A city solicitor asks which body is the EU’s primary legislature that co-decides regulations such as the GDPR under the ordinary legislative procedure. Which answer is best?
Select an answer to reveal the explanation.
Short Explanation
When the EU passes a big regulation, Parliament is not a spectator — it co-decides with the Council in the ordinary legislative procedure. Picture two chambers agreeing on the final text, not a single agency waving a wand. That is how instruments like the GDPR become law.
Full Explanation
In the ordinary legislative procedure, the European Parliament acting with the Council of the European Union plays a central legislative role in adopting EU data-protection law such as the GDPR. City solicitors should treat Parliament as a democratic co-legislator paired with the Council of the EU, not as a decorative afterthought beside supervisory forums. Binding regulations emerge from that legislative pathway following a Commission proposal, which is why municipal counsel cites the GDPR as Union law rather than as board guidance. The EDPB does not alone adopt EU regulations without Member State input; it coordinates supervisory consistency among authorities. Pearson VUE exam boards do not enact EU law and have no legislative competence in the Union legal order. The OECD Privacy Working Party is an influential soft-law forum, not the EU’s co-legislator for the GDPR. Confusing legislative adoption with soft-law committees or exam vendors collapses the hierarchy candidates must keep straight for CIPP/E institutional questions. Exam caveat: when asked who makes binding EU data-protection law, point to Parliament and the Council of the EU as co-legislators—not to the EDPB, EDPS, OECD, or testing companies. Operational check: label civic briefing slides legislation (Parliament + Council of the EU) versus supervision (SAs + EDPB) so political stakeholders stop asking the EDPB to pass a new regulation when they actually need a Commission proposal pathway.