DPAs may run joint investigations and enforcement operations, including in each other's territories, with staff from several authorities taking part.
Official text & source
Article 62 of the General Data Protection Regulation (Regulation (EU) 2016/679). Read the full, authoritative text on EUR-Lex.
Official text
Verbatim text of Article 62 of the General Data Protection Regulation — Regulation (EU) 2016/679.
The supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and joint enforcement measures in which members or staff of the supervisory authorities of other Member States are involved.
1 Where the controller or processor has establishments in several Member States or where a significant number of data subjects in more than one Member State are likely to be substantially affected by processing operations, a supervisory authority of each of those Member States shall have the right to participate in joint operations. 2 The supervisory authority which is competent pursuant to Article 56 (1) or (4) shall invite the supervisory authority of each of those Member States to take part in the joint operations and shall respond without delay to the request of a supervisory authority to participate.
1 A supervisory authority may, in accordance with Member State law, and with the seconding supervisory authority's authorisation, confer powers, including investigative powers on the seconding supervisory authority's members or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory authority permits, allow the seconding supervisory authority's members or staff to exercise their investigative powers in accordance with the law of the Member State of the seconding supervisory authority. 2 Such investigative powers may be exercised only under the guidance and in the presence of members or staff of the host supervisory authority. 3 The seconding supervisory authority's members or staff shall be subject to the Member State law of the host supervisory authority.
Where, in accordance with paragraph 1, staff of a seconding supervisory authority operate in another Member State, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability, for any damage caused by them during their operations, in accordance with the law of the Member State in whose territory they are operating.
1 The Member State in whose territory the damage was caused shall make good such damage under the conditions applicable to damage caused by its own staff. 2 The Member State of the seconding supervisory authority whose staff has caused damage to any person in the territory of another Member State shall reimburse that other Member State in full any sums it has paid to the persons entitled on their behalf.
Without prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each Member State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another Member State in relation to damage referred to in paragraph 4.
1 Where a joint operation is intended and a supervisory authority does not, within one month, comply with the obligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt a provisional measure on the territory of its Member State in accordance with Article 55 . 2 In that case, the urgent need to act under Article 66 (1) shall be presumed to be met and require an opinion or an urgent binding decision from the Board pursuant to Article 66 (2).
Source: Regulation (EU) 2016/679 (OJ L 119, 4.5.2016, p. 1). Official text reproduced from EUR-Lex — © European Union. Only European Union legislation published in the Official Journal is deemed authentic.
Related articles
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
Need to apply Article 62?
Our data-protection lawyers turn the text into a plan.