Source: OJ L 119, 4.5.2016, pp. 1–88 · Consolidated textCurrent language: EN
- General data protection
Basic legislative acts
- GDPR regulation
Article 66 Urgency procedure
Summary What does Article 66 of the GDPR regulation say?
This article establishes an urgency procedure that operates as an explicit exception to the standard consistency mechanism set out in Articles 63, 64, and 65, as well as the cooperation procedure in Article 60.
It allows supervisory authorities to bypass the usual coordinated process when there is an urgent need to protect the rights and freedoms of data subjects, enabling faster unilateral action and accelerated Board decision-making.
Important points:
- Supervisory authorities may immediately adopt provisional measures on their own territory in exceptional circumstances, valid for no more than three months, and must notify the other supervisory authorities concerned, the Board, and the Commission without delay.
- Either the supervisory authority that has already taken provisional measures, or any other supervisory authority where a competent authority has failed to act, may request an urgent opinion or binding decision from the Board.
- The Board is required to adopt such urgent opinions or binding decisions within two weeks by simple majority, compared to the longer timelines that apply under the standard procedure.
Springlex's summary of the article is a reading aid, not a substitute for the legal text.
In exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to act in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency mechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt provisional measures intended to produce legal effects on its own territory with a specified period of validity which shall not exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons for adopting them to the other supervisory authorities concerned, to the Board and to the Commission.
Where a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures need urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving reasons for requesting such opinion or decision.
Any supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such opinion or decision, including for the urgent need to act.
By derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in paragraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board.
Relevant recitals
Recital 137 Urgent provisional measures, time-limited
There may be an urgent need to act in order to protect the rights and freedoms of data subjects, in particular when the danger exists that the enforcement of a right of a data subject could be considerably impeded. A supervisory authority should therefore be able to adopt duly justified provisional measures on its territory with a specified period of validity which should not exceed three months.
Springlex and this text is meant purely as a documentation tool and has no legal effect. No liability is assumed for its content. The authentic version of this act is the one published in the Official Journal of the European Union.
Definition
supervisory authority concerned
- the controller or processor is established on the territory of the Member State of that supervisory authority;
- data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be substantially affected by the processing; or
- a complaint has been lodged with that supervisory authority;
Definition
processing
Definition
controller
Definition
processor
Definition
supervisory authority
Definition
personal data