain a clear procedural framework for Board meetings and decision-making.

  • Train staff and members on voting requirements, majority rules, and operational arrangements.

  • Review and update rules of procedure as needed to reflect changes in GDPR or Board structure.

  • Record all decisions, votes, and procedural changes for transparency and compliance.

Periodic Review

  • Frequency: Annually or when procedural rules or operational arrangements are revised.

  • Responsible Role: EDPB Chair, Board Secretariat, Compliance Teams.

  • Outcome: Ensure decision-making and operational procedures remain effective, transparent, and compliant with GDPR.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover for supervised entities.

  • Legal Exposure: Challenges to Board decisions if procedural rules are not properly followed.

  • Reputational Damage: Loss of trust due to inconsistent or unclear Board governance.

  • Operational Risk: Ineffective procedures may impede timely decisions and cross-border coordination.