• Legal basis

The legal basis for the proposal is Article 16 of the Treaty on the Functioning of the European Union (TFEU).

Article 16 TFEU empowers the European Parliament and the Council to lay down rules regarding the protection of individuals with regard to the processing of personal data and the free movement of such data. The proposal concerns the enforcement of the GDPR in cross-border cases. The objective of such enforcement is to ensure the right of data subjects to protection of their personal data. As such, Article 16 TFEU is the appropriate legal basis for the proposal.

• Subsidiarity (for non-exclusive competence)

The EU is best placed to act because the proposal relates to an existing procedure established by the GDPR that involves the DPAs of several EU Member States and the European Data Protection Board (an EU body) . Accordingly, the problems identified above cannot be solved by EU Member States acting alone.

• Proportionality

This proposal ensures an appropriate balance between meeting the objective of ensuring the smooth functioning of cross-border enforcement of the GDPR while not unduly interfering with national legal systems.

The proposal aims to ensure the smooth functioning of the cooperation and dispute resolution mechanism established by the GDPR. Accordingly, the proposal concerns only cross-border cases under the GDPR. Such cases involve DPAs of several EU Member States and the Board.