Commission Implementing Decision (EU) 2018/743 of 16 May 2018 on a pilot project to implement the administrative cooperation provisions set out in Regulation (EU) 2016/679 of the European Parliament and of the Council by means of the Internal Market Information System (Text with EEA relevance. )
Data as of 2026-07-04 · Compiled from an official source version. Later amendments or repeals may not be reflected; the official text prevails. · Read the official text ↗
The pilot project
Articles 56, 60 to 66 and points (d) to (k), (m) and (x) of Article 70(1) of Regulation (EU) 2016/679 shall be subject to a pilot project to implement the administrative cooperation provisions set out in those Articles by means of the Internal Market Information System (‘IMI’).
Competent authorities
For the purposes of the pilot project, the supervisory authorities referred to in Article 51 of Regulation (EU) 2016/679 and the European Data Protection Board referred to in Article 68 of Regulation (EU) 2016/679 (‘the Board’) shall be considered as competent authorities.
Administrative cooperation between supervisory authorities
1. For the purposes of Article 56 of Regulation (EU) 2016/679, IMI shall, in particular, provide for the following basic technical functionality: (a) initiation of a consultation to determine the lead supervisory authority and any other supervisory authorities concerned for a given cross-border processing; (b) communication of an intention to participate in a consultation under point (a); (c) communication of an intention to handle a case locally; (d) communication of the lead authority's intention to handle or not to handle the case. 2. For the purposes of Article 60 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality: (a) communication and initiation of a consultation on a draft decision; (b) communication and initiation of a consultation on a revised draft decision; (c) communication of an intention to participate in the consultation under point (a) and (b), including communication of relevant and reasoned objections; (d) communication of an adopted decision. 3. For the purposes of Article 61 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality: (a) requesting mutual assistance from another supervisory authority in the form of information and/or supervisory measures; (b) responding to a mutual assistance request including acceptance or in exceptional cases refusals to comply with the request; (c) communication of the progress and the result of measures taken in order to respond to the request; (d) communication of any cost considerations. 4. For the purposes of Article 62 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality: (a) invitation to take part in the joint operations including joint investigations and joint enforcement measures. (b) communication of a request to participate or not in a joint operation (c) communication of the agreement to conduct a joint operation.
Administrative cooperation between supervisory authorities, the Board and the Commission
1. For the purposes of Article 64 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality: (a) submitting a request for an opinion of the Board on the following: (i) a draft decision of the competent supervisory authority concerning any of the measures listed in Article 64(1); (ii) a matter of general application; (iii) matter producing effects in more than one Member State; (b) communicating a draft opinion of the Board; (c) communication concerning the request and in particular the draft opinion of the Board; (d) communicating a final opinion issued by the Board; (e) communicating an intention to follow or not the opinion of the Board and where relevant to amend the draft decision and communicate the amended draft decision. 2. For the purposes of Article 65 of Regulation (EU) 2016/679, IMI shall provide for, in particular, the following basic technical functionality: (a) submitting a request for a binding decision of the Board where: (i) a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead authority and the lead authority has rejected such a relevant and reasoned objection as being not relevant or reasoned in accordance with Article 60(4) of Regulation (EU) 2016/679; (ii) there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment; (iii) a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64 (1) of Regulation (EU) 2016/679; (iv) a competent supervisory authority does not follow an opinion of the Board issued under Article 64 of Regulation (EU) 2016/679; (b) communicating the draft of a binding decision of the Board; (c) communication on the request and in particular the binding decision of the Board; (d) communicating the binding decision adopted by the Board; (e) communicating that a supervisory authority has notified respectively to the controller or the processor and to the data subject the final decision and the date of the notification. 3. For the purposes of Article 66 of Regulation (EU) 2016/679, IMI shall, in particular, provide for the following basic technical functionality: (a) communication of provisional measures and the reasons for adopting them; (b) submitting a request for an urgent opinion or an urgent decision of the Board; (c) communicating a draft opinion or a draft decision of the Board; (d) communication concerning the request and in particular the draft opinion or draft decision of the Board; (e) communicating the Board's final opinion or final decision; (f) communicating an intention to follow or not the opinion of the Board and where relevant to amend the draft decision; (g) communicating that a supervisory authority has notified the parties concerned of the decision.
Storage and reuse of data for subsequent processing
IMI shall provide for storage of data processed during information exchanges under Articles 56, 60 to 66 of Regulation (EU) 2016/679. Where such data is necessary for subsequent processing under those Articles, IMI shall allow for the reuse of stored data.
Ensuring consistent application of Regulation (EU) 2016/679
IMI shall provide for functionality that allows the Board to share documents and information as referred to in points (d) to (k), (m) and (x) of Article 70 (1) of Regulation (EU) 2016/679.
Evaluation
An evaluation of the outcome of the pilot project referred to in Article 4(2) of Regulation (EU) No 1024/2012 shall be submitted to the European Parliament and the Council by 31 December 2021.
Entry into force and application
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union . It shall apply from 25 May 2018.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.