In the past years we have identified more than 60 procedural issues that we have experienced first-hand in daily operations. We have summarized them on the page below. Many of these issues are symptoms of an underlying procedural problem.

EDPB binding directions too broad or disregarded

Article(s) involved (national, EU, or other): Article 65.


When implementing the EDPB decision, SAs ‘must’ follow the binding directions of the EDPB. These binding directions, however, are often broadly formulated, leaving a lot of leeway to the SAs to deal with it as they wish. E.g., a higher fine, does not per se lead to a fine that is truly high enough.

The EDPB is, furthermore, not keeping an eye on the implementation of its decisions. All the SAs should do, is informing the Board about its final decision. If not followed, there is no tool in the GDPR that allows the EDPB to act (only possibilities are Commission infringement procedure, or CJEU). 

Ideal Solution

EDPB should formulate its decisions in a way that leaves less discretion to the national SAs. EDPB should be able to step in when its decisions are not followed. Inspiration can be found within the SRB’s regulation: if SRB’s decision is not correctly implemented by the national authorities, the SRB can take over and directly address its decision towards the institution under resolution, see SRMR, Articles 18(9), 29(1), 28(1), 29(2). 

Proposed Solution

Concepts 8 and 11 should limit this problem.

Reference to EDPB documents/table:

See EDPB’s first two binding decisions. More potential in its fourth decision where fine ranges where clarified.

National Issues

National Issues