What changed

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board.

(2) In an effort of modernizing EU data protection rules, inter alia, by streamlining them with the European data strategy, and in order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

Or. en

Amendment 2

Amendment

(2 a) This Regulation and Chapter VII ofIn Regulationline (EU)with 2016/679the onlyprinciple governon certainthe elementsprimacy of the cooperation procedure,Union whenlaw, supervisory authorities ofshould morenot thanapply onenational Memberprocedural Statelaw participatewhere it is in theconflict procedure.with Thisthis Regulation doesand notRegulation apply(EU) when2016/679. aCooperation partyamong lodgessupervisory aauthorities complaintshould directlynot withbe aaffected leaddue supervisoryto authoritydifferences in anothernational Memberprocedural State.law.

Or. en

Justification

Certain matters are not harmonised and national procedural rules still apply.

Amendment 3

Proposal for a regulation

Recital 2 b (new)

Text proposed by the Commission

Amendment

(2 b) Supervisory authorities shall make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video conference, or generally available electronic means of communication.

Amendment 4

Proposal for a regulation

Recital 2 c (new)

Text proposed by the Commission

Amendment

(2 c) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law.

Amendment 5

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities be created so as to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Amendment 6

Proposal for a regulation

Recital 4

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post. The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679. No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible.

(4) In order to be admissible a complaint should contain certain specified information about the alleged violation, whether ongoing or past.information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a model complaint form should be provided. Where a complaint does not meet the minimum requirements, the supervisory authority should require the complainant to resubmit a complete complaint within a reasonable period of time. No additional information should be required for a complaint to be deemed admissible. The complaint may be submitted in written, electronically or by post. In particular, complainants should not be required to use a national electronic ID or e-government system to submit the complaint. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

Amendment 7

Or. en

Justification

The form should not be mandatory but only attached as a model, as many complainants will initially not know if a case is a cross-border one. Further, no burdensome transmission steps should be required, such as the use of a particular national e-government system.

Amendment 4

Proposal for a regulation

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case.

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case, including judicial remedies under Article 78 of Regulation (EU) 2016/679. This Regulation foresees specific deadlines to provide for a foreseeable procedure in line with the requirement of legal certainty as a part of the right to good administration enshrined in Article 41 of the EU Charter, and Article 6 ECHR. Procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations for delays or disruptions that are outside of the control of the lead supervisory authority.case. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

Amendment 8

Or. en

Amendment 5

Proposal for a regulation

Amendment

(5 a) The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

(5 a) This Regulation foresees specific deadlines to provide for a foreseeable procedure in line with the requirement of legal certainty as a part of the right to good administration enshrined in Article 41 of the EU Charter.

Amendment 9

Or. en

Proposal for a regulation

Amendment 6

Recital 5 b (new)

Text proposed by the Commission

Amendment

(5b) Article 6 of the ECHR and Article 47 of the Charter require that fair procedures are public. Article 42 of the Charter and the law of many Member States foresee the right of access to public documents and the transparency of actions of authorities. However, it should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/943. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why.

Amendment 10

Proposal for a regulation

Recital 5 c (new)

Text proposed by the Commission

Amendment

(5c) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities.

Amendment 11

Proposal for a regulation

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate, as well as effective and dissuasive,proportionate in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective and quick remedy to the complainant can be quickly delivered. Planning the procedure is important to ensure a quick result.complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the reason for the complaint. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision that can be submitted to judicial review.

Amendment 12

Or. en

Justification

There can be no unlimited discretion of supervisory authorities in view of possible action. Further, the use of a judicial remedy should not be an element of consideration as it is a fundamental right of the data subject.

Amendment 7

Proposal for a regulation

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant.

(7) The lead supervisory authority should regularly provide the supervisory authority with which the complaint was lodged with all the necessary information on the progress of the investigation without undue delay and for the purpose of providing updates to the complainant. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

Amendment 13

Or. en

Amendment 8

Proposal for a regulation

(8) The competent supervisory authority should provide the parties with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Amendment 14

Or. en

Amendment 9

Proposal for a regulation

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should endeavour, where appropriate, to resolve complaints by amicable settlement. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Settlements should be of a voluntary nature, and should be able to take the form of a contract between the parties.nature. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be misused to defer decisions on complaints.

Amendment 15

Or. en

Proposal for a regulation

Amendment 10

Recital 9 a (new)

Text proposed by the Commission

Amendment

(9a) The supervisory authority is not bound by the amicable settlement. It should in particular open an ex officio investigation instead, where the party under investigation is a repeat offender, the party under investigation has been the subject of a large number of other amicable settlements, the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, the consequence of the processing which has been subject to the complaint is of long duration or serious nature.

Amendment 16

Proposal for a regulation

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case as early as possible and at least prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

Amendment 17

Or. en

Amendment 11

Proposal for a regulation

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. To ensure that they are coherent and easy to understand, theThe legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

Amendment 18

Or. en

Justification

Supervisory authorities have independence and autonomy. Therefore, it is not possible to beforehand prescribe in full detail how and in what length they shall communicate with each other.

Amendment 12

Proposal for a regulation

(14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

(14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within three months after the deadline for comments.

Amendment 19

Or. en

Justification

A deadline of nine months in non-contentious cases does not seem appropriate and in line with the rights for decisions in reasonable time and good administration.

Amendment 13

Proposal for a regulation

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the involved supervisory authorities should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings.

Amendment 20

Or. en

Justification

In accordance with Article 66(3) GDPR any supervisory authority may request an urgent decision. Further, the Board should have wide powers in view of the decision on the investigation.

Amendment 14

Proposal for a regulation

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and to ensure compliance with Article 47 of the Charter,2016/679, the handling of any complaint should always lead to a decision which may be challenged before a national court.

Amendment 21

Or. en

Justification

To ensure that cases are not closed without a clear decision which can be appealed.

Amendment 15

Proposal for a regulation

(18) Complainants as parties to the procedure should have the opportunity to express their views and the right to be heard before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known at least prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the documents on which the decision fully or partially rejecting the complaint is based, in a way to allow him or her the possibility of effective judicial review.

Amendment 22

Or. en

Justification

It has to be clear that the complainant as a party has the right to be heard before decisions affecting his or her rights. Further, he should have also rights to documents necessary to understand the decision and allow him or her the possibility of effective judicial review.

Amendment 16

Proposal for a regulation

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

Or. en

Justification

Clarification in line with Article 60(3), (8) and (9) GDPR.

Amendment 2317

Proposal for a regulation

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’),Charter’),, including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shall have the right to decline the right to be heard.

Amendment 24

Or. en

Amendment 18

Proposal for a regulation

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them, by receiving access to the administrative file.

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the right to be heard and the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to make and defend their case effectively and to comment on the allegations made, by receiving access to the case file. Where, at any stage in an investigation, a submission is made to a lead supervisory authority, which materially changes the lead supervisory authority’s view of a case, parties should be given an opportunity to respond to this submission before the lead supervisory authority takes its final decision.

Amendment 25

Or. en

Justification

It should be clarified that the recital is referring to the procedural right to be heard, as well as that the access is to the case file as such preventing any further artificial denominations or subcategories of parts of the file.

Amendment 19

Proposal for a regulation

(23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Amendment 26

Or. en

Amendment 20

Proposal for a regulation

(24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Amendment 27

Or. en

Amendment 21

Proposal for a regulation

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt of the complaint does not bar the qualification of a data subject as complainant.

Amendment 28

Or. en

Amendment 22

Proposal for a regulation

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the administrative file.

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the case file, in view of protection of confidential information and integrity of the decision-making process, without prejudice to their right for an effective judicial remedy.

Amendment 29

Or. en

Proposal for a regulation

Justification

Recital 27

Judicial remedy of complainants should not be affected.

Text proposed by the Commission

Amendment 23

Amendment

(27) When setting deadlines for parties under investigation and complainants to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, in order to ensure that the parties under investigation and complainants have sufficient opportunity to meaningfully provide their views on the issues raised.

(27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to undue long procedures.

Amendment 30

Proposal for a regulation

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject.

Amendment 31

Or. en

Justification

Unduly limits the options for concerned supervisory authorities to raise objections.

Amendment 24

Proposal for a regulation

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length taking into account the complexity of the cases and the relevancy of the contributions by other supervisory authorities; they should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

Or. en

Justification

It limits the length of written contributions that other supervisory authorities can make (to specific amount of pages), disregarding the different complexity of cases.

Amendment 3225

Proposal for a regulation

(30) Access to the case file is provided for as a part of the rights of defence, effective judicial remedy and the right to good administration enshrined in the Charter. Access to the case file should be provided to the parties under investigation at the latest when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

Amendment 33

Or. en

Amendment 26

Proposal for a regulation

(31) When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(31) When granting access to the case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

Amendment 34

Or. en

Amendment 27

Proposal for a regulation

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Amendment 35

Or. en

Amendment 28

Proposal for a regulation

(37 a) In order to enhance the provision for the smooth and effective functioning of the cooperation and dispute resolution mechanism in cross-border cases, the European Data Protection Board and the European Data Protection Supervisor should be increasingly provided with competences and a more prominent role in coordination to foster cooperation with the supervisory authorities.

Amendment 36

Or. en

Proposal for a regulation

Amendment 29

Article 1 – title

Text proposed by the Commission

Amendment

Subject matter

Subject matter and scope

Amendment 37

Proposal for a regulation

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

1. This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities related to the cross-border processingcooperation withingand consistency within the meaning of Regulation (EU) 2016/679.

Amendment 38

Or. en

Proposal for a regulation

Justification

Article 1 – paragraph 1 a (new)

It should reflect the title of Chapter VII of GDPR, namely “Cooperation and Consistency”

Text proposed by the Commission

Amendment 30

Amendment

1a. This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

This Regulation does not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.

Amendment 39

Proposal for a regulation

Article 2 – paragraph 2 – point 1

Text proposed by the Commission

Amendment

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing, as well as their representative(s);

Amendment 40

Proposal for a regulation

Amendment

(1 a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the procedure;

Amendment 41

Or. en

Proposal for a regulation

Justification

Article 2 – paragraph 2 – point 2 a (new)

It should be clear that the complainant is any subject justified to lodge a complaint under Article 77 GDPR and that, hence, he or she is a party to the procedure with particular rights. See EDPB, Letter to Commission, 22 October 2022, Annex.

Text proposed by the Commission

Amendment 31

Amendment

(2 a) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case as defined under national law;

Amendment 42

Proposal for a regulation

Article 2 – paragraph 2 – point 4 a (new)

Text proposed by the Commission

Amendment

(4 a) ‘Confidential version of documents’ means documents containing confidential or sensitive information which may be legally privileged under the applicable laws and data protection rules.

Amendment 43

Proposal for a regulation

Article 2 – paragraph 2 – point 4 b (new)

Text proposed by the Commission

Amendment

(4 b) ‘Non-confidential version of documents’ means a version of documents from which confidential or sensitive information has been redacted and which can be provided to the complainant without contravening laws or data protection rules.

Amendment 44

Proposal for a regulation

Article 2a

Common minimumMinimum procedural standardsrights

(1) Without prejudice to additional rights under national law, each party to the procedure shall have at least the following rights:

(a) have their case handled impartially and fairly, and to be treated equally, even in different jurisdictionsequally (‘fair(“fair procedure and equality of arms’);arms”);

(b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (‘right(“right to be heard’);heard”);

(c) have access to the case file (‘procedural transparency’).file.

(2) The rights in paragraph (1) shall be applied as provided in this Regulation and Regulation (EU) 2016/679, and, where applicable, national law.

Amendment 45

Or. en

Justification

It is necessary to clarify the main rights of the parties to the procedure as requested by the EDPB. Such rights shall be applied in line with this Regulation and Regulation (EU) 2016/679, if harmonised, or in accordance with national law, if not harmonised.

Amendment 32

Proposal for a regulation

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

1. A complaint that relates to cross-border cooperation and consistency in line with Article 60 of Regulation (EU) 2016/679 shall provide at least the following information:

(a) the name, address and any other available contact details of the complainant;complainant,

(b) if known, the name, address and any other contact details of the party under investigation;investigation,

(c) the facts of the case and any evidence available to the complainant;complainant,

(d) the measures that the complainant demands from the supervisory authority. No additional information shall be required in order for the complaint to be admissible.

No additional information shall be required in order for the complaint to be admissible.

The complaint may be submitted electronically or by post.

The complaint may be submitted in written, electronically or by post.

To facilitate the complaint procedure a model form is attached in the Annex.

Amendment 46

Or. en

Justification

A common form is useful to harmonise right and procedures. However, it should not be obligatory as often the complainant cannot know if the case has a cross-border dimension, and, therefore, minimum requirements to ensure that the complaint is admissible should be defined by the legislature in the operative part. Also text on the forms of transmission should be in the operative part, not only in the recitals. See AM to Recital 4.

Amendment 33

Proposal for a regulation

1 a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.

Amendment 47

Or. en

Justification

To prevent the undue rejection of complaints as observed in the practice of some DPAs.

Amendment 34

Proposal for a regulation

Amendment

1 b. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.3

Amendment 48

Or. en

Justification

Moved up from paragraph 6, to follow the sequence of events.

Amendment 35

Proposal for a regulation

- substantial affect or likely substantial affect on data subjects in more than one Member State.

Amendment 49

Or. en

Justification

Request from EDPS/EDPB joint opinion 1/2023.

Amendment 36

Proposal for a regulation

3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.

3. The supervisory authority with which the complaint was lodged shall determine the admissibility of the complaint, including the completeness of the information required, and transmit it to the lead supervisory authority within three weeks upon receipt of the complaint.

Amendment 50

Or. en

Justification

Merger of paragraphs 3 and 4 to prevent a streamlined procedure without legal lacunae on the transmission deadline to the lead DPA in view of Articles 56 and 60 GDPR. Also a deadline of three weeks for this initial phase seems long enough in view of an efficient legal remedy and the right to good administration in accordance with Article 41 of the Charter. See also EDPB, Letter to Commission, 22 October 2022, Annex, as well as EDPS and EDPB joint opinion 1/2023.

Amendment 37

Proposal for a regulation

deleted

Amendment 51

Or. en

Proposal for a regulation

Justification

Article 3 – paragraph 5

Merger with paragraph 3.

Text proposed by the Commission

Amendment 38

Amendment

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also submit a non-confidential version of the complaint.

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also provide a non-confidential version of the complaint alongside the confidential version. The supervisory authority shall only disclose it if such disclosure is necessary for the parties under investigation to exercise their rights of defence efficiently.

Amendment 52

Proposal for a regulation

deleted

Amendment 53

Or. en

Justification

Moved up to paragraph 1a, to follow the chronological order of events.

Amendment 39

Proposal for a regulation

While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall take into account all relevant circumstances, including all of the following:

Amendment 54

Or. en

Justification

Request for clarification by EDPS and EDPB joint opinion 1/2023.

Amendment 40

Proposal for a regulation

(a) the delivery of an effective and timely remedy to the complainant, including taking into account what is at stake for the complainant;

Amendment 55

Or. en

Proposal for a regulation

Amendment 41

Article 4 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(c a) the complainant’s use of internal complaint mechanism (CM) provided by the parties under investigation.

Amendment 56

Proposal for a regulation

Article 4 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(1(a a) The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Amendment 57

Or. en

Justification

Each complaint must concluded in a way to lead to an appealable decision in accordance with the right of an effective judicial remedy as stated in Article 78 GDPR and stated in Article 47 of the EU Charter.

Amendment 42

Proposal for a regulation

Article 5 – paragraph 1

Text proposed by the Commission

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

1. A complaint may be resolved by amicable settlement between the complainant and the parties under investigation at anyin stagecases ofconcerning the investigation. The supervisory authoritydata maysubjects’ encouragerights and facilitate such a voluntary process. Amicablewhere settlementswith maythe notresolution beof reachedthe ondispute, the basisobject of payments to the complainant. A resolutioncomplaint ofwill theno disputelonger bypresent. anAn amicable settlement,settlement isbetween withoutthe prejudicecomplainant toand the complainantparty claimingunder compensationinvestigation pursuantshall be considered to Articlebe 82found ofwhere Regulationthere (EU)is 2016/679.explicit agreement.

(1a) An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement.

2. The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it.

(1b)3. TheWhere supervisoryan authorityamicable withsettlement whichto the complaint has been lodged may facilitate suchfound, anthe amicableparties settlementshall incommunicate the preparatorysettlement phase;to the lead supervisory authority may facilitate itauthority, onceand athe complaint has been transmitted to it. The supervisory authority may encourage and facilitate amicableshall settlementsbe wheredeemed relevant.withdrawn.

(1c) Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

4. If the amicable settlement was reached by the lead supervisory authority Article 60(3) and (4) of Regulation 2016/679 applies.

(1d)5. IfThe thesupervisory amicableauthorities settlementare wasnot reachedbound by the lead supervisoryamicable authoritysettlement Articlein 60(3)view andof (4)a offurther Regulationex 2016/679officio applies.investigation.

(1e) The supervisory authorities are not bound by the amicable settlement in view of a further ex officio investigation.

Or. en

Amendment 58

Justification

Proposal for a regulation

The complainant has to be part of the amicable settlement and should agree with it. If the agreement was achieved by the LSA than specific intervention possibilities apply to CSA according to Article 60(3) and (4) GDPR. The settlement is without prejudice to ex officio powers of supervisory authorities. See .EDPB, Guidelines 06/2022 on the practical implementation of amicable settlements, 2022, and EDPS and EDPB joint opinion 1/2023.

Article 5 a (new)

Amendment 43

Text proposed by the Commission

Amendment

Article 5a

Request for an ex officio procedure

1. The lead supervisory authority may open an ex officio procedure at any time.

2. Where it considers that Regulation (EU) 2016/679 may be violated, any concerned supervisory authority may request an ex officio procedure by submitting a written request to the lead supervisory authority. Such a request shall contain at least:

(a) a declaration to be a concerned supervisory authority;

(b) any evidence of the violation;

(c) a summary of key issues pursuant to Article 9.

3. Within three weeks, the assumed lead supervisory authority shall:

(a) inform the concerned supervisory authority that it has opened an ex officio procedure;

(b) inform the concerned supervisory authority that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself in line; or

(c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no violation of Regulation (EU) 2016/679.

In the case referred to in point (a) of this paragraph, the concerned supervisory authority may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679.

In the case referred to in point (c) of this paragraph, the concerned supervisory authority may resubmit an amended request for an ex officio procedure, or request a determination on the opening of the procedure by the Board.

Amendment 59

Proposal for a regulation

Article 6 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation, or into the working language agreed on between the supervisory authorities concerned, for the purposes of the investigation;

Amendment 60

Proposal for a regulation

Article 6 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

(b) translation of documents provided by the lead supervisory authority into the language used or agreed for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679

Amendment 61

Proposal for a regulation

Article 68 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1 a. A supervisory authority may provide automated translations and unofficial translations.

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

Amendment 62

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, without undue delay, and on the latest within one week, with all relevant information once available.

Or. en

Amendment 44

Proposal for a regulation

Article 8 – paragraph 12 a (new)

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

2 a. The information listed in the first subparagraph above shall be transmitted immediately and at the latest within one week from receiving or producing it.

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, without undue delay, and at the latest within one week with all relevant information once available.

Or. en

Amendment 63

Justification

For the mentioned relevant information in subparagraph 1 of paragraph 2 there should be a stricter defined deadline. The concept should be in principle “immediate” and an additional fixed deadline is added.

Amendment 45

Proposal for a regulation

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues as soon as possible and on the latest within 9 months for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

Amendment 64

Or. en

Proposal for a regulation

Justification

Article 9 – paragraph 2 – point a a (new)

Introduction of specific deadline for contentious cases as requested by EDPS and EDPB joint opinion 1/2023.

Text proposed by the Commission

Amendment 46

Amendment

(a a) the response of the parties under investigation;

Amendment 65

Proposal for a regulation

Article 9 – paragraph 2 – point d a (new)

Text proposed by the Commission

Amendment

(d a) an overview of both, the replies of all parties under investigation as well as the views of the complainant on to the preliminary findings;

Amendment 66

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues.

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues, in accordance with Article 60 of Regulation (EU) 2016/679.

Amendment 67

Proposal for a regulation

deleted

Amendment 68

Or. en

Justification

Such a provision unnecessarily puts formal burdens on the communication between LSA and other concerned supervisory authorities and goes against the letter and spirit of Articles 60, 61 and 62 GDPR. See also EDPS and EDBP joint opinion 1/2023 requesting deletion.

Amendment 47

Proposal for a regulation

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

6. InCases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious casescases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

Amendment 69

Or. en

Justification

A nine-month deadline in non-contentious cases seems excessive in view of proceedings in reasonable time and the right to good administration as specified in Article 41 of the Charter.

Amendment 48

Proposal for a regulation

(c a) the potential corrective measures.

Amendment 70

Or. en

Justification

Request by EDPS and EDPB joint opinion 1/2023.

Amendment 49

Proposal for a regulation

4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority or the concerned supervisory authorities may request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679.

Amendment 71

Or. en

Justification

The procedure foreseen in Article 66(3) GDPR refers to any supervisory authority. Further, the urgent procedure should be optional depending on the case and the EDPB should not be forced to take it. Therefore, the deletion of last sentence. See also EDPS and EDPB opinion 1/2023 sincere and effective cooperation between the lead supervisory authorities and other supervisory authorities concerned applies to both, complaint based procedures and others.

Amendment 50

Proposal for a regulation

(a) the relevant information referred to in Article 9(2);

Amendment 72

Or. en

Justification

Request by EDPS and EDPB joint opinon 1/2023.

Amendment 51

Proposal for a regulation

(b a) other documents or information, as the European Data Protection Board deems appropriate in the particular case.

Amendment 73

Or. en

Proposal for a regulation

Justification

Article 10 – paragraph 6

Request by EDPS and EDPB joint opinion 1/2023.

Text proposed by the Commission

Amendment 52

Amendment

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

6. The Board shall adopt an urgent binding decision limited on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

Amendment 74

Proposal for a regulation

4. The complainant may request access to the documents on which the proposed rejection of the complaint is based using mutatis mutandis Chapter IV of this Regulation.

Amendment 75

Or. en

Proposal for a regulation

Justification

Article 11 – paragraph 5

As the complainant should be considered as a party the same rules should apply to him or her per analogy as they apply to the party under investigation. Only by having access to the case file he or her can lodge an effective judicial remedy.

Text proposed by the Commission

Amendment 53

Amendment

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, under Article 60(8) or Article 60(9) of Regulation (EU) 2016/679, as applicable, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

Amendment 76

Proposal for a regulation

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements. The time limit set should not be less than two weeks.

Or. en

Justification

It should be clear that the consideration that a complainant should be re-heard is not an arbitrary power but should take place if there are essential changes to the draft. At the same time, there should be a minimum level of time for an answer like in Article 11(2) of the proposed regulation. The limit was set to two weeks per analogy with Article 60(5) GDPR. Para. 2 was merged with para.1.

Amendment 7754

Proposal for a regulation

deleted

Amendment 78

Or. en

Amendment 55

Proposal for a regulation

Preliminary finding and the right to be heard by parties under investigation

Amendment 79

Or. en

Amendment 56

Proposal for a regulation

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties are heard and can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Amendment 80

Or. en

Justification

Clarification of the right to be heard by parties under investigation.

Amendment 57

Proposal for a regulation

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. ThatThe time-limit must be reasonable and proportionate and take into account the results of the investigations, and shall be no less than three weeks. The lead supervisory authority may receive additional written views from the parties under investigation after the expiry of this time limit but it shall not be obliged to take it into account.

Amendment 81

Or. en

Justification

There should be a reasonable time limit for defence per analogy with Article 11(2) of the proposed Regulation.

Amendment 58

Proposal for a regulation

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the case file in accordance with Chapter IV.

Amendment 82

Or. en

Justification

See comment above about the denomination of a case file. Not only Article 20 but also Articles 21 and 22 regulate access to the case file.

Amendment 59

Proposal for a regulation

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings and set a time-limit within which the complainant may make known its views in writing.

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings within 30 days following receipt of the preliminary findings, and set a time-limit within which the complainant may make known its views in writing. The time-limit shall be proportionate to afford the complainants adequate time to provide their response, and shall be no less than three weeks.

Amendment 83

Or. en

Amendment 60

Proposal for a regulation

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the case file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1, without prejudice for the rights for an effective remedy.

Amendment 84

Or. en

Proposal for a regulation

Amendment 61

Article 15 – paragraph 4

Text proposed by the Commission

Amendment

4. The complainant shall be provided with the non-confidential version of the preliminary findings only for the purpose of the concrete investigation in which the preliminary findings were issued.

4. The complainant shall be provided with the non-confidential version of the preliminary findings for the purpose of the investigation concerning her or his specific complaint in which the preliminary findings were issued. The non-confidential version shall be provided in order to facilitate the complainant’s participation in the investigation procedure and to enable her or him to put forward her or his views and arguments adequately within that investigation.

Amendment 85

Proposal for a regulation

Article 15 – paragraph 5

Text proposed by the Commission

Amendment

5. Before receiving the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the complainant shall send to the lead supervisory authority a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than the concrete investigation in which those findings were issued.

5. Before providing the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the supervisory authority with which the complaint was lodged shall request the complainant to sign a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than making submission on the concrete investigation in which those findings were issued. Legal consequences of refusing to sign or to comply with the confidentiality declaration shall be specified.

Amendment 86

Proposal for a regulation

In such case, the supervisory authority shall also provide the controller or processor information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

Or. en

Justification

Clear time period as regards the application of Article 60(7) GDPR once all the procedures on reasoned opinions or consistency mechanism are finished. See also EDPS and EDPB joint opinion 1/2023.

Amendment 8762

Proposal for a regulation

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to exercisemake their rightviews toknown beon heardsuch andnew toelements. makeThe theirtime viewslimit knownset onshould suchnot newbe elements.less than two weeks.

Amendment 88

Or. en

Justification

It should be clear that the consideration that a complainant should be re-heard is not an arbitrary power but should take place if there are essential changes to the draft. At the same time there should be a minimum level of time for an answer like in Article 11(2) of the proposed regulation. The limit was set to two weeks per analogy with Article 60(5) GDPR. Para. 2 was merged with para.1.

Amendment 63

Proposal for a regulation

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views. That time-limit must be reasonable and proportionate and take into account the results of the investigations, and shall not be less than two weeks.

deleted

Amendment 89

Or. en

Amendment 64

Proposal for a regulation

(a) the reasoned objection shall be concise, transparent, intelligible and provided in an easily accessible form, using clear and plain language;

Or. en

Justification

The provision is too formalistic, not taking into account the diversity of possible cases. The duty is to have concise documents but not in the form of specific number of pages.

Amendment 9065

Proposal for a regulation

Access to the case file and treatment of confidential information

Amendment 91

Or. en

Justification

As stated above the use of the term “administrative file” gives the impression that there are files inside a file, with restriction of certain group of documents per se to the parties. Horizontal amendment.

Amendment 66

Proposal for a regulation

Content of the case file

Amendment 92

Or. en

Amendment 67

Proposal for a regulation

1. The case file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

Amendment 93

Or. en

Amendment 68

Proposal for a regulation

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority may return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the administrative file.

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority shallmay return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the case file.

Amendment 94

Or. en

Amendment 69

Proposal for a regulation

deleted

Amendment 95

Or. en

Justification

The paragraph excludes automatically from the case file a whole group of documents. Such an approach is not proportionate and may significantly affect the right to a judicial remedy as provided in Article 78 GDPR and Article 47 of the Charter. The mentioned paragraph could cause even situations where documents would be possibly given to any EU citizen under access to documents requests but rejected to the parties to the procedure.

Amendment 70

Proposal for a regulation

Access to the case file and use of documents

Amendment 96

Or. en

Amendment 71

Proposal for a regulation

1. The lead supervisory authority shall grant access to the administrative file to the parties under investigation, enabling them to exercise their right to be heard. Access to the administrative file shall be granted after the lead supervisory authority notifies the preliminary findings to the parties under investigation.

1. The lead supervisory authority shall grant access to the case file to the parties, enabling them to exercise their right to be heard and the right to an effective judicial remedy. Access to the case file shall be granted aton the latest after the lead supervisory authority notifies the preliminary findings to the parties.

Amendment 97

Or. en

Amendment 72

Proposal for a regulation

2. The case file shall include all documents, inculpatory and exculpatory, including facts and documents concerning the parties under investigation.

Amendment 98

Or. en

Amendment 73

Proposal for a regulation

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties had the opportunity to make their views known.

Amendment 99

Or. en

Amendment 74

Proposal for a regulation

4. Documents obtained through access to the case file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided to the parties.

Amendment 100

Or. en

Justification

Access relates to parties to the proceedings that can be parties under investigation as well as the complainant. It should be clarified that the access and limitation issue refers to parties, not to authorities.

Amendment 75

Proposal for a regulation

2. Any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, is excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing.

2. InThere is a rebuttable presumption in line with applicable national and EU law on access to documents that any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, may beis excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing. The same exclusion applies to business secrets and other confidential information.

Amendment 101

Or. en

Justification

A general and absolute prohibition of public access to all documents during the investigation phase would not be proportionate and could contravene national and EU law in view of access to documents by the public. There can be a presumption that such documents are non-public. However, the citizen must have the possibility to prove that “there is an overriding public interest in disclosure”.

Amendment 76

Proposal for a regulation

3. When communicating preliminary findings to parties under investigation and providing for access to the administrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties under investigation to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of defence of the parties under investigation with due regard for the confidentiality of the information.

3. When communicating preliminary findings to parties and providing for access to the caseadministrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of the parties with due regard for the confidentiality of the information. The final assessment whether information is confidential lies within the lead supervisory authority.

Amendment 102

Or. en

Proposal for a regulation

Justification

Article 21 – paragraph 6 – introductory part

Wording adapted the notion of the parties to the proceeding including complainants and parties under investigation.

Text proposed by the Commission

Amendment 77

Amendment

6. The lead supervisory authority may set a time-limit for parties under investigation and any other party raising a confidentiality claim to:

6. The lead supervisory authority may set a proportionate and reasonable time-limit for parties under investigation and any other party raising a confidentiality claim to:

Amendment 103

Proposal for a regulation

Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679

Amendment 104

Or. en

Justification

Clarification of the text.

Amendment 78

Proposal for a regulation

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections.

Amendment 105

Or. en

Proposal for a regulation

Justification

Article 22 – paragraph 2 – point a a (new)

Necessary addition of a strict deadline in view of practical application of GDPR (cases of very long periods before submission).

Text proposed by the Commission

Amendment 79

Amendment

(a a) (aa) the summary of key issues;

Amendment 106

Proposal for a regulation

Article 22 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) a summary of the relevant facts;

(b) a summary of the relevant facts, including the description of processing activities, the description of the company's organisation and the description of where decisions are taken;

Amendment 107

Proposal for a regulation

Article 22 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority;

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as being neither relevant nor reasoned;

Amendment 108

Proposal for a regulation

Article 22 – paragraph 2 – point g

Text proposed by the Commission

Amendment

(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.

(g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned.

Amendment 109

Proposal for a regulation

Article 22 – paragraph 2 – point g a (new)

Text proposed by the Commission

Amendment

(g a) access to the joint case file.

Amendment 110

Proposal for a regulation

Article 22 – paragraph 3

Text proposed by the Commission

Amendment

3. The Board shall within four weeks of receiving the documents listed in paragraph 2 identify retained relevant and reasoned objections.

3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to the supervisory authorities.

Amendment 111

Proposal for a regulation

Article 22 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3 a. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit any relevant information that they have on that case, including but not limited to, facts and documentation that underlie their objection.

Amendment 112

Proposal for a regulation

Article 22 – paragraph 3 b (new)

Text proposed by the Commission

Amendment

3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

Amendment 113

Proposal for a regulation

Article 22 – paragraph 3 c (new)

Text proposed by the Commission

Amendment

3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation shall also apply during the periods referred in paragraph 3 of this Article.

Amendment 114

Proposal for a regulation

The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Articles 22(2) and 23 are available and translated.

Or. en

Justification

Request by EDPB and EDPS opinion 1/2023.

Amendment 11580

Proposal for a regulation

Article 26 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(aa) views made in writing by the parties under investigation as well as by complainants;

Amendment 116

Proposal for a regulation

Article 28 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) where applicable, the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

(f) the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

Amendment 117

Proposal for a regulation

Article 28 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the Board shall request a joint assessment carried out by at least five experts from the 'Support Pool of Experts' of the EDPB. This joint assessment shall be published together with the urgent binding decision.

Amendment 118

Proposal for a regulation

deleted

Or. en

Justification

As Regulation No. 1182/71 fully applies such an additional text is not necessary.

Amendment 11981

Proposal for a regulation

Article 30 a (new)

Text proposed by the Commission

Amendment

Article 30a

Evaluation and review

The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.

Amendment 120

Proposal for a regulation

Article 31 – title

Text proposed by the Commission

Amendment

Entry into force

Entry into force and application

Amendment 121

Proposal for a regulation

Article 31 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

It shall apply from … [one year from the date of entry into force of this Regulation].

Justification

EDPB para 192 – transition period for necessary adjustments in EDPB secretariat and tools (IMI), national DPAs, and possibly national laws.

Amendment 122

Proposal for a regulation

Annex I – title

Text proposed by the Commission

Amendment

Part A - 3. Entity whose processing of your personal data infringes Regulation (EU) 2016/679. Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including whether you have contacted the entity prior to your complaint and outline the result of any such actions. If possible, please attach any relevant correspondence between you and the entity. In return, delete the second paragraph of Section B.

Amendment 123

Proposal for a regulation

2 For example, passport, driving licence, national ID.

Or. en

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 12482

Proposal for a regulation

deleted

Or. en

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 12583

Proposal for a regulation

Telephone number

Or. en

Justification

The rapporteur declares under his exclusive responsibility that he did not receive input from any entity or person to be mentioned in this Annex pursuant to Article 8 of Annex I to the Rules of Procedure.

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

Laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

References

COM(2023)0348 – C9-0231/2023 – 2023/0202(COD)

Committee responsible

Date announced in plenary

LIBE

13.7.2023

Opinion by

Date announced in plenary

JURI

13.7.2023

Rapporteur for the opinion

Date appointed

Ibán García Del Blanco

16.11.2023

Discussed in committee

11.12.2023

Date adopted

24.1.2024

Result of final vote

+:

–:

0:

14

9

0

Members present for the final vote

Pascal Arimont, Gunnar Beck, Jorge Buxadé Villalba, Ilana Cicurel, Ibán García Del Blanco, Virginie Joron, Sergey Lagodinsky, Gilles Lebreton, Sabrina Pignedoli, Jiří Pospíšil, Franco Roberti, Raffaele Stancanelli, Adrián Vázquez Lázara, Axel Voss, Marion Walsmann, Tiemo Wölken

Substitutes present for the final vote

Pascal Durand, Angelika Niebler, Nacho Sánchez Amor, Jana Toom

Substitutes under Rule 209(7) present for the final vote

Benoît Biteau, Christian Ehler, Witold Pahl

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols: