July 25, 2022
Following publication of its Statement on Enforcement Cooperation in April 2022, the EDPB has now adopted a set of criteria to assess whether a cross-border case will qualify as a case of “strategic importance” for closer cooperation. The EDPB has also adopted details of the steps to be taken following identification of a strategic case. In addition, the EDPB has chosen the first pilot cases to test the project.
Cases of strategic importance are primarily “one-stop-shop” cases that are likely to be high risk to the rights and freedoms of data subjects in several EEA Member States. In order to identify a case of strategic importance, one or more of the following criteria should be considered:
- whether there is a structural or recurring problem in several Member States, in particular where the case concerns a general legal issue with regards to the interpretation, application or enforcement of the GDPR;
- whether the case overlaps with other areas of law;
- whether the case affects a large number of data subjects in several Member States;
- whether the case involves a large number of complaints in several Member States;
- whether the case concerns a fundamental issue falling within the scope of the EDPB strategy; and
- whether it is a case where the GDPR implies that a high risk can be assumed, such as the processing of special categories of data, the processing of data of vulnerable people such as minors and situations where a data protection impact assessment is required.
Within the framework of the EDPB, Supervisory Authorities (SAs) can propose any case that meets at least one of the criteria to other SAs. Members of the EDPB will then decide which of the proposed cases will be identified as a case of strategic importance at European level. Following identification, cooperation will be prioritised and supported by the EDPB. Participation is voluntary and all SAs are allowed to submit proposals. SAs will exchange information and cooperate closely at an early stage. Cases of strategic importance will be handled in accordance with Chapter VII of the GDPR.
In line with the criteria outlined above, the EDPB agreed on three pilot cases to kick-start the project. To read the EDPB’s news release in full, click here.