European Data Protection Board adopted a set of criteria to assess whether a cross-border case may qualify as a case of “strategic importance” for closer cooperation. The Board also adopted a procedure detailing the steps to be taken following identification of a strategic case. In addition, the EDPB selected the very first pilot cases to test this project.
Cases of strategic importance are mainly one-stop-shop cases which are likely to entail a high risk to the rights and freedoms of data subjects in several European Economic Area (EEA) Member States. In order to identify a case of strategic importance, one or more of the following criteria is to be taken into account:
- a structural or recurring problem in several Member States, in particular where the case concerns a general legal issue with regards to the interpretation, application or enforcement of GDPR;
- a case related to the intersection of data protection and other legal fields;
- a case which affects a large number of data subjects in several Member States;
- a case involving a large number of complaints in several Member States;
- a case concerning a fundamental issue falling within the scope of the EDPB strategy;
- a case where the GDPR implies that a high risk can be assumed, such as:
- the processing of special categories of data;
- processing regarding vulnerable people such as minors;
- situations where a Data Protection Impact Assessment (DPIA) is required.
Within the framework of the EDPB, Supervisory Authorities (‘SAs’) can propose any case that meets at least one of the criteria to other SAs. The Board Members will then decide which of the proposed cases will be identified as a case of strategic importance at European level.
After identification, cooperation will be prioritised and supported by the EDPB. Participation is voluntary and all SAs are allowed to submit proposals. In particular, SAs will exchange information and cooperate closely at an early stage. The handling of cases of strategic importance will also take place in accordance with the procedures and instruments for achieving cooperation and consistency between SAs, as laid down in Chapter VII of the GDPR. In line with the criteria outlined above, the EDPB agreed on three pilot cases to kick-start the project.