European cooperation

The Office of the Data Protection Ombudsman is an active member of the European Data Protection Board (EDPB). The EDPB promotes cooperation between European data protection authorities and the consistent application of data protection legislation across the EU. Together, the data protection authorities supervise the processing of individuals’ personal data that occurs in two or more European countries.

The European Data Protection Board (EDPB) is an independent EU body that comprises the national data protection authorities of all EU and EEA countries as well as the representatives of the European Data Protection Supervisor (EDPS). Finland’s Data Protection Ombudsman Anu Talus serves as the Chair of the EDPB between 2023 and 2028.

The task of the EDPB is to ensure that data protection legislation is applied and interpreted consistently in all EU countries. For this purpose, the EDPB’s tasks include the following:

issuing guidelines and recommendations that clarify data protection legislation
issuing statements and decisions that are binding on all national data protection authorities
creating templates, checklists and other material to support organisations
promoting information exchange between data protection authorities.

Website of the European Data Protection Board (edpb.europa.eu)

Guidance of the European Data Protection Board (edpb.europa.eu)

Data protection authorities supervise personal data processing together

Data protection authorities collaborate to supervise organisations that operate in two or more EU or EEA countries. The country in which the organisation’s principal place of business is located has the primary responsibility over the supervision. This authority is called the lead supervisory authority.

The lead supervisory authority closely collaborates with the data protection authorities of the countries whose residents the cross-border processing pertains to or in which the processing organisation is established. The joint decision making ensures that EU’s data protection legislation is applied to organisations of all sizes.

One-Stop-Shop

Data protection authorities use a ‘One-Stop-Shop’ mechanism. The mechanism enables individuals to lodge a complaint about an international organisation to the data protection authority of their country, which in Finland is the Office of the Data Protection Ombudsman.

Organisations also need to contact only one data protection authority, which is usually the authority of the country in which the organisation’s principal place of business in the EU is located.

Every year, the Office of the Data Protection Ombudsman contributes to the handling of around one thousand cases of cross-border processing.

More information to organisations about personal data processing involving several EU countries

When the Office of the Data Protection Ombudsman is contacted, it determines which national data protection authority should be the lead authority. If necessary, the case is referred to the correct national authority.
If the organisation’s principal place of business is in another EU Member State, the national authority of that country has the main responsibility for handling the case. The Office of the Data Protection Ombudsman contributes to the decision making with the other related data protection authorities. The Office of the Data Protection Ombudsman ensures that the rights of Finnish data subjects are respected and can affect decision making when necessary.
If an organisation operates in several EU countries and its principal place of business is in Finland, the Office of the Data Protection Ombudsman is the lead authority in the case. The national data protection authorities of other countries contribute to the decision making.
If the organisation does not have a place of business within the EU or the EEA, each national data protection authority is responsible for supervising the organisation’s data processing in their country. EU Member States may still cooperate in this case too.

European Data Protection Board ensures consistency

Dispute resolution

The goal of data protection authorities is to reach a consensus on the resolution of a case. If they cannot agree on a resolution, the EDPB resolves the matter through a consistency mechanism. This ensures that data protection is interpreted uniformly.

The EDPB issues a decision to settle the dispute and the decision is binding on all data protection authorities. The lead data protection authority must issue the final decision in the case in accordance with the EDPB’s decision.

Urgent measures

In special cases, the Office of the Data Protection Ombudsman can rapidly intervene with the activities of a business established in another country if the privacy and rights of Finnish data subjects are compromised. In this case, among other measures, the Office of the Data Protection Ombudsman can order the business to stop data processing in Finland for a fixed period. Urgent measures can be enforced for up to three months at a time.

The national data protection authority can request that the measures are extended to apply across the EU. In this case, the authority can request the lead data protection authority or the EDPB to issue a decision that permanently forbids certain activities in all Member States.

Website of the European Data Protection Supervisor (EDPS)