Sittings · Compare

What changed

From · report parliamentary committee draft · 2023-11-09 LIBE-PR-755005 on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

→

To · agreement provisional · 2025-07-15 LIBE-AG-775517 Proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

+395 added · −2099 removed · 8 modified paragraphs hide unchanged text

~~PR_COD_1amCom~~

27.6.2025

~~Symbols for procedures~~

PROVISIONAL AGREEMENT RESULTING FROM INTERINSTITUTIONAL NEGOTIATIONS

* Consultation procedure

Subject: Proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

*** Consent procedure

(COM(2023)0348 – C90231/2023 – 2023/0202(COD))

***I Ordinary legislative procedure (first reading)

The interinstitutional negotiations on the aforementioned proposal for a regulation have led to a compromise. In accordance with Rule 75(4) of the Rules of Procedure, the provisional agreement reproduced below is submitted to the Committee on Civil Liberties, Justice and Home Affairs for decision by way of a single vote.

***II Ordinary legislative procedure (second reading)

PE-CONS No/YY - 2023/0202(COD)

***III Ordinary legislative procedure (third reading)

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL ▌

~~(The type of procedure depends on the legal basis proposed by the draft act.)~~

▌

~~Amendments to a draft act~~

laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

~~Amendments by Parliament set out in two columns~~

(Text with EEA relevance)

~~Deletions are indicated in bold italics in the left-hand column. Replacements are indicated in bold italics in both columns. New text is indicated in bold italics in the right-hand column.~~

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

The first and second lines of the header of each amendment identify the relevant part of the draft act under consideration. If an amendment pertains to an existing act that the draft act is seeking to amend, the amendment heading includes a third line identifying the existing act and a fourth line identifying the provision in that act that Parliament wishes to amend.

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

~~Amendments by Parliament in the form of a consolidated text~~

Having regard to the proposal from the European Commission,

New text is highlighted in bold italics. Deletions are indicated using either the ▌symbol or strikeout. Replacements are indicated by highlighting the new text in bold italics and by deleting or striking out the text that has been replaced.

After transmission of the draft legislative act to the national parliaments,

~~By way of exception, purely technical changes made by the drafting departments in preparing the final text are not highlighted.~~

Having regard to the opinion of the European Economic and Social Committee,

~~DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION~~

Having regard to the opinion of the Committee of the Regions,

~~on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679~~

Acting in accordance with the ordinary legislative procedure,

~~(COM(2023)348 – C90231/2023 – 2023/0202(COD))~~

Whereas:

~~(Ordinary legislative procedure: first reading)~~

(1) Regulation (EU) 2016/679 of the European Parliament and of the Council establishes a decentralised enforcement system which aims to ensure the consistent interpretation and application of Regulation (EU) 2016/679 in cross-border cases. In cases concerning cross-border processing of personal data, this system requires cooperation between supervisory authorities in an endeavour to reach consensus and, where supervisory authorities cannot reach consensus, provides for dispute resolution by the European Data Protection Board (‘the Board’).

~~– having regard to the Commission proposal to Parliament and the Council (COM(2023)348),~~

~~– having regard to Article 294(2) and Article 16 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90231/2023),~~

▌

~~– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,~~

(2a) In the absence of EU rules governing the matter, it is for each Member State, in accordance with the principle of the procedural autonomy of the Member States, to lay down the detailed rules of administrative and judicial procedures intended to ensure a high level of protection of rights which individuals derive from EU law. The procedural law of each Member State should therefore apply to the supervisory authorities insofar as this Regulation does not harmonise a matter, and as long as such national procedural rules do not impede the principles of effectiveness and equivalence of EU law.

~~– having regard to Rule 59 of its Rules of Procedure,~~

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Information provided by complainant as part of the complaint lodged or when making their views known can include arguments and evidences which can help progress the investigation. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

~~– having regard to the opinion of the Committee on Legal Affairs,~~

(3a) This Regulation aims at ensuring that investigations in cases of cross-border processing are dealt in accordance with the principle of good administration, in particular that they are dealt impartially, fairly and within a reasonable time. To this end, this Regulation lays down some horizontal principles relating to the procedures in the enforcement of Regulation (EU) 2016/679 for cross-border processing.

~~– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A90000/2023),~~

(3b) A complaint should be understood as a claim lodged by a data subject with a supervisory authority in accordance with Article 77(1) or Article 80 of the Regulation (EU) 2016/679. The mere reporting of alleged infringements which does not concern the processing of personal data relating to the data subject, requests for advice from controllers or processors or general requests regarding the application of Regulation (EU) 2016/679, either from controllers, processors or natural persons, should not be regarded as a complaint.

~~1. Adopts its position at first reading hereinafter set out;~~

(4) In order for a complaint relating to cross-border processing to be admissible, it should contain specified information. No additional information should be required for such a complaint to be admissible. Administrative modalities and requirements of admissibility of complaints under national law of the supervisory authority with which a complaint has been lodged, such as language, statute of limitations, means of identification, electronic form, specific template or signature, continue to apply.

~~2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;~~

(4a) The complainant should not be required to contact the party under investigation before lodging a complaint in order for that complaint to be admissible. Where the complaint relates to the exercise of a right of the data subject which relies on a request to be submitted to the data controller by the data subject concerned, such request is expected to be made to the controller before the submission of such complaint.

~~3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.~~

(4ab) The supervisory authority with which the complaint was lodged shall determine, by way of a preliminary conclusion, whether the complaint relates to cross-border processing, which supervisory authority is assumed to act as a lead supervisory authority in accordance with Article 56(1) of Regulation (EU) 2016/679, and if Article 56(2) of Regulation (EU) 2016/679 applies. Where a procedure for the early resolution has not been initiated, the supervisory authority with which the complaint has been lodged should transmit the admissible complaint to the assumed lead supervisory authority and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged should be binding on the lead supervisory authority.

~~Amendment 1~~

(4b) As part of the specified information required, the contact details of the person or entity lodging the complaint could include postal address, place of residence and, where available, email address.

~~Proposal for a regulation~~

(4c) Where the entity filling the complaint is a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, a proof that the body, organisation or association has been properly constituted in accordance with the national law of the Member State of the authority with which the complaint is lodged should be provided, together with a proof that such body, organisation or association is acting on the basis of the mandate of the data subject. The modalities and procedures for the establishment of such proofs are determined in accordance with the national law of the Member State of the authority with which the complaint was lodged.

~~Recital 2~~

(4d) Where the complainant is a natural person not in a position to exercise his or her right to lodge a complaint without the assistance of a legal representative, for example because he or she is a child or because he or she has a disability or vulnerability, the result of which is that his or her rights are exercised through another person, such as a parent, legal guardian or family member, and where such representation is allowed under national law, that circumstance must be clearly identified at the point in time at which the complaint is lodged.

~~Text proposed by the Commission~~

(4e) Supervisory authorities should facilitate the submission of all required information by the complainant. This could include providing templates or electronic forms, including in line with relevant European Data Protection Board's guidelines. Supervisory authorities could ask for further information from the complainant in order to facilitate the handling of the complaint. Where some of the information necessary for the complaint to be deemed admissible is missing, the supervisory authority with which the complaint is lodged could contact the complainant in order to obtain the missing information where feasible. Where the complaint is inadmissible, the supervisory authority should decide on its inadmissibility within the deadline provided by this Regulation while informing the complainant of the missing information, so as to allow him to resubmit an admissible complaint.

~~Amendment~~

(4f) Where, following receipt of a complaint relating to cross-border processing from a supervisory authority, the lead supervisory authority requires additional information from the complainant in order to allow for the full investigation of the complaint, the supervisory authority with which the complaint was lodged should assist the lead supervisory authority, including by contacting the complainant to seek the required information if needed.

(4g) Supervisory authorities can facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the specified information required and no additional information should be required in order to find the complaint admissible.

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

(4h) Where the lead supervisory authority initiates an investigation on the basis of a complaint, the parties under investigation should be informed without delay about the lodging of the complaint and the main elements thereof. Such provision of information by the lead supervisory authority could however be postponed for as long as it is necessary to protect the integrity of the investigation and allow for the effective conduct of investigative measures.

~~Or. en~~

(5) Supervisory authorities should decide on complaints within a reasonable timeframe. For this reason, this regulation lays down time limits. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. In order to effectively protect the fundamental rights and freedoms of data subjects in relation to the processing of personal data, it is important that complaints are handled in an efficient and expedient way. Depending on the circumstances of a case, the time required to handle it could be shorter than the time limit provided for in this Regulation. Efficient cooperation between the concerned authorities and the lead supervisory authority can also have a positive impact for the expedient handling of cases.

~~Amendment 2~~

(5a) A complainant should have the possibility to exclusively communicate with the supervisory authority with which the complaint has been lodged. This should not prevent the complainant from communicating directly with another supervisory authority, including the lead supervisory authority.

~~Proposal for a regulation~~

▌

~~Recital 2 a (new)~~

(5b) Supervisory authorities should conduct procedures in an expedient and efficient way and should cooperate with each other in a sincere and effective manner, including by providing support where necessary and responding to requests without delay.

~~Text proposed by the Commission~~

▌

~~Amendment~~

(6) It is important to consider the personal data processed and the situation of the data subject, for example where a complaint relates to the processing of personal data of children.

(2a) This Regulation and Chapter VII of Regulation (EU) 2016/679 only govern certain elements of the cooperation procedure, when supervisory authorities of more than one Member State participate in the procedure. This Regulation does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State.

~~Or. en~~

~~Amendment 3~~

~~Proposal for a regulation~~

~~Recital 2 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(2b) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law.

~~Or. en~~

~~Justification~~

The Commission proposal is based on an idea of full harmonization, whereas matters like the use of languages, evidence, witnesses and alike are regulated in national procedures. The new Articles 1a and 2a to 2c shall clarify this matter.

~~Amendment 4~~

~~Proposal for a regulation~~

~~Recital 4~~

~~Text proposed by the Commission~~

~~Amendment~~

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post. The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679. No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible.

(4) In order to be admissible a complaint should contain certain specified information. No additional information should be required for a complaint to be deemed admissible. Where a complaint does not meet the minimum requirements, the supervisory authority should reject it and inform the complainant about the missing information. The complainant can then resubmit a complete complaint. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

~~Or. en~~

~~Justification~~

The form should not be mandatory, as many complainants will not initially know if a case is cross-country or not. A mandatory form may unduly limit access to authorities. Instead, minimum information should be introduced.

~~Amendment 5~~

~~Proposal for a regulation~~

~~Recital 5~~

~~Text proposed by the Commission~~

~~Amendment~~

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. Article 6 of the European Convention on Human Rights (ECHR) and Articles 41 and 47 of the Charter require a reasonable overall duration of procedures. Given that this includes judicial remedies under Article 78 of Regulation (EU) 2016/679, procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations of time-limits for delays or disruptions that are outside the control of the lead supervisory authority.

~~Or. en~~

~~Justification~~

The duration of nine months is based on existing laws (requiring usually 3-12 months) and also objectively necessary, when appeals under Article 78 (often 2-3 “levels” in the Member States) are accounted for. It is formulated as an average, normal duration to recognize that exceptional cases may take longer.

~~Amendment 6~~

~~Proposal for a regulation~~

~~Recital 5 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(5a) The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

~~Or. en~~

~~Justification~~

~~The Commission follows the idea of full harmonisation. This begs the question which procedural laws govern elements that are not fully harmonised. Linked to Article 2a (new)~~

~~Amendment 7~~

~~Proposal for a regulation~~

~~Recital 5 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(5b) To ensure that minimum requirements of fair and efficient procedures are met in all cross-border cases, including in Member States where there is no codified national procedural law, the Regulation sets directly applicable rules based on Article 41 of the Charter.

~~Or. en~~

~~Justification~~

The minimum standards should be largely compatible with existing national procedural laws. In Member States without a codified procedure, these minimum standards allow more legal certainty. When national laws are not compatible, this Regulation prevails. Linked to Article 2a (new)

~~Amendment 8~~

~~Proposal for a regulation~~

~~Recital 5 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(5c) Article 6 of the ECHR and Article 47 of the Charter require that fair procedures are public. Article 42 of the Charter and the law of many Member States foresee the right of access to public documents and the transparency of actions of authorities. However, it should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a . This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why.

~~___________~~

1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj)

~~Or. en~~

~~Justification~~

Reconcile the right to fair (=public) procedures and the right to access to information with the need to protect trade secrets and the inner decision-making of the authorities. Linked to Article 2b (new).

~~Amendment 9~~

~~Proposal for a regulation~~

~~Recital 5 d (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(5d) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities.

~~Or. en~~

~~Justification~~

~~The LSA is in charge of managing the case, while the other SAs provide all information and must be involved. Linked to Article 2c (new).~~

~~Amendment 10~~

~~Proposal for a regulation~~

~~Recital 5 e (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(5e) Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should, however, not lead to any interference with the rights of the parties. Complaints procedures should not be delayed and the right of parties to be heard should not be limited when a supervisory authority opens an ex officio procedure into the same matter.

~~Or. en~~

~~Justification~~

~~To avoid an “ex officio bypass” by some authorities, where the issue of a complaint is moved into an “ex officio” procedure, without the participation of the complainant.~~

~~Amendment 11~~

~~Proposal for a regulation~~

~~Recital 5 f (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(5f) Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the relevant accepted languages.

~~Or. en~~

~~Justification~~

~~Currently the joint language is English, based on IMI rules. This is not defined in law, but seems accepted and sufficient in most cases. This should be codified. Linked to Article 2d.~~

~~Amendment 12~~

~~Proposal for a regulation~~

~~Recital 6~~

~~Text proposed by the Commission~~

~~Amendment~~

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective and quick remedy to the complainant can be quickly delivered. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision.

~~Or. en~~

~~Justification~~

~~The recital so far hinted at limited enforcement and discretion of authorities not to act. This was amended to ensure that their duty to act is highlighted.~~

~~Amendment 13~~

~~Proposal for a regulation~~

~~Recital 7~~

~~Text proposed by the Commission~~

~~Amendment~~

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant.

(7) The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention.

▌

~~Or. en~~

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should endeavour, where appropriate, to resolve complaints by the procedure for early resolution in accordance with this regulation. Such procedure should establish whether the infringement alleged in the complaint has been brought to an end in a manner rendering the complaint devoid of purpose. Member States are not required to introduce new procedures under national law to allow their supervisory authorities to resolve a complaint through early resolution.

~~Justification~~

(9a) A procedure for the early resolution of a complaint should only be concluded where the complainant has not submitted a timely objection to the finding that the alleged infringement has been brought to an end. The early resolution of a complaint should therefore apply to cases where the complainant is duly able to assess the proposed outcome.

~~Linked to Articles 2c, 8~~

(9b) The early resolution of a complaint may be particularly useful in expeditiously resolving disputes concerning infringements of data subject rights pursuant to Chapter III of Regulation (EU) 2016/679 to the satisfaction of the complainant. Such outcome should allow the supervisory authority with which the complaint has been lodged or the lead supervisory authority to establish, on the basis of preliminary engagement with the data controller and provided that supporting evidence has been obtained, that the complaint is devoid of purpose.

~~Amendment 14~~

(9c) The circumstance that an individual complaint has been resolved through a procedure allowing for its early resolution should be without prejudice to the exercise by the lead supervisory authority of its powers in accordance with Regulation (EU) 2016/679 on the same subject-matter, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

~~Proposal for a regulation~~

(9d) Where the lead supervisory authority to which the complaint has been transmitted considers that a complaint can be resolved through early resolution, a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 should be submitted to the other supervisory authorities concerned, with a view to adopting a final decision in accordance with Article 60(7) of Regulation (EU) 2016/679 establishing that the alleged infringement has been brought to an end and that the complaint, or part of the complaint, has been resolved by the lead supervisory authority. The draft decision submitted could therefore be simplified and limited to an information that the complaint was settled, in whole or in part, through a procedure allowing for its early resolution, indicating the reasons underlying the decision and the scope of the resolution, and confirming that the complaint is therefore devoid of purpose. In such cases, the lead supervisory authority should directly submit its draft decision, without having to prepare and circulate a summary of key issues or preliminary findings.

~~Recital 8~~

▌

~~Text proposed by the Commission~~

(10) In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679.

~~Amendment~~

▌

(8) The competent supervisory authority should provide the complainant with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint.

(10a) Where the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it should be possible for the lead supervisory authority to cooperate with supervisory authorities through a simple cooperation procedure. In such a case, the lead supervisory authority should inform supervisory authorities concerned of such consideration and provide all relevant information concerning the characteristics of the case and the complaint, including the main relevant facts and the alleged infringement to be investigated. Unless any of the supervisory authorities concerned object, the lead supervisory authority should continue cooperating with concerned supervisory authorities and submit a draft decision within the time limits foreseen in this Regulation.

~~(8) The competent supervisory authority should provide the parties with remote access to the joint case file, except for redacted documents and internal deliberations.~~

(10b) The simple cooperation procedure should only be applied on a case-by-case basis, following a consideration by the lead supervisory authorities that, no reasonable doubt exists as to the scope of the investigation and the legal and factual issues identified do not require additional cooperation of the purpose of a complex investigation, in particular on the basis of the characteristics of the case and previous decisions in similar cases. In addition, existing case-law and guidelines adopted by the Board on the alleged infringement of Regulation (EU) 2016/679 to be investigated should also be taken into account by the lead supervisory authority in considering that consensus on the main elements of a case is likely to be established. In principle, the simple cooperation procedure should not apply where the case raises structural or recurring problems in several Member States, where the case concerns a general legal issue with regards to the interpretation, application or enforcement of Regulation (EU) 2016/679, where the case is related to the intersection of data protection with other legal fields, where the case affects a large number of data subjects in several Member States, where the case is related to a large number of complaints in several Member States; or where there may be a high risk to the rights and freedoms of data subject.

~~Or. en~~

▌

~~Amendment 15~~

(10c) In cases where a supervisory authority is required to take certain procedural steps within specified time limits, it is the purpose of such time limits to ensure that the procedure progresses and concludes within a reasonable time. However, the purpose of such time limits is not to preclude supervisory authorities from taking the required procedural steps after their expiry. It is therefore necessary to ensure that where such procedural steps are taken after the expiry of the corresponding time limits, that fact cannot be considered grounds for illegality or invalidity either of the procedural step in question or of the final decision.

~~Proposal for a regulation~~

(10d) A mechanism should be introduced to allow the lead supervisory authority to extend the time limit for submitting a draft decision. Such extensions should be applied only in exceptional cases where it is required by the complexity of a case. Supervisory authorities concerned should be informed and have the opportunity to submit objections to the extension, which should be considered by the lead supervisory authority when determining whether to apply an extension to the time limit and, where applicable, the length of such an extension.

~~Recital 9~~

(10e) In cases where the lead supervisory authority extends the time limit for submitting a draft decision, supervisory authorities concerned should have the opportunity to inform the lead supervisory authority of their assessment that there is a need to act in order to protect the rights and freedoms of data subjects. In cases where the lead supervisory authority has been informed of such assessment in a timely manner, and does not submit a draft decision within the extended time limit, the urgent need to act as referred to in Article 66(1) of Regulation (EU) 2016/679 should be presumed. Notwithstanding this possibility, the urgency procedure remains available to supervisory authorities subject to the conditions set out in Article 66 of Regulation (EU) 2016/679.

~~Text proposed by the Commission~~

(10f) In order to ensure that proceedings are conducted in an efficient manner, unless the procedural step in itself irreversibly affects the rights of the party under investigation or the complainant irrespective of the final decision, without prejudice to the procedural autonomy of Member States, it is preferable that remedies against procedural steps taken by supervisory authorities only be available in conjunction with a remedy against a final decision.

~~Amendment~~

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case as early as possible and prior to the ▌adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679 ▌.

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should not bind the authorities. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

(12a) In this context, the exchange of relevant information between the lead supervisory authority and supervisory authorities concerned is an important element to support the spirit of effective and sincere cooperation. Such exchange of relevant information, and the timely provision of specific elements of information by the lead supervisory authority, should be understood as a continuous process throughout the course of an investigation and may vary in terms of documents and details required, depending on the complexity of the case being investigated. In particular, depending on the stage of the investigation and the circumstances of a case, such relevant information could progressively include, among others, the exchange of correspondence with the data controller or the data subject on the subject of a complaint or investigation, the preparatory documents for an audit or inspection, or preliminary technical or legal assessment being considered by the lead supervisory authority as a result of a specific step in its investigation.

~~Or. en~~

(12b) While the lead supervisory authority should provide any relevant information to the supervisory authorities concerned without delay after the information becomes available, concerned supervisory authorities should also proactively make available any relevant information deemed useful to assess the legal and factual elements of a case. The exchange of relevant information should support the swift and effective cooperation between supervisory authorities and may, in certain cases, be supported by summary, extracts or copies of documents in order to facilitate a swift understanding of a case, while allowing for complementary information to be provided where further elements become necessary. In order to facilitate an effective and appropriate exchange of information between supervisory authorities, the Board could specify the modalities and requirements for the exchange of such information.

~~Amendment 16~~

(12c) As part of the relevant information on a specific case, the lead supervisory authority should provide concerned supervisory authorities with a summary of key issues setting out its preliminary view on the main issues in an investigation. It should be provided at a sufficiently early stage to allow effective inclusion of the views submitted by supervisory authorities concerned but at the same time at a stage where the lead supervisory authority has sufficient elements to form its views on the case, where necessary by means of preliminary analysis and possible initial investigative measures. The summary of key issues should also include, where applicable, the preliminary identification of potential corrective measures in cases where the lead supervisory authority has sufficient elements to form a preliminary view on the matter, in particular when the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement can be easily identified at an early stage.

~~Proposal for a regulation~~

(12d) Concerned supervisory authorities should have the opportunity to provide their comments on the summary of key issues, including on a broad range of questions, such as the scope of the investigation, the identification of the alleged infringements and the identification of factual and legal issues which are relevant for the investigation. Given that the scope of the investigation determines the matters which require investigation by the lead supervisory authority, supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

~~Recital 11~~

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the summary of key issues and the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The summary of key issues and the comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents should not make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

~~Text proposed by the Commission~~

▌

~~Amendment~~

(15) Supervisory authorities should use all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope of a complaint-based investigation, including the provisions of Regulation (EU) 2016/679 the infringement of which will be investigated, or where the comments of the supervisory authorities concerned relate to an important change in the complex legal or factual assessment, or to the preliminary identification of potential corrective measures, the concerned authority could use the tools provided for under Articles 61 and 62 of Regulation (EU) 2016/679.

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the investigation as early as possible and prior to the communication of allegations to the parties under investigation and adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(16) Regulation (EU) 2016/679 enables the supervisory authority to request an urgent binding decision from the Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is an urgent need to act, in order to protect the rights and freedoms of data subjects. Under this Regulation, where following the use of the means set out in this Regulation the supervisory authorities fail to reach a consensus on the scope of a complaint-based investigation, the conditions under Article 66(3) of Regulation (EU) 2016/679 to request an urgent binding decision should be presumed to be met and the lead supervisory authority should request an urgent binding decision of the Board. The urgent binding decision of the Board on the scope of a complaint-based investigation cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the right to be heard of the parties under investigation. ▌

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case via the summary of key issues and comments on that summary as early as possible and prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(16a) Procedural rights should be conferred on the complainant to the extent his or her rights and freedoms as a data subject are concerned. Procedural steps laid down in this regulation, relating to the cooperation between supervisory authorities, do not confer rights on the complainant or the parties under investigation. Therefore this regulation clarifies which provisions on procedural steps do not confer rights on individuals or parties under investigation, or do not limit those rights.

~~Or. en~~

▌

~~Amendment 17~~

(18) Complainants should have the opportunity to express their views before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. ▌

~~Proposal for a regulation~~

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of full or partial rejection or dismissal of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed full or partial rejection or dismissal of the complaint and that authority should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision fully or partially rejecting or dismissing the complaint, the lead supervisory authority should prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679, in cooperation with the supervisory authority with which the complaint has been lodged, including the possibility to request the assistance of the supervisory authority with which the complaint has been lodged in preparing such a draft.

~~Recital 12~~

(20) The effective enforcement of Union data protection rules should be compatible with the full respect of the parties' rights of defence, which constitutes a fundamental principle of Union law to be respected in all circumstances, and in particular in procedures which may give rise to penalties.

~~Text proposed by the Commission~~

~~Amendment~~

(12) Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority, with due regard for the margin of discretion enjoyed by each supervisory authority, including in the assessment of the extent appropriate to investigate a case, and for the varying traditions of the Member States. For this purpose, the lead supervisory authority should provide concerned supervisory authorities with a summary of key issues setting out its preliminary view on the main issues in an investigation. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned but at the same time at a stage where the lead supervisory authority’s views on the case are sufficiently mature. Concerned supervisory authorities should have the opportunity to provide their comments on a broad range of questions, such as the scope of the investigation and the identification of complex factual and legal assessments. Given that the scope of the investigation determines the matters which require investigation by the lead supervisory authority, supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

(12) Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority. For this purpose, the supervisory authority with which a complaint has been lodged or which demands an ex-officio action should provide a summary of key issues setting out its preliminary view on the main issues in an investigation. In all other cases, the lead supervisory authority should draft the summary of key issues. The summary of key issues should be part of the joint case file, and should be a living document that is updated by the lead supervisory authority during the course of the procedure. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned. Concerned supervisory authorities should have the opportunity to provide their comments on any update of the summary of key issues. The lead supervisory authority should comply with the comments as far as possible or reject them. In the case of a rejection, the supervisory authorities should be able to raise any dispute with the Board. Supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

~~Or. en~~

~~Amendment 18~~

~~Proposal for a regulation~~

~~Recital 13~~

~~Text proposed by the Commission~~

~~Amendment~~

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, any documents submitted by concerned supervisory authorities and the parties should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. Supervisory authorities should therefore be able to limit the length of submissions by the parties. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate.

~~Or. en~~

~~Justification~~

To avoid “spamming” by large companies who can afford law firms to submit thousands of pages. The rule is similar to the rules of procedure before the CJEU, where submissions are regularly limited to 20 or 30 pages.

~~Amendment 19~~

~~Proposal for a regulation~~

~~Recital 14~~

~~Text proposed by the Commission~~

~~Amendment~~

(14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

~~Or. en~~

~~Justification~~

~~Linked to Article 9(6).~~

~~Amendment 20~~

~~Proposal for a regulation~~

~~Recital 15~~

~~Text proposed by the Commission~~

~~Amendment~~

(15) Supervisory authorities should avail of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope of a complaint-based investigation, including the provisions of Regulation (EU) 2016/679 the infringement of which will be investigated, or where the comments of the supervisory authorities concerned relate to an important change in the complex legal or technological assessment, the concerned authority should use the tools provided for under Articles 61 and 62 of Regulation (EU) 2016/679.

(15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should be able to raise the matter quickly with the Board. The Board should be able to make the necessary procedural determinations.

~~Or. en~~

~~Justification~~

~~Linked to Article 26a (new).~~

~~Amendment 21~~

~~Proposal for a regulation~~

~~Recital 16~~

~~Text proposed by the Commission~~

~~Amendment~~

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the lead supervisory authority should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. For this purpose, the requirement of urgency should be presumed. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings. The urgent binding decision of the Board cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the rights of the parties under investigation to be heard. In particular, the Board should not extend the scope of the investigation on its own initiative.

~~deleted~~

~~Or. en~~

~~Justification~~

Urgent decisions under Article 66(3) GDPR are limited to inaction of a DPA. Instead, procedural determinations by the Board should be possible for all sorts of procedural disputes. Linked to Recital (15).

~~Amendment 22~~

~~Proposal for a regulation~~

~~Recital 17~~

~~Text proposed by the Commission~~

~~Amendment~~

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the handling of any complaint should always lead to a decision which may be challenged before a national court.

~~Or. en~~

~~Justification~~

~~To ensure that cases are not “closed” or “deemed withdrawn” and alike without a clear decision which can be appealed.~~

~~Amendment 23~~

~~Proposal for a regulation~~

~~Recital 18~~

~~Text proposed by the Commission~~

~~Amendment~~

~~deleted~~

~~Or. en~~

~~Justification~~

There is a general right to be heard before a decision, which allows to remove the need for “draft” decisions. Article 11 is therefore also deleted. This should limit the need for paperwork through repeated “draft of the draft” procedures.

~~Amendment 24~~

~~Proposal for a regulation~~

~~Recital 19~~

~~Text proposed by the Commission~~

~~Amendment~~

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed rejection of the complaint and should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also have the responsibility of preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

~~Or. en~~

~~Justification~~

The COM proposal would rewrite the GDPR, as the drafting is clearly with the LSA. We suggest to highlight that the CSA with which the complaint was filed must issue the final decision and therefore needs to be involved in the drafting, to ensure that it cannot be easily appealed before a national court.

~~Amendment 25~~

~~Proposal for a regulation~~

~~Recital 21~~

~~Text proposed by the Commission~~

~~Amendment~~

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter, including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case.

▌

~~Or. en~~

~~Amendment 26~~

~~Proposal for a regulation~~

~~Recital 22~~

~~Text proposed by the Commission~~

~~Amendment~~

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them, by receiving access to the administrative file.

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with the documents required to make their case effectively and to comment on the allegations made, by receiving access to the joint case file.

(22a) These rules should be without prejudice to the possibility for supervisory authorities to grant further access to the administrative file in order to hear further the views of any of the parties under investigation or of the complainant in the course of the proceedings, in accordance with national law.

~~Or. en~~

~~Amendment 27~~

~~Proposal for a regulation~~

~~Recital 23~~

~~Text proposed by the Commission~~

~~Amendment~~

(23) The preliminary findings define the scope of the investigation and therefore the scope of any future final decision (as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a) of Regulation (EU) 2016/679) which may be addressed to controllers or processors. The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties under investigation have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the Article 65(1), point (a), decision resolving the dispute between the supervisory authorities. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties under investigation in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of defence rights.

(23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

(23a) This regulation provides for rules where the lead supervisory authority is required by national law to further engage in subsequent domestic procedures related to the same case, such as administrative appeal proceedings.

~~Or. en~~

(24) The parties under investigation should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. New legal elements include relevant and reasoned objections where those objections contain legal assessments different from those proposed by the lead supervisory authority in the draft decision submitted pursuant to Article 60(4) of Regulation (EU) 2016/679.

~~Amendment 28~~

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt of the complaint does not bar the qualification of a data subject as complainant. ▌An investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor ▌is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are ▌not in the same procedural situation, and it is essential to safeguard the right of defence of the party under investigation. ▌The parties under investigation and the complainant can invoke the fundamental right ▌to be heard when the decision adversely affects their legal position

~~Proposal for a regulation~~

▌

~~Recital 24~~

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings to the extent that it relates to their complaint concerning the processing of their personal data. However, they should not have access to trade secrets or other confidential information belonging to other parties involved in the proceedings. ▌

~~Text proposed by the Commission~~

~~Amendment~~

(24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

~~Or. en~~

~~Amendment 29~~

~~Proposal for a regulation~~

~~Recital 25~~

~~Text proposed by the Commission~~

~~Amendment~~

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt the complaint does not bar the qualification of a data subject as complainant. However, an investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor does not constitute an adversarial procedure between the complainant and the parties under investigation. It is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are, therefore, not in the same procedural situation and the latter cannot invoke the right to a fair hearing when the decision does not adversely affect her or his legal position. The complainant’s involvement in the procedure against the parties under investigation cannot compromise the right of these parties to be heard.

~~Or. en~~

~~Amendment 30~~

~~Proposal for a regulation~~

~~Recital 26~~

~~Text proposed by the Commission~~

~~Amendment~~

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the administrative file.

~~deleted~~

~~Or. en~~

~~Amendment 31~~

~~Proposal for a regulation~~

~~Recital 27~~

~~Text proposed by the Commission~~

~~Amendment~~

(27) When setting deadlines for parties under investigation and complainants to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, in order to ensure that the parties under investigation and complainants have sufficient opportunity to meaningfully provide their views on the issues raised.

(27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to unduly long procedures.

~~Or. en~~

~~Amendment 32~~

~~Proposal for a regulation~~

~~Recital 28~~

~~Text proposed by the Commission~~

~~Amendment~~

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject. Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant and reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation.

~~deleted~~

~~Or. en~~

~~Justification~~

~~Unduly limits the options for concerned supervisory authorities to raise objections. Could be used against CSAs by controllers e.g. filing injunctions against objections.~~

~~Amendment 33~~

~~Proposal for a regulation~~

~~Recital 29~~

~~Text proposed by the Commission~~

~~Amendment~~

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length, should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

~~Or. en~~

~~Amendment 34~~

~~Proposal for a regulation~~

~~Recital 30~~

~~Text proposed by the Commission~~

~~Amendment~~

(30) Access to the administrative file is provided for as a part of the rights of defence and the right to good administration enshrined in the Charter. Access to the administrative file should be provided to the parties under investigation when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

~~(30) Access to the joint case file is provided for as a part of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties.~~

(31) When granting access to the administrative file to parties under investigation and the complainant, supervisory authorities should ensure the protection of trade secrets and other confidential information. The category of other confidential information includes information other than trade secrets, which may be considered as confidential in accordance with Union and national law, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. Confidential information shall in particular include information which is known only to a limited number of persons and which disclosure is liable to cause serious harm to the person who provided it or to third parties, and where the interests liable to be harmed by the disclosure of such information are, objectively, worthy of protection. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

~~Or. en~~

(32) Where trade secrets or other confidential information are necessary to prove an infringement, the supervisory authorities should assess for each individual document in a proportionate manner whether the need to disclose is greater than the harm which might result from disclosure.

~~Amendment 35~~

(32a) Access to documents included in the administrative file on the basis of access to public documents is to be provided in accordance with Member States law. In this regard, it is important that the integrity of the decision-making process is protected until the final decision is adopted by the competent supervisory authority.

~~Proposal for a regulation~~

(32b) It is important that the Board facilitate access to decisions adopted in accordance with the cooperation and consistency mechanisms, by making the text of the final decisions adopted by national supervisory authorities available online through easily accessible registers. In accordance with applicable national law, supervisory authorities can redact names, any other information that allows for the identification of parties under investigation or the complainant, and other information that is protected under applicable Union and national law.

~~Recital 31~~

(32c) It is important that the provision to the complainant of a version of the final decision in accordance with this Regulation remains without prejudice to the possibility for a supervisory authority to decide whether to make the decision public as part of its corrective powers.

~~Text proposed by the Commission~~

(33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents, ▌the Chair of the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

~~Amendment~~

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in a way which allows the lead supervisory authority to adopt its final decision on the basis of the decision of the Board ▌.

(31) When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(35) In order to streamline the resolution of disputes between supervisory authorities submitted to the Board under Article 65(1), points (b) and (c), of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the documents to be submitted to the Board and on which the Board should base its decision. It is also necessary to specify when the Board should register the submission of the matter to dispute resolution.

(31) When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

~~Or. en~~

▌

~~Amendment 36~~

(36a) Regulation (EU) 2016/679 provides that the data subject has a right to an effective judicial remedy where a competent supervisory authority does not handle a complaint. This Regulation does not create new judicial remedies in addition to the ones already established by Regulation (EU) 2016/679, nor does it limit the application of the judicial remedies established by that Regulation. Certain provisions of this Regulation have particular importance for the timely delivery of the final decision by the supervisory authorities when handling complaints. When deciding whether a supervisory authority has handled a complaint, consideration should be given to whether certain time limits laid down in this Regulation and in Regulation (EU) 2016/679 were met by the supervisory authority. In making that determination it is essential to safeguard the right of the complainant to have his or her complaint handled within a reasonable time. The provisions of this Regulation are without prejudice to the possibility of foreseeing remedies in national law for the party under investigation, in view of their right to have their affairs handled within a reasonable time.

~~Proposal for a regulation~~

(37) Chapters III and IV concern cooperation between supervisory authorities, the procedural rights of parties under investigation and the involvement of complainants. To ensure legal certainty, those provisions should not apply to investigations already under way at the time this Regulation enters into force. They should apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation. Chapter V provides procedural rules for cases submitted to dispute resolution under Article 65 of Regulation (EU) 2016/679. Also for reasons of legal certainty, this Chapter should not apply to cases that have been submitted to dispute resolution prior to the entry into force of this Regulation. It should apply to all cases submitted to dispute resolution after the entry into force of this Regulation.

~~Recital 33~~

(37a) The implementation of the Regulation requires adequate digital tools supporting the rapid and secure exchange of information. It is important that an appropriate secure common electronic tool be available for all data protection authorities, taking into account the experience gained in using the existing tools. It is also important that resources needed for the implementation of such an electronic tool be provided and that such tool facilitate the collection and consolidation of enforcement statistics on cross-border cases by the Board.

~~Text proposed by the Commission~~

~~Amendment~~

(33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents listed in Article 23, the Chair of the Board should register the referral of the subject-matter in the sense of Article 65(2) of Regulation (EU) 2016/679.

(33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents, the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

~~Or. en~~

~~Justification~~

~~One does not refer to Articles in Recitals, because the Recitals are supposed to lead to the Articles later.~~

~~Amendment 37~~

~~Proposal for a regulation~~

~~Recital 34~~

~~Text proposed by the Commission~~

~~Amendment~~

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

~~Or. en~~

~~Justification~~

~~Board decisions in dispute resolution are binding on the authorities.~~

~~Amendment 38~~

~~Proposal for a regulation~~

~~Recital 36~~

~~Text proposed by the Commission~~

~~Amendment~~

(36) In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board.

~~Or. en~~

~~Justification~~

~~EDPB para 120.~~

~~Amendment 39~~

~~Proposal for a regulation~~

~~Recital 36 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(36a) Where, after its deliberations, the Board is unable to determine the matter, because the joint case file and other information provided by the lead supervisory authority are not complete, the Board should be able to request further information from the parties or supervisory authorities, or conduct further factual investigations.

~~Or. en~~

~~Amendment 40~~

~~Proposal for a regulation~~

~~Recital 36 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(36b) The Board should be able to delegate certain tasks to one or more select committees, which can consist of members of the Board or members of the secretariat referred to in Article 75 of Regulation (EU) 2016/679. It should be possible for this delegation to include any task under Article 70 of Regulation (EU) 2016/679, decisions under Article 65 and 66 of Regulation (EU) 2016/679 or functions of the Board under this Regulation, such as routine tasks or decisions that need to be taken without delay, including any procedural determinations.

~~Or. en~~

~~Justification~~

~~Linked to Articles 26a (new), 26b (new).~~

~~Amendment 41~~

~~Proposal for a regulation~~

~~Recital 36 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(36c) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board.

~~Or. en~~

~~Justification~~

~~Linked to Article 26c (new).~~

~~Amendment 42~~

~~Proposal for a regulation~~

~~Recital 38~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(38) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on [ ],~~

(38) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on 19 September 2023,

~~Or. en~~

HAVE ADOPTED THIS REGULATION:

~~Amendment 43~~

Chapter I General provisions

~~Proposal for a regulation~~

Section 1a Subject matter, scope, and definitions

~~Chapter I – Section 1 (new)~~

Article 1 Subject matter and scope

~~Text proposed by the Commission~~

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the ▌enforcement of Regulation (EU) 2016/679 for cross-border processing, including the determination of whether a case relates to cross-border processing.

~~Amendment~~

Article 2 Definitions

~~Section 1~~

For the purposes of this Regulation the definitions in Article 4 of Regulation (EU) 2016/679 shall apply.

~~Subject matter, scope and definitions~~

The following definitions shall also apply:

~~Or. en~~

(1) ‘party under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;

~~Amendment 44~~

(2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned, identifying the main relevant factual and legal issues and the lead supervisory authority’s factual and legal views on the case.

~~Proposal for a regulation~~

▌

~~Article 1 – title~~

Article 2a Principles relating to the procedures in the enforcement of Regulation (EU) 2016/679 for cross-border processing

~~Text proposed by the Commission~~

1. Supervisory authorities shall conduct procedures in an expedient and efficient way and shall cooperate with each other in a sincere and effective manner, including by providing support where necessary and responding to requests without delay.

~~Amendment~~

2. A supervisory authority may join and separate proceedings in accordance with national procedural law, insofar as this does not undermine the rights of the parties under investigation and the complainant.

~~Subject matter~~

3. A complainant shall have the possibility to communicate exclusively with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679.

~~Subject matter and scope~~

4. The handling of a complaint shall always lead to a decision that is subject to an effective legal remedy within the meaning of Article 78 of Regulation (EU) 2016/679.

~~Or. en~~

5. In the interest of efficiency of the procedures, supervisory authorities may limit the length of the submission by the party under investigation and the complainant, taking into account the complexity of the case and the documents submitted so far.

~~Amendment 45~~

▌

~~Proposal for a regulation~~

Chapter II Submission ▌of complaints and early resolution

~~Article 1 – paragraph 1~~

Article 3 Complaints concerning cross-border processing

~~Text proposed by the Commission~~

1. A complaint on the basis of Regulation (EU) 2016/679 concerning cross-border processing shall be admissible provided that it includes the following information:

~~Amendment~~

(a) name of person or entity lodging the complaint;

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

(b) where the complaint is lodged by a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, proof that the body, organisation or association has been properly constituted in accordance with the law of a Member State;

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities related to the cross-border processing in the meaning of Regulation (EU) 2016/679.

(c) where the complaint is lodged on the basis of Article 80(1) of Regulation (EU) 2016/679, name of the body, organisation or association, contact details and proof that the body, organisation or association lodging the complaint is acting on the basis of the mandate of a data subject;

~~Or. en~~

(d) contact details of the person or entity lodging the complaint;

~~Justification~~

(e) information which facilitates the identification of the controller or processor which is the subject of the complaint;

~~EDPB wording suggestion – “cross-border enforcement” is not defined in GDPR. EDPB, introduction, p.7.~~

(f) description of the alleged infringement of Regulation (EU) 2016/679.

~~Amendment 46~~

Only information referred to in the first subparagraph shall be required in order for the complaint relating to cross-border processing to be admissible.

~~Proposal for a regulation~~

Administrative modalities and requirements under the national procedural law of the supervisory authority with which the complaint is lodged shall continue to apply.

~~Article 1 – paragraph 1 a (new)~~

-1a. Where the supervisory authority with which a complaint has been lodged determines that the complaint does not contain the information referred to in paragraph 1, it shall, within two weeks of receiving the complaint, declare the complaint inadmissible and inform the complainant about the reasons thereof.

~~Text proposed by the Commission~~

1a. Without prejudice to the admissibility of a complaint, supervisory authorities may ask the submission of supplementary information by the complainant in order to facilitate the handling of the complaint and enable the full investigation of the case.

~~Amendment~~

1b. The complainant shall not be required to contact the party under investigation before lodging a complaint in order for that complaint to be admissible. Without prejudice to the admissibility of the complaint, where the complaint relates to the exercise of a right of the data subject which relies on a request to be submitted to the data controller by the data subject concerned, such request shall be made to the controller before the submission of the complaint.

This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

2. The supervisory authority with which the complaint was lodged shall determine, by way of a preliminary conclusion, whether the complaint relates to cross-border processing, which supervisory authority is assumed to act as a lead supervisory authority in accordance with Article 56(1) of Regulation (EU) 2016/679, and if Article 56(2) of Regulation (EU) 2016/679 applies.

~~Or. en~~

2a. The lead supervisory authority shall without delay inform the party under investigation about the lodging of a complaint and of its main elements.

~~Amendment 47~~

▌

~~Proposal for a regulation~~

4. Where a complaint that relates to cross-border processing is admissible, in the absence of early resolution pursuant to Article 5, the supervisory authority with which the complaint was lodged shall transmit the complaint to the presumed lead supervisory authority and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority.

~~Article 1 – paragraph 1 b (new)~~

4a. The supervisory authority with which the complaint has been lodged shall transmit the complaint to the assumed lead supervisory authority no later than six weeks from receiving the complaint, after having concluded the assessment of admissibility of the complaint, that the case concerns cross-border processing and the determination as to the presumed lead supervisory authority.

~~Text proposed by the Commission~~

4b. Within six weeks after receipt of the complaint, the assumed lead supervisory authority shall either confirm its competence or, where there are conflicting views on which supervisory authorities concerned is competent for the main establishment, refer the subject-matter to the Board for dispute resolution under Article 65(1), point (b) of Regulation (EU) 2016/679.

~~Amendment~~

Where the lead supervisory authority does not confirm its competence or refer the subject-matter to the Board within the time limit referred to in the first subparagraph, the supervisory authority with which the complaint has been lodged shall refer the subject-matter to the Board.

~~Article 26c of this Regulation also applies to cases before a supervisory authority of a single Member State.~~

▌

~~Or. en~~

Article 5 Early resolution

~~Amendment 48~~

1. A complaint relating to cross-border processing which concerns the exercise of the rights of the data subject under Chapter III of Regulation (EU) 2016/679, may be resolved, where appropriate, through a procedure allowing for its early resolution by:

~~Proposal for a regulation~~

(a) the supervisory authority with which the complaint was lodged, after determining by way of preliminary conclusion that the complaint relates to cross-border processing and prior to the possible transmission of the complaint to the lead supervisory authority; or

~~Article 1 – paragraph 1 c (new)~~

(b) the lead supervisory authority to which the complaint has been transmitted, at any time before the submission of the preliminary findings to supervisory authorities concerned pursuant to Article 14 of this Regulation, or, where the simple procedure referred to in Article 6bis applies, before the submission of the draft decision.

~~Text proposed by the Commission~~

Supervisory authorities may encourage and facilitate such early resolution and communicate with the controller or the complainant for this purpose, as appropriate.

~~Amendment~~

2. For the purpose of early resolution, a complaint shall be considered devoid of purpose where the supervisory authority has established, based on supporting evidence, that the alleged infringement has been brought to an end.

~~This Regulation does not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.~~

3. The supervisory authority shall inform the complainant of the finding under paragraph 2 and of the consequences of the early resolution, using clear and plain language, including of the possibility that he or she may submit an objection within four weeks of receiving such information.

~~Or. en~~

4. In a procedure before the supervisory authority with which the complaint was lodged, where the complainant does not object within the deadline set out in paragraph 3, the supervisory authority shall establish that the complaint has been resolved and inform the complainant and the party under investigation within two weeks, and, where applicable, the lead supervisory authority thereof.

~~Amendment 49~~

5. In a procedure before the lead supervisory authority to which the complaint has been transmitted, where the complainant does not object within the deadline set out in paragraph 3, the authority shall submit a draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 within four weeks, with a view to adopting a final decision in accordance with Article 60(7) of Regulation (EU) 2016/679 establishing that the complaint has been resolved.

~~Proposal for a regulation~~

6. The early resolution of a complaint shall be without prejudice to the exercise by the lead supervisory authority of its powers in accordance with Article 58 of Regulation (EU) 2016/679on the same subject-matter.

~~Article 2 – paragraph 2 – point 1~~

7. Articles 9 to 15 of this Regulation do not apply to complaint-based cases resolved pursuant to this Article.

~~Text proposed by the Commission~~

▌

~~Amendment~~

Chapter III Cooperation under Article 60 of Regulation (EU) 2016/679

~~(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;~~

Section 1 Simple cooperation

~~(1) ‘party under investigation’ means the controller(s) and/or processor(s) accused of, or investigated for, alleged infringement of Regulation (EU) 2016/679;~~

Article 6bis Simple cooperation procedure

~~Or. en~~

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it may cooperate with supervisory authorities concerned through a simple cooperation procedure, in accordance with this Article, where:

~~Amendment 50~~

(a) the lead supervisory authority considers that no reasonable doubt exists as to the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which are to be investigated; and

~~Proposal for a regulation~~

(b) the legal and factual issues identified by the lead supervisory authority do not require additional cooperation between supervisory authorities for the purpose of a complex investigation, in particular where they can be addressed based on previous decisions in similar cases.

~~Article 2 – paragraph 2 – point 1 a (new)~~

In such a case, Articles 9, 10, 11, 14, 15, 18(1), points (a) and (b) and Article 18(2) of this Regulation shall not apply, and the lead supervisory authority shall submit a draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 within the time limit referred to in Article 10a(6), of this Regulation.

~~Text proposed by the Commission~~

2. The lead supervisory authority shall notify the supervisory authorities concerned of its intention to apply the simple cooperation procedure, providing information on the characteristics of the case relevant to establishing the conditions set out in paragraph 1, no later than within six weeks from the confirmation of its competence pursuant to Article 3, (4a) of this Regulation or after a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.

~~Amendment~~

3. Where any of the supervisory authorities concerned objects to the application of the simple cooperation procedure, within two weeks after having been notified of it, this procedure shall not apply and the lead supervisory authority shall draft a summary of key issues in accordance with Article 9 of this Regulation and cooperate under the procedures pursuant to Chapter III of this Regulation.

~~(1a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679;~~

4. When applying the procedure referred to in paragraph 1, the lead supervisory authority shall, prior to the submission of a draft decision, ensure that, where applicable, the parties under investigation are provided with the right to be heard and the complainant is provided with an opportunity to make his or her views known. For the purpose of this paragraph, administrative modalities and requirements under national procedural law of the lead supervisory authority, or the supervisory authority with which the complaint has been lodged, where applicable, shall continue to apply.

~~Or. en~~

5. Chapter III does not apply to cases handled by the concerned supervisory authority pursuant to Article 56, (2) of Regulation (EU) 2016/679.

~~Justification~~

Section 1a Reaching consensus within the meaning of Article 60(1) of Regulation (EU) 2016/679

~~EDPB para 155.~~

Article 6b Conferral or limitation of rights

~~Amendment 51~~

The provisions in this section concern the cooperation between supervisory authorities and do not confer or limit rights on individuals or the parties under investigation.

~~Proposal for a regulation~~

Article 7 Cooperation between supervisory authorities

~~Article 2 – paragraph 2 – point 1 b (new)~~

While cooperating in an endeavour to reach a consensus, as provided for in Article 60(1) of Regulation (EU) 2016/679, supervisory authorities shall use all the means provided for in Regulation (EU) 2016/679, including mutual assistance pursuant to Article 61 and joint operations pursuant to Article 62 of Regulation (EU) 2016/679.

~~Text proposed by the Commission~~

▌

~~Amendment~~

Article 8 Relevant information to be exchanged between the lead supervisory authority and supervisory authorities concerned within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679

~~(1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case where foreseen under Member State law;~~

1. The lead supervisory authority and the supervisory authorities concerned shall exchange relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679.

~~Or. en~~

2. ▌Information referred to in paragraph 1 shall include, where applicable:

~~Amendment 52~~

~~Proposal for a regulation~~

~~Article 2 – paragraph 2 – point 1 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(1c) ‘national procedural law’ means the laws or other rules of the Member State that regulate the procedure before a supervisory authority;~~

~~Or. en~~

~~Amendment 53~~

~~Proposal for a regulation~~

~~Article 2 – paragraph 2 – point 1 d (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(1d) ‘complaints procedure’ means an adversarial procedure determining a complaint under Article 77 of Regulation (EU) 2016/679;~~

~~Or. en~~

~~Amendment 54~~

~~Proposal for a regulation~~

~~Article 2 – paragraph 2 – point 1 e (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1)(a) of Regulation (EU) 2016/279;

~~Or. en~~

~~Amendment 55~~

~~Proposal for a regulation~~

~~Article 2 – paragraph 2 – point 1 f (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(1f) ‘internal deliberations’ means any preliminary view, opinion, comment or exchange within or between the supervisory authorities or the Board, such as the summary of key issues, comments on the summary of key issues, draft decisions or relevant and reasoned objections under Article 60(3) to (5) of Regulation (EU) 2016/679;

~~Or. en~~

~~Amendment 56~~

~~Proposal for a regulation~~

~~Article 2 – paragraph 2 – point 1 g (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(1g) ‘joint case file’ means a dedicated electronic file for any given case, managed by the lead supervisory authority, in which all documents, submissions, memos and other information regarding a case are stored and made remotely accessible to supervisory authorities and parties to the case;

~~Or. en~~

~~Amendment 57~~

~~Proposal for a regulation~~

~~Section 2 (new) – Article 2 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Section 2~~

~~Procedural Rules~~

~~Article 2a~~

~~Applicable Procedural Law~~

(1) In addition to, and where not conflicting with this Regulation, the applicable procedural law of a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. When applying national procedural law, supervisory authorities shall strive to facilitate the participation of all parties, including parties established or residing in other Member States.

~~(2) Regulation (EU) 2016/679 and this Regulation govern the interaction between supervisory authorities of different Member States within the scope of this Regulation.~~

~~(3) Any complainant has the right to communicate solely with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679.~~

(4) The interaction and sharing of information between supervisory authorities as well as between supervisory authorities and the Board shall be neither restricted nor prohibited under national law. Cooperation under this Regulation and Regulation (EU) 2016/679 and the consistent application of those regulations shall not be limited, delayed or denied based on differences in national procedural laws.

~~Or. en~~

~~Amendment 58~~

~~Proposal for a regulation~~

~~Article 2 b – title (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 2b~~

~~Procedural Minimum Standards~~

~~Or. en~~

~~Justification~~

~~Following from Article 6 ECHR and Article 41 CFR, as confirmed by CJEU in Case C-277/11.~~

~~Amendment 59~~

~~Proposal for a regulation~~

~~Article 2 b – paragraph 1 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(1) Without prejudice to additional rights under relevant national procedural law, each party shall have at least the right to:~~

(a) have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure and equality of arms”);

~~(b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (“right to be heard”);~~

~~(c) have access to the joint case file, except to any internal deliberations (“procedural transparency”);~~

~~Or. en~~

~~Amendment 60~~

~~Proposal for a regulation~~

~~Article 2 b – paragraph 2 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(2) The lead supervisory authority shall hear the parties when novel issues arise during the procedures under Article 60, 65 or 66 of Regulation (EU) 2016/679.~~

~~Or. en~~

~~Justification~~

See Article 18(a)(a). This would ensure that if a CSA brings totally new issues up in a “reasoned objection” the parties are still heard – but only if that is the case, not as a default in all the “normal” cases.

~~EDPB, para 92~~

~~Amendment 61~~

~~Proposal for a regulation~~

~~Article 2 b – paragraph 3 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(3) On the request of a party or in the public interest, a supervisory authority may limit the rights referred to in paragraph 1 and 2 to protect legally recognized rights of others or to protect the public interest. Any such limitation shall be in accordance with the national procedural law applicable under Article 2a(1) to any direct interaction between a supervisory authority and the party receiving limited information. The party claiming confidentiality shall provide a non-confidential version of any information, applying only strictly proportionate measures, such as redacting specific parts of documents. Supervisory authorities involved in a case, as well as other relevant authorities under Article 7(1a), shall always have access to the confidential version of all information, and shall confirm that redactions are strictly proportionate and may otherwise release the information. Supervisory authorities shall immediately inform the parties about the fact that information is withheld. The lead supervisory authority shall keep records of each access to the joint case file and a list of authorised staff from each supervisory authority.

~~Or. en~~

~~Justification~~

~~“... national procedural law” In line with wording suggestion from EDPB. “always have access to the confidential version” from EDPB para 68.~~

~~Amendment 62~~

~~Proposal for a regulation~~

~~Article 2 b – paragraph 4 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(4) In the interest of efficient procedures, supervisory authorities shall limit the length of submissions and set reasonable deadlines not longer than four weeks, unless exceptional circumstances require a reasonable extension..

~~Or. en~~

~~Justification~~

Especially large law firms of big tech companies try to “bury” cases in endless submissions that neither SAs nor the other parties are able to process. The Regulation should follow the approach by the CJEU where page limitations and short deadlines lead to focused submissions.

~~Amendment 63~~

~~Proposal for a regulation~~

~~Article 2 c – title (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 2c~~

~~Cooperation between supervisory authorities~~

~~Or. en~~

~~Amendment 64~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 1 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

1. The lead supervisory authority shall structure, coordinate and manage the case in an efficient and expedient way, in accordance with Regulation (EU) 2016/679, this Regulation and any applicable national procedural law, ensuring that Regulation (EU) 2016/679 is fully enforced.

~~Or. en~~

~~Amendment 65~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 2 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

2. The lead supervisory authority shall manage each case in full cooperation with the supervisory authorities concerned, and shall comply with any request of a supervisory authority under this Regulation and Articles 60 to 62 of Regulation (EU) 2016/679. Any supervisory authority may declare that it is concerned and participate in the case from that point onwards.. The lead supervisory authority shall maintain a list of supervisory authorities concerned for each case in the joint case file.

~~Or. en~~

~~Amendment 66~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 3 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

3. Any supervisory authority which receives relevant information for a case shall provide it to the lead supervisory authority without delay, but no later than one week from the day that it received such information.

~~Or. en~~

~~Amendment 67~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 4 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~4. The lead supervisory authority may join and separate cases in accordance with national procedural law, insofar as this does not undermine the rights of the parties.~~

~~Or. en~~

~~Justification~~

~~Generally recognizing this option would ensures legal certainty, especially in Member States where there is no procedural law.~~

~~EDPB, para 50.~~

~~Amendment 68~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 5 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

5. The lead supervisory authority shall include all documents, submissions, memos and other information regarding the case in a joint case file without delay, but no later than one week from the day in which the lead supervisory authority received such information. Any other supervisory authority and the Board shall have instant remote access to the joint case file.

~~Or. en~~

~~Amendment 69~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 6 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

6. When diverging views arise or are to be expected, for example when a case is considered as contentious under Article 9, the lead supervisory authority shall instantly initiate an exchange with all concerned supervisory authorities with an aim to reach an early consensus or narrow areas of disagreement. The lead supervisory authority shall investigate facts relevant for diverging views.

~~Or. en~~

~~Amendment 70~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 7 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

7. Supervisory authorities shall use their powers under this Regulation and under Chapter VII of Regulation (EU) 2016/679 if diverging views cannot be overcome or in the case of inactivity of another supervisory authority.

~~Or. en~~

~~Justification~~

~~Active duty to take action under Articles 60 to 66 GDPR when another SA does not fulfill its duties for cooperation. Otherwise parties are left in limbo.~~

~~EDPB, para 120.~~

~~Amendment 71~~

~~Proposal for a regulation~~

~~Article 2 c – paragraph 8 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~8. All written documents by the supervisory authorities shall be provided by electronic means and in a concise, transparent, intelligible and easily accessible form, using clear and plain language.~~

~~Or. en~~

~~Justification~~

The principle to use short, concise, transparent (…) documents is taken from various duties for CSAs in the proposal and elevated to a general principle (also applicable to the LSA). Text is taken from Article 12 GDPR

~~Amendment 72~~

~~Proposal for a regulation~~

~~Article 2 d – title (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 2d~~

~~Use of Languages and Translations~~

~~Or. en~~

~~Justification~~

~~Amended version of Article 6 moved here, to ensure that the rules on translations apply to any type of procedure, not only to complaints procedures.~~

~~Amendment 73~~

~~Proposal for a regulation~~

~~Article 2 d – paragraph 1 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation procedure (“cooperation language”) .~~

~~Or. en~~

~~Amendment 74~~

~~Proposal for a regulation~~

~~Article 2 d – paragraph 2 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts.

~~Or. en~~

~~Justification~~

The “any other language” ensures that information is shared as soon as it is available. The information would still have to be translated into the cooperation language, once it goes into the joint case file.

~~Amendment 75~~

~~Proposal for a regulation~~

~~Article 2 d – paragraph 3 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~3. The lead supervisory authority shall provide entries into the joint case file in the original language, and shall provide translations into the cooperation language.~~

~~Or. en~~

~~Amendment 76~~

~~Proposal for a regulation~~

~~Article 2 d – paragraph 4 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication.

~~Or. en~~

~~Justification~~

~~See same rule in Article 12 of Regulation 2020/1784, Service of Documents Regulation.~~

~~Amendment 77~~

~~Proposal for a regulation~~

~~Article 2 d – paragraph 5 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~5. A supervisory authority may provide automated translations, if they certify that the translation is not substantially different from the original.~~

~~Or. en~~

~~Justification~~

~~The existing practice of automated translations should be regulated, by demanding a certification that the contents are (at the core) correct.~~

~~Amendment 78~~

~~Proposal for a regulation~~

~~Article 2 d – paragraph 6 (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State of jurisdiction.

~~Or. en~~

~~Amendment 79~~

~~Proposal for a regulation~~

~~Chapter II – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Submission and handling of complaints~~

~~Complaints and ex officio procedures~~

~~Or. en~~

~~Amendment 80~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

1. A complaint that is potentially subject to Article 60 of Regulation (EU) 2016/679 shall comply with the requirements of national procedural law applicable to the supervisory authority with which the complaint has been lodged and shall provide the following minimum information:

~~(a) the name, address and any other available contact details of the complainant,~~

~~(b) if known, the name, address and any other contact details of the party under investigation,~~

~~(c) the facts of the case and any evidence available to the complainant,~~

~~(d) the measures that the complainant demands from the supervisory authority.~~

No additional information shall be required in order for the complaint to be admissible. In particular, complainants shall not be required to use a national electronic ID or e-government system to submit the complaint.

~~Or. en~~

~~Justification~~

Instead of a mandatory form, there should be minimum requirements to ensure that the complaint can be processed by the LSA. We recognize possible additional requirements under national law and the fact that in some cases, a data subject may not know or understand all details of a case. EDPB, para 23. Complainants shall not be required to use a national electronic ID to prevent the undue restriction of the manner in which to submit a complaint in cases where the data subject may not be aware whether the case relates to cross-border processing, and to align the Reg. with recital 141 GDPR.

~~Amendment 81~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 1 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~1a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.~~

~~Or. en~~

~~Justification~~

~~To prevent the undue rejection of complaints as observed in the practice of various DPAs.~~

~~Amendment 82~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 1 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

1b. The supervisory authority with which a complaint has been lodged shall, within one week, acknowledge receipt of the complaint, and where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

~~Or. en~~

~~Justification~~

~~Moved up from paragraph 6, to follow the sequence of events.~~

~~Amendment 83~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 1 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

1c. The supervisory authority shall attribute a case number to the complaint, designate a case handler and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c)(i).

~~Or. en~~

~~Justification~~

~~To facilitate communication between the CSA with which the complaint is lodged and the complainant.~~

~~Amendment 84~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2~~

~~Text proposed by the Commission~~

~~Amendment~~

~~2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.~~

~~2. The supervisory authority with which the complaint has been lodged shall, within three weeks after receipt of the complaint:~~

~~Or. en~~

~~Justification~~

Combining the steps in paragraphs 2 to 4 into one paragraph to ensure that all steps are under the three week deadline. The three weeks is parallel to Article 56(3) GDPR, and has been moved here from the end of the paragraph, to make clear everything shall be done within three weeks.. Additional wording from EDPB suggestions.

~~Amendment 85~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(a) determine the admissibility of the complaint,~~

~~Or. en~~

~~Amendment 86~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(b) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing,~~

~~Or. en~~

~~Amendment 87~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(c) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

~~Or. en~~

~~Amendment 88~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point d (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(d) draft a summary of key issues, and~~

~~Or. en~~

~~Amendment 89~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point e (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(e) either~~

~~Or. en~~

~~Amendment 90~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point e – point i (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(i) transmit the complaint to the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679 and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority;

~~Or. en~~

~~Justification~~

~~To provide clarification on the mutual recognition of complaints. EDPB, para 24.~~

~~Amendment 91~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point e – point ii (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(ii) handle the complaint under Article 56(2) of Regulation (EU) 2016/679; or~~

~~Or. en~~

~~Amendment 92~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 – point e – point iii (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(iii) inform the complainant that he or she can resubmit the complaint, naming any missing information.~~

~~Or. en~~

~~Amendment 93~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

2a. The lead supervisory authority shall immediately provide the complaint to the party under investigation and demand a reply without undue delay, but no later than three weeks from the day it was informed by the supervisory authority concerned.

~~Or. en~~

~~Amendment 94~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

2b. The parties or the assumed lead supervisory authority shall raise any objection in relation to the competence of the assumed lead supervisory authority or to the handling of a complaint under Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the transmission of the complaint to the assumed lead supervisory authority or the lack of such a transmission.

~~Or. en~~

~~Amendment 95~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 2 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were undertaken, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a.

~~Or. en~~

~~Justification~~

~~Related to Article 26a~~

~~Amendment 96~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 3~~

~~Text proposed by the Commission~~

~~Amendment~~

~~3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Merged into paragraph 2.~~

~~Amendment 97~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 4~~

~~Text proposed by the Commission~~

~~Amendment~~

4. Upon assessment of the completeness of the information required by the Form, the supervisory authority with which the complaint was lodged shall transmit the complaint to the lead supervisory authority.

~~deleted~~

~~Or. en~~

~~Justification~~

~~Merged into paragraph 2.~~

~~Amendment 98~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 5~~

~~Text proposed by the Commission~~

~~Amendment~~

~~5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also submit a non-confidential version of the complaint.~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Covered by new horizontal rule on confidentiality in Article 2b(3).~~

~~Amendment 99~~

~~Proposal for a regulation~~

~~Article 3 – paragraph 6~~

~~Text proposed by the Commission~~

~~Amendment~~

6. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

~~deleted~~

~~Or. en~~

~~Justification~~

~~Moved up to paragraph 1a, to follow the chronological order of events.~~

~~Amendment 100~~

~~Proposal for a regulation~~

~~Article 4 – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Investigation of complaints~~

~~Handling of complaints~~

~~Or. en~~

~~Amendment 101~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 – introductory part~~

~~Text proposed by the Commission~~

~~Amendment~~

While assessing the extent appropriate to which a complaint should be investigated in each case the supervisory authority shall take into account all relevant circumstances, including all of the following:

~~While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall ensure the following:~~

~~Or. en~~

~~Amendment 102~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 – point a~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(a) the expediency of delivering an effective and timely remedy to the complainant;~~

~~(a) the delivery of an effective and timely remedy to the complainant;~~

~~Or. en~~

~~Amendment 103~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 – point b~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(b) the gravity of the alleged infringement;~~

~~(b) the investigation of all factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7) to (9) of Regulation (EU) 2016/679;~~

~~Or. en~~

~~Amendment 104~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 – point c~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(c) the systemic or repetitive nature of the alleged infringement.~~

(c) the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemic or repetitive infringements.

~~Or. en~~

~~Amendment 105~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.~~

~~Or. en~~

~~Justification~~

Each complaint must lead to an appealable decision. This will prevent situations where complaints are “closed” without an appealable decision. “Handling of complaints” is from Article 78(2) GDPR and ensures deadlines are met. EDPB, para 29.

~~Amendment 106~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 b – introductory part (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~The lead supervisory authority shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, but not later than nine months from the receipt of the complaint.~~

~~This period may exceptionally be prolonged by:~~

~~Or. en~~

~~Amendment 107~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 b – point a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(a) eight weeks when comments under Article 9(3) are submitted against a summary of key issues or an updated summary of key issues;~~

~~Or. en~~

~~Amendment 108~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 b – point b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(b) the period of time between a reference under Article 26a and the decision by the Board;~~

~~Or. en~~

~~Justification~~

~~Linked to Article 26a.~~

~~Amendment 109~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 b – point c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(c) the period of any prolongation permitted by the Board under Article 26a(3).~~

~~Or. en~~

~~Justification~~

~~Linked to Article 26a.~~

~~Amendment 110~~

~~Proposal for a regulation~~

~~Article 4 – paragraph 1 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Paragraph 1b shall not apply once a case is submitted to the consistency mechanism in accordance with Article 60(4) of Regulation (EU) 2016/679.~~

~~Or. en~~

~~Amendment 111~~

~~Proposal for a regulation~~

~~Article 5 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

1. A complaint may be resolved by amicable settlement only where it concerns the data subjects’ rights and where with the resolution of the dispute by an amicable settlement, the processing which the complaint related to is no longer taking place.

~~Or. en~~

~~Justification~~

~~EDPB para 32. See also EDPB Guidelines 06/2022 on amicable settlements.~~

~~Amendment 112~~

~~Proposal for a regulation~~

~~Article 5 – paragraph 1 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it. Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

~~Or. en~~

~~Justification~~

~~EDPB para 33, clarification which SA is in charge when. Joint communication by the parties ensures it is the free will of the complainant.~~

~~Amendment 113~~

~~Proposal for a regulation~~

~~Article 5 – paragraph 1 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~1b. The supervisory authority is not bound by the amicable settlement. It shall in particular open an ex officio investigation instead, where~~

~~(a) the party under investigation is a repeat offender,~~

~~(b) the party under investigation has been the subject of a large number of other amicable settlements,,~~

~~(c) the broad subject matter of the complaint concerns a large number of data subjects other than the complainant; or~~

~~(d) the consequence of the processing which has been subject to the complaint is of long duration or serious nature.~~

~~Or. en~~

~~Justification~~

~~A dispute settlement between two parties is usually seen as a contract between these parties, not an act between a party and an authority. EDPB, para 32.~~

~~Amendment 114~~

~~Proposal for a regulation~~

~~Article 5 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 5a~~

~~Request for an ex officio procedure~~

~~1. The lead supervisory authority may open an ex officio procedure at any time.~~

2. Where it considers that Regulation (EU) 2016/679 may be violated, any concerned supervisory authority may request an ex officio procedure by submitting a written request to the lead supervisory authority. Such a request shall contain at least:

~~(a) a declaration to be a concerned supervisory authority;~~

~~(b) any evidence of the violation;~~

~~(c) a summary of key issues pursuant to Article 9;~~

~~3. Within three weeks, the assumed lead supervisory authority shall:~~

~~(a) inform the concerned supervisory authority that it has opened an ex officio procedure.;~~

(b) inform the concerned supervisory authority that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself in line ; or

~~(c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no violation of Regulation (EU) 2016/679.~~

In the case referred to in point (a) of this paragraph, the concerned supervisory authority may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679

In the case referred to in point (c) of this paragraph, the concerned supervisory authority may resubmit an amended request for an ex officio procedure, or request a determination on the opening of the procedure by the Board under Article 26a(1).

~~Or. en~~

~~Justification~~

~~Deadline of three weeks in para 3 from Article 56 GDPR.~~

~~Amendment 115~~

~~Proposal for a regulation~~

~~Article 6~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 6~~

~~deleted~~

~~Translations~~

~~1. The supervisory authority with which the complaint was lodged shall be responsible for:~~

~~(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;~~

(b) translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

2. In its rules of procedure, the Board shall determine the procedure for the translation of comments or relevant and reasoned objections expressed by supervisory authorities concerned in a language other than the language used by the lead supervisory authority for the purposes of the investigation.

~~Or. en~~

~~Justification~~

~~Moved to Article 2d, as the matter of translations does not only concern complaints procedures but any form of cooperation.~~

~~Amendment 116~~

~~Proposal for a regulation~~

~~Article 7 – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Cooperation between supervisory authorities~~

~~Cooperation between supervisory authorities and between supervisory authorities and other relevant authorities~~

~~Or. en~~

~~Amendment 117~~

~~Proposal for a regulation~~

~~Article 7 – paragraph 1 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

Supervisory authorities shall strive to communicate the information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in other areas, including competition, financial services, energy, telecommunications and consumer protection authorities, where the information is deemed relevant to the tasks and duties of those authorities.

~~Or. en~~

~~Justification~~

~~Recognising that investigation on infringements in the area of data protection might provide evidence on infringements in other areas. This is a demand from many civil society organisations.~~

~~Amendment 118~~

~~Proposal for a regulation~~

~~Article 7 – paragraph 2~~

~~Text proposed by the Commission~~

~~Amendment~~

~~The provisions in this section concern the relations between supervisory authorities and are not intended to confer rights on individuals or the parties under investigation.~~

~~deleted~~

~~Or. en~~

~~Justification~~

If the parties cannot bring a claim in national courts over the lack of cooperation, this would in many cases make Article 78 GDPR inefficient if the “problem” for a missing decision lies in the lack of cooperation and cannot be tackled by the parties. EDPB, para 29.

~~Amendment 119~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

1. The lead supervisory authority shall provide the other supervisory authorities and the Board with instant, unrestricted and continuous remote access to the full joint case file, and shall include into the joint case file any documents, submissions, communication, protocols, evidence or other information related to the case within one week of producing or receiving it.

~~Or. en~~

~~Amendment 120~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – introductory part~~

~~Text proposed by the Commission~~

~~Amendment~~

~~2. Relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679 shall include, where applicable:~~

2. The lead supervisory authority shall actively provide the other supervisory authorities and the Board with relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679, within one week from receiving or producing it. This information shall cover information on major steps in the procedure, including where applicable:

~~Or. en~~

~~Amendment 121~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point a~~

~~Text proposed by the Commission~~

~~Amendment~~

(a) information on the opening of an investigation of an alleged infringement of Regulation (EU) 2016/679;

~~(a) information on the opening of an ex officio investigation or a complaints procedure;~~

(b) requests for information pursuant to Article 58(1), point (e) of Regulation (EU) 2016/679 and related documents resulting from these requests;

~~Or. en~~

(c) information of the use of other investigative powers referred to in Article 58(1) of Regulation (EU) 2016/679 and related documents resulting from the exercise of these powers;

~~Amendment 122~~

(d) in the case of envisaged rejection of complaint, the lead supervisory authority’s reasons for rejection of the complaint;

~~Proposal for a regulation~~

(da) the early resolution of the complaint pursuant to Article 5 of this Regulation;

~~Article 8 – paragraph 2 – point e~~

(e) the summary of key issues in an investigation and related comments in accordance with Article 9;

~~Text proposed by the Commission~~

(ea) information on the scope of investigation, including developments or findings which might lead to the modification of the scope of investigation or the initiation of a new investigation;

~~Amendment~~

(f) information concerning steps and legal analysis aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision;

~~(e) summary of key issues in an investigation in accordance with Article 9;~~

(g) preliminary findings;

~~(e) the issuing or updating of the summary of key issues in an investigation in accordance with Article 9;~~

~~Or. en~~

~~Amendment 123~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point e a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(e a) any comments to a summary of key issues in accordance with Article 9(3);~~

~~Or. en~~

~~Amendment 124~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point f~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(f) information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings;~~

~~(f) information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision;~~

~~Or. en~~

~~Amendment 125~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point h~~

~~Text proposed by the Commission~~

~~Amendment~~

(h) the response of the parties under investigation to the preliminary findings;

~~deleted~~

(i) the views of the complainant on the non-confidential version of the preliminary findings and, if relevant, on other aspects of the investigation on which formal written submissions might have been made by the complainant;

~~Or. en~~

~~Justification~~

~~Following the deletion of Article 15.~~

~~Amendment 126~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point i~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(i) the views of the complainant on the preliminary findings;~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Following the deletion of Article 15.~~

~~Amendment 127~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point j~~

~~Text proposed by the Commission~~

~~Amendment~~

(j) in the case of rejection of a complaint, the written submissions of the complainant;

~~deleted~~

(k) any relevant steps taken by the lead supervisory authority after receiving the response of the parties under investigation to the preliminary findings and prior to submission of a draft decision in the sense of Article 60(3) of Regulation (EU) 2016/679;

~~Or. en~~

(ka) the views made by the parties under investigation on a revised draft decision;

~~Justification~~

(kb) any other information deemed useful and relevant for the purpose of the investigation.

~~Following the deletion of Article 15.~~

2a. In the course of the investigation, the lead supervisory authority and the supervisory authorities concerned shall exchange the information referred to in paragraph 2 as soon as that information becomes available and, unless otherwise provided for in this Regulation or in Regulation (EU) 2016/679, no later than one week from when such information becomes available.

~~Amendment 128~~

2b. The Board may specify the modalities and requirements for the exchange of relevant information between supervisory authorities referred to in this Article and for the provision of comments by supervisory authorities concerned on the summary of key issues.

~~Proposal for a regulation~~

Article 9 Summary of key issues

~~Article 8 – paragraph 2 – point k~~

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679. When transferring a case to the lead supervisory authority, the supervisory authority with which the complaint was lodged, may provide relevant elements to the lead supervisory authority.

~~Text proposed by the Commission~~

2. The summary of key issues shall include all of the following elements:

~~Amendment~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Following the deletion of Article 15.~~

~~Amendment 129~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point k a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(k a) any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;~~

~~Or. en~~

~~Amendment 130~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point k b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(k b) any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;~~

~~Or. en~~

~~Amendment 131~~

~~Proposal for a regulation~~

~~Article 8 – paragraph 2 – point k c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(k c) any judicial remedy brought during a procedure under Article 60 of Regulation (EU) 2016/679 or against a decision under Article 60(7) to (9) of Regulation (EU) 2016/679.~~

~~Or. en~~

~~Amendment 132~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

1. At the outset of any case, the lead supervisory authority, or where a case is transferred from another supervisory authority, that authority, shall draft a summary of key issues that presumably need to be determined to decide the case, for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679. The summary shall be drafted in an impartial way, taking into account any diverging facts and arguments.

~~Or. en~~

~~Justification~~

Under Article 3(2), the summary of key issues should be drafted by the CSA that receives a complaint, as it will best understand the concern of the data subject and is under the jurisdiction for appeals in case a complaint is rejected. EDPB, para 50.

~~Amendment 133~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 2 – point a~~

~~Text proposed by the Commission~~

~~Amendment~~

(a) the main relevant facts;

~~(a) the relevant facts;~~

(b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which are to be investigated;

~~Or. en~~

~~Amendment 134~~

(ca) analysis of relevant views as expressed by a party under investigation or the complainant where available when the summary is drafted;

~~Proposal for a regulation~~

(d) where applicable, preliminary identification of potential corrective measure(s).

~~Article 9 – paragraph 2 – point b~~

2a. The summary of key issues shall be communicated to the supervisory authorities concerned without delay, and no later than three months after the lead supervisory authority has confirmed its competence pursuant to Article 3(4a) of this Regulation or after a binding decision by the Board pursuant to Article 65(1), point b), of Regulation (EU) 2016/679.

~~Text proposed by the Commission~~

▌

~~Amendment~~

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues. The period may be extended by the lead supervisory authority by another two weeks on account of the complexity of the case or upon request of the supervisory authorities concerned.

~~(b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which will be investigated;~~

4. In cases where the supervisory authorities concerned provided comments under paragraph 4, they shall be shared with all other supervisory authorities concerned. The lead supervisory authority shall respond to these comments within four weeks to indicate whether and how it intends to take them into account. The period may be extended by another two weeks on account of the complexity of the case.

(b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement , and an indication if they seem to be infringed;

Article 10 Use of means to reach consensus within the meaning of Article 60(1) of Regulation (EU) 2016/679

~~Or. en~~

-1. Pursuant to Article 60(1) of Regulation (EU) 2016/679, the lead supervisory authority and supervisory authorities concerned shall endeavour to reach consensus on cross-border processing cases, in accordance with this Article, and may use all the means provided for in Regulation (EU) 2016/679, including mutual assistance pursuant to Article 61 and joint operations pursuant to Article 62 of Regulation (EU) 2016/679.

~~Amendment 135~~

▌

~~Proposal for a regulation~~

1. In cases where a supervisory authority concerned disagrees with the lead supervisory authority and in the absence of consensus, that supervisory authority may make a request to the lead supervisory authority under Article 61 of Regulation (EU) 2016/679 or to trigger Article 62 of Regulation (EU) 2016/679, or both, in order to reach consensus on:

~~Article 9 – paragraph 2 – point c~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(c) identification of complex legal and technological assessments which are relevant for preliminary orientation of their assessment;~~

~~(c) identification of legal and technological assessments which are relevant for preliminary orientation of their assessment;~~

~~Or. en~~

~~Justification~~

~~EDPB para 52.~~

~~Amendment 136~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 2 – point c a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(c a) where applicable, European case law, as well as guidelines, recommendations and best practices issued by the Board, that would determine the matter, and an indication if the supervisory authority intends to follow them;

~~Or. en~~

~~Amendment 137~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 2 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any material changes that emerge during the course of the procedure.~~

~~Or. en~~

~~Amendment 138~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 3~~

~~Text proposed by the Commission~~

~~Amendment~~

~~3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues.~~

~~3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update.~~

~~Or. en~~

~~Amendment 139~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 4~~

~~Text proposed by the Commission~~

~~Amendment~~

~~4. Comments provided pursuant to paragraph 3 shall meet the following requirements:~~

~~deleted~~

~~(a) language used is sufficiently clear and contains precise terms to enable the lead supervisory authority, and, as the case may be, supervisory authorities concerned, to prepare their positions;~~

~~(b) legal arguments are set out succinctly and grouped by reference to the part of the summary of key issues to which they relate;~~

~~(c) the comments of the supervisory authority concerned may be supported by documents, which may supplement the comments on specific points.~~

~~Or. en~~

~~Justification~~

~~Moved to a horizontal provision on all communications in Article 2c(8).~~

~~Amendment 140~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 5~~

~~Text proposed by the Commission~~

~~Amendment~~

~~5. The Board may specify in its rules of procedure restrictions on the maximum length of comments submitted by supervisory authorities concerned on the summary of key issues.~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~EDPB para 54. (EDPB Rules of Procedure can specify this already anyway.)~~

~~Amendment 141~~

~~Proposal for a regulation~~

~~Article 9 – paragraph 6~~

~~Text proposed by the Commission~~

~~Amendment~~

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article, and where the supervisory authority indicates that it intends to follow European case law, as well as guidelines, recommendations and best practices referred to in paragraph 2(ca), shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

~~Or. en~~

~~Justification~~

~~3 months: rapid decision-making in non-contentious cases requires shorter deadlines.~~

~~Amendment 142~~

~~Proposal for a regulation~~

~~Article 10 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

1. A supervisory authority concerned shall make a request to the lead supervisory authority under Article 61 of Regulation (EU) 2016/679, Article 62 of Regulation (EU) 2016/679, or both, where, following the comments of supervisory authorities concerned pursuant to Article 9(3), a supervisory authority concerned disagrees with the assessment of the lead supervisory authority on:

~~deleted~~

(a) the scope of the investigation in complaint-based cases, including the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which will be investigated;

(b) ~~preliminary orientation in relation~~the tofactual ~~complex~~or legal ~~assessments~~issues identified by the lead supervisory authority pursuant to Article 9(2), point ~~(c);~~(c), where applicable;

~~(c) preliminary orientation in relation to complex technological assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c).~~

▌

~~Or. en~~

(ca) preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

~~Justification~~

2. The request under paragraph 1 shall be made within one month of the expiry of the period referred to in Article 9(4).

~~Covered by horizontal provisions in new Article 2c now.~~

2a. Where a request to conduct joint operations pursuant to Article 62 of Regulation (EU) 2016/679 is made by a concerned supervisory authority, the lead supervisory authority shall respond to the request within one month.

~~Amendment 143~~

3. The lead supervisory authority shall engage with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Articles 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings or, where applicable, provide the supervisory authority with which the complaint was lodged with its reasoning for the purposes of Article 11(2).

~~Proposal for a regulation~~

4. Where, in a complaint-based investigation, following the procedures under Article 9(4) and paragraph 3 of this Article, there is no consensus between the lead supervisory authority and one or more ▌supervisory authorities concerned on the matters referred to in Article 9(2), point (b) ▌, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

~~Article 10 – paragraph 2~~

~~Text proposed by the Commission~~

~~Amendment~~

~~2. The request under paragraph 1 shall be made within two months of the expiry of the period referred to in Article 9(3).~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Covered by horizontal provisions in new Article 2c now.~~

~~Amendment 144~~

~~Proposal for a regulation~~

~~Article 10 – paragraph 4~~

~~Text proposed by the Commission~~

~~Amendment~~

4. Where, in a complaint-based investigation, there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matter referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), the lead supervisory authority or a concerned supervisory authority may request a procedural determination pursuant to Article 26a(1).

~~Or. en~~

~~Amendment 145~~

~~Proposal for a regulation~~

~~Article 10 – paragraph 5 – introductory part~~

~~Text proposed by the Commission~~

~~Amendment~~

5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the lead supervisory authority shall provide all of the following:

~~5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the supervisory authority shall provide all of the following:~~

(a) the elements referred to in Article 9(2); ▌

~~Or. en~~

(b) the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation;

~~Amendment 146~~

(c) further exchanges between the lead supervisory authority and the supervisory authorities concerned under Article 9(4) and (5) and Article 10(3);

~~Proposal for a regulation~~

(d) any other relevant document or information, as requested by the Board.

~~Article 10 – paragraph 5 – point a~~

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of all the documents received.

~~Text proposed by the Commission~~

▌

~~Amendment~~

Article 10a Time limits for submission of a draft decision

~~(a) the documents referred to in Article 9(2), points (a) and (b);~~

1. The lead supervisory authority shall submit a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 no later than 15 months after the lead supervisory authority has confirmed its competence pursuant to Article 3(4a) of this Regulation or after a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679. This time limit may be extended once by the lead supervisory authority in line with the procedure in paragraphs 3 and 4.

~~(a) the relevant information referred to in Article 9(2);~~

2. Where a request under Article 10(4) of this Regulation has been made, the time limits referred to in paragraph 1 shall be suspended until the Board has adopted its binding decision.

~~Or. en~~

3. In an exceptional case, the lead supervisory authority may extend the time limit referred to in paragraph 1 for a maximum period of 12 months on account of complexity of the case. In such a case, the lead supervisory authority shall inform the supervisory authorities concerned thereof and set out the duration of and reasons for the intended extension, at least four weeks before the expiry of the time limit referred to in paragraph 1.

~~Amendment 147~~

4. Any supervisory authority concerned may submit an objection to the extension within two weeks from being informed pursuant to paragraph 3. The authority shall set out the reasons for its objection. When determining whether to apply an extension to the time limit and, where applicable, the length of such an extension, the lead supervisory authority shall take due account of such an objection.

~~Proposal for a regulation~~

5. Following the extension referred to in paragraph 3 of this Article, any supervisory authority concerned may inform the lead supervisory authority that it considers there is a need to act in order to protect the rights and freedoms of data subjects. Where the lead supervisory authority does not submit a draft decision within the extended time limit referred to in paragraph 3, an authority that has informed of a need to act in order to protect the rights and freedoms of data subjects may adopt a provisional measure on the territory of its Member State in accordance with Article 55 of Regulation (EU) 2016/679. In that case, the urgent need to act under Article 66(1) of Regulation (EU) 2016/679 shall be presumed to be met.

~~Article 10 – paragraph 5 – point b~~

6. Where the simple cooperation procedure under Article 6bis is applied, the lead supervisory authority shall submit a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 no later than 12 months after the lead supervisory authority has confirmed its competence pursuant to Article 3(4a) of this Regulation or after a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.

~~Text proposed by the Commission~~

Where national law provides for prior or subsequent domestic proceedings which necessitate that a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 be submitted after the time limit referred to in the first subparagraph has expired, the lead supervisory authority may extend that time limit for a maximum period of two months. In such a case, the lead supervisory authority shall inform the supervisory authorities concerned thereof and set out the duration of the extension, at least two weeks before the expiry of the time limit referred to in the first subparagraph.

~~Amendment~~

▌

~~(b) the comments of the supervisory authority concerned that disagrees with the lead supervisory authority’s preliminary identification of the scope of the investigation.~~

Article 10b Subsequent domestic proceedings

~~(b) the comments of the supervisory authority concerned that disagrees with the lead supervisory authority’s preliminary identification of the matter referred to in Article 9(2).~~

1. Where national law requires subsequent domestic proceedings related to the same case to be opened after the adoption of a decision pursuant to Articles 13 or 16, the lead supervisory authority shall:

~~Or. en~~

(a) not draft a new summary of key issues;

~~Amendment 148~~

(b) repeat the procedural steps pursuant to Article 11 or Articles 14 and 15 only where its factual or legal assessment differs from the preceding decision adopted pursuant to Articles 13 or 16; and

~~Proposal for a regulation~~

(c) submit a draft decision before adopting any subsequent decision that is different from the preceding decision pursuant to Articles 13 or 16.

~~Article 10 – paragraph 6~~

2. The time limits pursuant to Article 10a shall apply to submitting a draft decision in any subsequent proceedings referred to in paragraph 1.

~~Text proposed by the Commission~~

Section 1b Application of time limits

~~Amendment~~

Article 10c Legality and validity of procedural steps and the final decision

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

Where this Regulation or Article 65(6) of Regulation (EU) 2016/679 requires that a supervisory authority take a procedural step within a specified time limit, taking such a step after the expiry of the time limit shall not affect the legality or validity of that procedural step or of the final decision.

~~6. The Board shall adopt an urgent binding decision on the summary of key issues, in accordance with Article 66(3) of Regulation (EU) 2016/679, on the basis of all documents received.~~

Article 10d Time limits and the right to an effective judicial remedy

~~Or. en~~

In determining whether a supervisory authority has not handled a complaint pursuant to Article 78(2) of Regulation (EU) 2016/679, consideration shall be given to whether a supervisory authority, within the time limit provided for in this Regulation or in Article 65(6) of Regulation (EU) 2016/679, including any possible extensions of such a time limit, has not:

~~Justification~~

- submitted a draft decision or revised draft decision, or

~~Wording suggestion from EDPB.~~

- adopted a final decision.

~~Amendment 149~~

Section 2 Full or partial rejection of complaints

~~Proposal for a regulation~~

Article 11 Procedure for full or partial rejection or dismissal of a complaint within the meaning of Article 60(8) and (9) of Regulation (EU) 2016/679

~~Chapter III – Section 2~~

1. Where the lead supervisory authority intends to fully or partially reject or dismiss a complaint, it shall, prior to submitting a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679, provide the supervisory authority with which the complaint has been lodged with the reasons for its preliminary view that the complaint should be fully or partially rejected or dismissed.

~~Text proposed by the Commission~~

The supervisory authority with which the complaint has been lodged shall inform the complainant of the reasons for the preliminary view referred to in the first subparagraph, provide the complainant with the possibility to make her or his views known and inform the complainant of the consequences of not making his or her views known.

~~Amendment~~

The complainant shall have an opportunity to make his or her views known in writing within an appropriate time-limit set by the lead supervisory authority no shorter than three weeks and no longer than six weeks.

~~SECTION 2~~

2. The supervisory authority with which the complaint has been lodged shall transmit any views made known by the complainant to the lead supervisory authority, as soon as they become available and in any case no later than one week from when they become available.

~~deleted~~

3. Where the views made known by the complainant in accordance with paragraph 1 do not lead to a change of the preliminary view referred to in the first subparagraph of paragraph 1, the lead supervisory authority, in cooperation with the supervisory authority with which the complaint has been lodged, ▌shall prepare a draft decision and submit it to the supervisory authorities concerned, in accordance with Article 60(3) of Regulation (EU) 2016/679.

~~Full or partial rejection of complaints~~

▌

~~Article 11~~

6. When the draft decision submitted pursuant to paragraph 3 concludes that the complaint should be partially rejected, the lead supervisory authority shall continue its investigation in cooperation with the supervisory authorities concerned on the part of the complaint which remains to be investigated.

~~Hearing of complainant prior to full or partial rejection of a complaint~~

▌

1. Following the procedure provided for in Article 9 and 10, the lead supervisory authority shall provide the supervisory authority with which the complaint was lodged with the reasons for its preliminary view that the complaint should be fully or partially rejected.

Article 12 Revised draft decision fully or partially rejecting or dismissing a complaint

2.▌Where ~~The~~the lead supervisory authority ~~with~~assesses ~~which~~that the ~~complaint was~~revised ~~lodged~~draft ~~shall~~decision ~~inform~~within the ~~complainant~~meaning of ~~the~~Article ~~reasons~~60(5) ~~for~~of ~~the~~Regulation ~~intended~~(EU) ~~full~~2016/679, fully or ~~partial~~partially ~~rejection~~rejecting ofor ~~the~~dismissing ~~complaint~~a ~~and~~complaint, ~~set~~raises anew ~~time-limit~~elements ~~within~~on which the complainant ~~may~~should ~~make~~have ~~known~~the opportunity to make her or his views inknown, ~~writing.~~the ~~The~~supervisory ~~time-limit~~authority ~~shall~~with bewhich nothe ~~less~~complaint ~~than~~has ~~three~~been ~~weeks.~~lodged ~~The~~shall, ~~supervisory~~prior ~~authority~~to ~~with~~the ~~which~~submission ~~the~~of ~~complaint~~the ~~was~~revised ~~lodged~~draft ~~shall~~decision ~~inform~~under ~~the~~Article ~~complainant~~60(5) of Regulation (EU) 2016/679, provide the ~~consequences~~complainant ofwith the ~~failure~~possibility to make her or his views ~~known.~~known on such new elements in accordance with the procedure under Article 11 of this Regulation.

3. If the complainant fails to make known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged, the complaint shall be deemed to have been withdrawn.

▌

~~4. The complainant may request access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.~~

Article 13 Decision fully or partially rejecting or dismissing a complaint

~~5. If the~~When ~~complainant~~adopting ~~makes~~a ~~known~~decision ~~her~~dismissing or ~~his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do~~fully ~~not~~or ~~lead~~partially torejecting a ~~change~~complaint in ~~the preliminary view that~~accordance ~~the~~with ~~complaint~~Article ~~should~~60(8) beor(9) ~~fully~~of orRegulation ~~partially~~(EU) ~~rejected,~~2016/679, the supervisory authority with which the complaint was lodged shall ~~prepare~~inform the ~~draft decision under Article 60(3)~~complainant of ~~Regulation (EU) 2016/679 which shall be submitted to~~ the ~~other supervisory~~judicial ~~authorities~~remedy ~~concerned~~available byto ~~the~~him ~~lead~~or ~~supervisory~~her ~~authority~~in ~~pursuant~~accordance towith Article ~~60(3)~~78 of Regulation (EU) 2016/679.

~~Article 12~~

Section 3 Decisions addressed to parties under investigation

~~Revised draft decision fully or partially rejecting a complaint~~

Article 14 Preliminary findings and the right to be heard

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements.

~~2. The supervisory authority with which the complaint was lodged shall set a time-limit within which the complainant may make known her or his views.~~

~~Or. en~~

~~Justification~~

~~Covered by Article 14 now.~~

~~Amendment 150~~

~~Proposal for a regulation~~

~~Article 13~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 13~~

~~deleted~~

~~Decision fully or partially rejecting a complaint~~

When adopting a decision fully or partially rejecting a complaint in accordance with Article 60(8) of Regulation (EU) 2016/679, the supervisory authority with which the complaint was lodged shall inform the complainant of the judicial remedy available to him or her in accordance with Article 78 of Regulation (EU) 2016/679.

~~Or. en~~

~~Justification~~

~~Moved to Article 16(1)(f) to horizontally ensure that all parties are informed about judicial remedy options.~~

~~Amendment 151~~

~~Proposal for a regulation~~

~~Section 3 – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Decisions addressed to controllers and processors~~

~~Decisions addressed to parties under investigation~~

~~Or. en~~

~~Justification~~

~~Wording suggestion from EDPB.~~

~~Amendment 152~~

~~Proposal for a regulation~~

~~Article 14 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

1. When the lead supervisory authority intends to submit a draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

1. Following the consultations and procedures under Articles 9 and 10 of this Regulation, when the lead supervisory authority intends to submit a draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

~~Or. en~~

2. The preliminary findings shall include the findings of the investigation and present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts, including listing the evidence relied upon, and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

~~Justification~~

The preliminary findings shall indicate, based on the information available at that stage and without prejudice to the views of the parties, corrective measures the lead supervisory authority considers using.

~~Wording suggestion from EDPB.~~

Where the lead supervisory authority, based on the information available at that stage and without prejudice to the views of the parties, considers imposing an administrative fine in accordance with Article 83 of Regulation (EU) 2016/679, the lead supervisory authority shall list in the preliminary findings the main legal and factual elements, which are known to it, and on which it intends to rely in deciding whether to impose an administrative fine and in deciding on the amount of the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

~~Amendment 153~~

2a. The preliminary findings shall be transmitted to the supervisory authorities concerned, which may provide comments to the lead supervisory authorities within four weeks. Upon request of one of the supervisory authorities concerned, the period shall be extended by another two weeks.

~~Proposal for a regulation~~

3. The lead supervisory authority shall notify preliminary findings, where relevant amended to take into account comments received by the supervisory authorities concerned, to each of the parties under investigation.

~~Article 14 – paragraph 2 – subparagraph 1~~

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set an appropriate time-limit no shorter than three weeks and no longer than six weeks from the date of notification, within which those parties may provide their views in writing, or the lead supervisory authority shall hold a hearing within the same time-limit in order to hear the views of the parties orally.

~~Text proposed by the Commission~~

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Articles 19 and 21.

~~Amendment~~

6. The parties under investigation may, in their reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties under investigation have been given the opportunity to comment.

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they must set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

▌

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Article 15 Transmission of preliminary findings to complainants

~~Or. en~~

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint has been lodged shall provide the complainant with those preliminary findings, in accordance with rules on access to the administrative file and on confidential information under Articles 19 and 21, and set an appropriate time-limit no shorter than three weeks and no longer than six weeks, within which the complainant may make known his or her views in writing.

~~Justification~~

1a. For the purpose of paragraph 1, administrative modalities and requirement under the national procedural law of the supervisory authority with which the complaint was lodged shall continue to apply.

~~EDPB para 135~~

2. Paragraph 1 shall also apply where the lead supervisory authority handles a complaint jointly with other complaints or where it handles a part of a complaint separately. It shall also apply where the lead supervisory authority has modified the scope of the investigation as set out in preliminary findings in any other way, including following a binding decision of the Board pursuant to Article 10(6).

~~Amendment 154~~

▌

~~Proposal for a regulation~~

Article 16 Adoption of final decision

~~Article 14 – paragraph 2 – subparagraph 2~~

1. After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned object to the draft decision within the periods referred to in Article 60(4) or (5) of Regulation (EU) 2016/679 as applicable, the lead supervisory authority shall, within one month from the end of the period referred to in Article 60(4) or (5) of Regulation (EU) 2016/679:

~~Text proposed by the Commission~~

(a) adopt its decision referred to in Article 60(7) or, where applicable Article 60(9), of Regulation (EU) 2016/679; and

~~Amendment~~

(b) notify that decision to the main establishment or single establishment of the controller or processor, as the case may be.

~~The preliminary findings shall indicate corrective measures the lead supervisory authority intends to use.~~

2. The information to be provided to the complainant pursuant to Article 60(7) and (9) of Regulation (EU) 2016/679 shall consist of a version of the decision adopted that includes its operative part in full and the grounds that do not include elements considered confidential in accordance with Article 21 of this Regulation, or a summary of the decision, including the relevant facts and grounds. In any case, the complainant shall, upon request, be provided with a version of that decision that includes its operative part in full and the grounds that do not include elements considered confidential in accordance with Article 21 of this Regulation. Administrative modalities and requirements under the national procedural law of the lead supervisory authority shall continue to apply.

~~The preliminary findings shall indicate the corrective measures that are considered by the lead supervisory authority.~~

▌

~~Or. en~~

Article 17 Right to be heard in relation to revised draft decision finding an infringement

~~Justification~~

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679,finding an infringement of Regulation (EU) 2016/679, raises new elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

~~EDPB para 135~~

2. The lead supervisory authority shall set an appropriate time-limit no shorter than three weeks and no longer than six weeks within which the parties under investigation may make known their views.

~~Amendment 155~~

2a. The lead supervisory authority shall inform the supervisory authorities concerned of the views made known by the parties under investigations, as soon as they become available and in any case no later than one week from when they become available.

~~Proposal for a regulation~~

Section 4 Relevant and reasoned objections

~~Article 14 – paragraph 2 – subparagraph 3~~

Article 18 Relevant and reasoned objections

~~Text proposed by the Commission~~

1. Relevant and reasoned objections within the meaning of Article 4(24) of Regulation (EU) 2016/679 shall:

~~Amendment~~

(a) be based ▌ on factual and legal elements included in the draft decision or in the cooperation file; ▌

Where the lead supervisory authority intends to impose a fine, it shall list in the preliminary findings the relevant elements on which it relies while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

(b) not concern the scope of an investigation in cases where none of the supervisory authorities provided comments under Article 9(3) or in cases where consensus has been reached following comments received, or the scope of an investigation as defined in the binding decision of the Board adopted under Article 10(6);

Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements of facts and law, which are known to it, and on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account..

(ba) not concern a draft decision adopted in accordance with the conditions pursuant to Article 5 of this Regulation.

~~Or. en~~

2. Notwithstanding point (b) of paragraph 1, a supervisory authority concerned may provide relevant and reasoned objections that concern the scope of an investigation as referred to in point (b) of paragraph 1, provided that, in duly justified cases:

~~Justification~~

– the lead supervisory authority has failed to investigate all the elements of the summary of key issues agreed pursuant to Article 10(1a) or (3), or has failed to comply with the binding decision of the Board under Article 10(6) or,

~~EDPB para 135~~

– additional new elements, not available at the time of agreeing on the summary of key issues pursuant to Article 10(1a) or (3), or at the time of the binding decision of the Board under Article 10(6), demonstrate a significant risk posed by the draft decision as regards the fundamental rights and freedom of the data subject and, where applicable, the free flow of personal data within the Union; or both.

~~Amendment 156~~

2. A relevant and reasoned objection shall be worded in sufficiently clear, coherent and precise terms and, where necessary, identify the elements of the draft decision that should be changed, in order to enable supervisory authorities, to prepare their positions and, as the case may be, to enable the Board to efficiently resolve the dispute.

~~Proposal for a regulation~~

▌

~~Article 14 – paragraph 3~~

Chapter IV ▌Administrative file, cooperation file and treatment of confidential information

~~Text proposed by the Commission~~

Article 19 ▌Administrative file ▌

~~Amendment~~

1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of the documents which have been obtained, or produced by the concerned supervisory authorities and the lead supervisory authority, and assembled by the lead supervisory authority during the investigation procedure, including all inculpatory and exculpatory evidence.

~~3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation.~~

The administrative file shall not include internal communications within a supervisory authority.

~~3. The lead supervisory authority shall notify preliminary findings to each of the parties.~~

2. Upon request of a party under investigation, or a complainant where the decision is liable to affect his or her interests adversely, the lead supervisory authority shall grant access to the administrative file to the parties under investigation, or the complainant, enabling them to exercise their right to be heard. This shall be without prejudice to more favourable rules on granting access to the administrative file under the lead supervisory authority’s national law.

~~Or. en~~

Where access is granted by the lead supervisory authority, the party under investigation shall be provided with such access by the lead supervisory authority, while the complainant shall be provided with such access by the supervisory authority with which the complaint has been lodged.

~~Amendment 157~~

3. The following documents or their parts shall be excluded from access, notwithstanding whether access is granted under Union or national law:

~~Proposal for a regulation~~

(a) correspondence or deliberations between the supervisory authorities;

~~Article 14 – paragraph 4~~

(b) confidential information pursuant to Article 21(1) of this Regulation.

~~Text proposed by the Commission~~

4. Access to relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679 on the basis to which the lead supervisory authority intends to adopt a revised draft decision shall only be provided by the lead supervisory authority where necessary to enable the parties under investigation or the complainant to express their views and defend their rights.

~~Amendment~~

▌

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

Article 21 Identification and protection of confidential information

~~deleted~~

1. Any information and documents or parts of documents shall be considered confidential in so far as they contain trade secrets as defined in Directive (EU) 2016/943 or other confidential information in accordance with Union or national law.

~~Or. en~~

2. Unless otherwise provided by Union law or national law, information collected, produced or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, which is considered confidential pursuant to paragraph 1, shall not be communicated or made accessible to a party under investigation, a complainant or any third party.

~~Justification~~

▌

~~Replaced by horizontal rule in Article 2b(4).~~

4. A party under investigation, a complainant, or a third party submitting information that it considers to be confidential shall clearly identify the information which it considers to be confidential, giving reasons for the confidentiality claimed. The party under investigation, complainant, or third party shall always provide the full version of the information. Where possible, it shall also provide a proposed non-confidential version ▌.

~~Amendment 158~~

5. Without prejudice to paragraph 4, the ▌supervisory authority to which the information is submitted may require the parties under investigation, or any other party which produces documents pursuant to Regulation (EU) 2016/679, to identify the documents or parts of documents which they consider to contain trade secrets or other confidential information belonging to them and to identify the parties for which these documents are considered to be confidential.

~~Proposal for a regulation~~

6. The ▌supervisory authority to which the information is submitted shall set an appropriate time-limit no longer than six weeks for parties under investigation and any other party raising a confidentiality claim to:

~~Article 14 – paragraph 5~~

(a) substantiate their claims for trade secrets and other confidential information for each individual document or part of document, statement, or part of statement;

~~Text proposed by the Commission~~

(b) provide, where possible, a proposed non-confidential version of the documents and statements, in which the trade secrets and other confidential information are redacted;

~~Amendment~~

7. If the parties under investigation or any other party fails to comply with paragraphs 5 and 6, the supervisory authority to which the information is submitted may assume that the documents or statements concerned do not contain trade secrets or other confidential information.

~~deleted~~

7a. The authority to which the information is submitted shall determine whether or not the information or relevant and specific parts of documents are confidential, in accordance with paragraph 1, ensuring that the redaction of documents is limited to the extent necessary and proportionate to protect the confidential information. It shall inform the other supervisory authorities about the confidential nature of the information when transmitted.

~~Or. en~~

7b. Information exchanged between supervisory authorities in the application of Regulation (EU) 2016/679, where it is regarded as confidential information under the national law of the supervisory authority to which the information is submitted, shall remain treated as confidential by the supervisory authority receiving it.

~~Justification~~

Article 21a Cooperation file

~~Replaced by horizontal rule in Article 2b(1)(c).~~

1. For the purpose of relevant information to be exchanged between the lead supervisory authority and supervisory authorities concerned in accordance with Article 8, the lead supervisory authority shall ensure such relevant information is available through a cooperation file dedicated to each complaint or investigation related to cross-border processing. The cooperation file shall be maintained in electronic form and shall, by means of a common electronic tool, be remotely accessible to supervisory authorities and, upon submission of a matter to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679, and, where applicable, when an urgent opinion or an urgent binding decision is requested pursuant to Article 66 of Regulation (EU) 2016/679, to the Board. It shall not be directly accessible to parties under investigation, complainants or third parties.

~~Amendment 159~~

2. The cooperation file shall include all information exchanged pursuant to Article 8 of this Regulation.

~~Proposal for a regulation~~

Chapter V Dispute resolution

~~Article 14 – paragraph 6~~

Article 22 Referral to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679

~~Text proposed by the Commission~~

▌

~~Amendment~~

1a. Within three months after the expiry of the period set out by Article 60(4) of Regulation (EU) 2016/679, the lead supervisory authority shall either submit a revised draft pursuant to Article 60(5) of Regulation (EU) 2016/679 to the other supervisory authorities concerned or refer the subject-matter to the Board for dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679.

6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties under investigation have been given the opportunity to comment.

1b. Within three months after the expiry of the period set out by Article 60(5) of Regulation (EU) 2016/679, the lead supervisory authority shall either submit another revised draft decision under 60(5) of Regulation (EU) 2016/679 or refer the subject-matter to the Board for dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679.

6. The parties may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

2. When referring the subject-matter to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679, the lead supervisory authority shall provide the Board with all of the following ▌:

~~Or. en~~

~~Amendment 160~~

~~Proposal for a regulation~~

~~Article 15~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 15~~

~~deleted~~

~~Transmission of preliminary findings to complainants~~

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings and set a time-limit within which the complainant may make known its views in writing.

2. Paragraph 1 shall apply also when a supervisory authority, where appropriate, treats several complaints jointly, splits the complaints in several parts or in any other way exercises its discretion concerning the scope of the investigation as set out in preliminary findings.

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the administrative file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1.

~~4. The complainant shall be provided with the non-confidential version of the preliminary findings only for the purpose of the concrete investigation in which the preliminary findings were issued.~~

5. Before receiving the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the complainant shall send to the lead supervisory authority a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than the concrete investigation in which those findings were issued.

~~Or. en~~

~~Justification~~

~~Now covered by Article 14, which in amended form requires preliminary findings to be sent to all parties of a case, including complainants.~~

~~Amendment 161~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation 2016/679, adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

~~Or. en~~

~~Justification~~

~~Four weeks from Article 60(4) and (5) GDPR~~

~~Amendment 162~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intends to follow that objection, the lead supervisory authority shall, within four weeks, submit a revised draft decision pursuant to Article 60(5) of that Regulation.

~~Or. en~~

~~Amendment 163~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit the matter to the consistency mechanism referred to in Article 63, in accordance with Article 60(4) of that Regulation.

~~Or. en~~

~~Amendment 164~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements:

~~(a) the name of the supervisory authority which issued the decision;~~

~~(b) the date of issuing of the decision;~~

~~(c) an impartial summary of the relevant facts of the case and their source;~~

~~(d) the legal grounds for the decision;~~

~~(e) the exercised corrective powers, penalties or other measures; and~~

~~(f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.~~

~~Or. en~~

~~Justification~~

~~Point (f) moved here from Article 13. This information should be available to all parties.~~

~~Amendment 165~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1 d (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

In a case where the legally binding decision is to be issued by the supervisory authority with which the complaint has been lodged in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the lead supervisory authority shall ensure that the decision contains all elements necessary under the applicable national procedural law of the concerned supervisory authority. The concerned supervisory authority with which the complaint has been lodged shall assist the lead supervisory authority in drafting the decision in such a manner.

~~Or. en~~

~~Amendment 166~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1 e (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision.~~

~~Or. en~~

~~Amendment 167~~

~~Proposal for a regulation~~

~~Article 16 – paragraph 1 f (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless they do not materially depart from previously published decisions. In accordance with applicable national procedural law,, supervisory authorities may redact information that may allow identifying parties and redact other information that is protected under applicable law.

~~Or. en~~

~~Justification~~

Established practice in most Member States, see GDPRhub.eu:- Spain publishes everything. Most countries publish novel or relevant decisions only (which is the proposal here). Germany and Romania do not publish anything (other than some press release).

~~Amendment 168~~

~~Proposal for a regulation~~

~~Article 17~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 17~~

~~deleted~~

~~Right to be heard in relation to revised draft decision~~

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

~~2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.~~

~~Or. en~~

~~Justification~~

This Article is replaced by Article 2b(1)(b), which clarifies that the parties must be heard on novel issues that were not brought to their attention (“Überraschungsverbot”). There is no need to hear the parties on the entire draft decision.

~~Amendment 169~~

~~Proposal for a regulation~~

~~Article 18 – paragraph 1 – point a~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(a) be based exclusively on factual elements included in the draft decision; and~~

~~(a) be based on factual elements included in the draft decision, or in the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;~~

~~Or. en~~

~~Justification~~

The limitation to only base this on what the LSA has put in the draft decision allows to manipulate the outcome by simply only focusing on certain elements. It should be at least the entire case file, ideally also evidence that the LSA may have been missing. EDPB paras 92-96

~~Amendment 170~~

~~Proposal for a regulation~~

~~Article 18 – paragraph 1 – point b~~

~~Text proposed by the Commission~~

~~Amendment~~

(b) not change the scope of the allegations by raising points amounting to identification of additional allegations of infringement of Regulation (EU) 2016/679 or changing the intrinsic nature of the allegations raised.

~~(b) not change the scope of the case as defined through the latest version of the summary of key issues; and~~

~~Or. en~~

~~Justification~~

~~Based on EDPB wording suggestions.~~

~~Amendment 171~~

~~Proposal for a regulation~~

~~Article 18 – paragraph 1 – point b a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

(b a) clearly identify the elements of the draft decision that should be changed, including, where possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

~~Or. en~~

~~Amendment 172~~

~~Proposal for a regulation~~

~~Article 18 – paragraph 2 – point a~~

~~Text proposed by the Commission~~

~~Amendment~~

(a) the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

~~deleted~~

~~Or. en~~

~~Justification~~

The duty to have concise documents is introduced as a general principle in Article 2c(8), which also applies to relevant and reasoned objections. Limiting it to 3 or maximum 6 pages is too narrow. EDPB para 97

~~Amendment 173~~

~~Proposal for a regulation~~

~~Chapter IV – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Chapter IV~~

~~(deleted)~~

~~Access to the administrative file and treatment of confidential information~~

~~Or. en~~

~~Justification~~

~~The entire Chapter is replaced by Article 2b.~~

~~Amendment 174~~

~~Proposal for a regulation~~

~~Article 19~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 19~~

~~deleted~~

~~Content of the administrative file~~

1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority may return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the administrative file.

3. The right of access to the administrative file shall not extend to correspondence and exchange of views between the lead supervisory authority and supervisory authorities concerned. The information exchanged between the supervisory authorities for the purpose of the investigation of an individual case are internal documents and shall not be accessible to the parties under investigation or the complainant.

~~4. Access to relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679 shall be provided in accordance with Article 24.~~

~~Or. en~~

~~Justification~~

~~Replaced by Article 2b(3). Paragraph 3 is captured by the definition of “internal deliberations” in Article 2(1f).~~

~~Amendment 175~~

~~Proposal for a regulation~~

~~Article 20~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 20~~

~~deleted~~

~~Access to the administrative file and use of documents~~

1. The lead supervisory authority shall grant access to the administrative file to the parties under investigation, enabling them to exercise their right to be heard. Access to the administrative file shall be granted after the lead supervisory authority notifies the preliminary findings to the parties under investigation.

~~2. The administrative file shall include all documents, inculpatory and exculpatory, including facts and documents which are known to the parties under investigation.~~

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties under investigation had the opportunity to make their views known.

4. Documents obtained through access to the administrative file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided.

~~Or. en~~

~~Justification~~

The entire Chapter is replaced by Article 2b.Paragraph 4 is particularly problematic, as supervisory authorities should not be prevented from using information obtained in one procedure to perform their functions in other procedures and ex officio inquiries. EDPB para 79.

~~Amendment 176~~

~~Proposal for a regulation~~

~~Article 21~~

~~Text proposed by the Commission~~

~~Amendment~~

~~[...]~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Replaced by Article 2b(3).~~

~~Amendment 177~~

~~Proposal for a regulation~~

~~Article 22 – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Referral to dispute resolution under Article 65 of Regulation (EU) 2016/679~~

~~Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679~~

~~Or. en~~

~~Justification~~

~~Wording suggestion from EDPB.~~

~~Amendment 178~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 1~~

~~Text proposed by the Commission~~

~~Amendment~~

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679.

~~Or. en~~

~~Justification~~

~~In some cases, LSAs have taken a year to submit RROs to the Board.~~

~~Amendment 179~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – introductory part~~

~~Text proposed by the Commission~~

~~Amendment~~

~~2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following documents:~~

~~2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following:~~

~~Or. en~~

~~Amendment 180~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point a a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(a a) the summary of key issues;~~

~~Or. en~~

~~Amendment 181~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point b~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(b) a summary of the relevant facts;~~

~~(b) a summary of the relevant facts, including the description of processing activities, the description of the company's organisation and the description of where decisions are taken;~~

~~Or. en~~

~~Justification~~

~~EDPB para 108~~

~~Amendment 182~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point d~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(d) view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;~~

~~(d) view made in writing by the parties, pursuant to Articles 15;;~~

~~Or. en~~

~~Justification~~

~~Aligned with amended and broader Article 15.~~

~~Amendment 183~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point e~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(e) views made in writing by complainants, as the case may be, pursuant to Articles 11, 12, and 15;~~

~~deleted~~

~~Or. en~~

~~Justification~~

~~Aligned with amended and broader Article 15, see amended point (d).~~

~~Amendment 184~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point f~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(f) the relevant and reasoned objections which were not followed by the lead supervisory authority;~~

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as being neither relevant nor reasoned;

~~Or. en~~

~~Justification~~

~~Wording suggestion by EDPB.~~

~~Amendment 185~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point g~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.~~

~~(g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned;~~

~~Or. en~~

~~Justification~~

~~Wording suggestion by EDPB, to align with (f).~~

~~Amendment 186~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 2 – point g a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(g a) access to the joint case file.~~

~~Or. en~~

~~Amendment 187~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 3~~

~~Text proposed by the Commission~~

~~Amendment~~

~~3. The Board shall within four weeks of receiving the documents listed in paragraph 2 identify retained relevant and reasoned objections.~~

3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to the supervisory authorities.

~~Or. en~~

~~Amendment 188~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 3 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

3a. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit any relevant information that they have on that case, including but not limited to, facts and documentation that underlie their objection.

~~Or. en~~

~~Justification~~

~~EDPB para 108.~~

~~Amendment 189~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 3 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

~~Or. en~~

~~Justification~~

~~EDPB para 101.~~

~~Amendment 190~~

~~Proposal for a regulation~~

~~Article 22 – paragraph 3 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation, shall also apply during the periods referred in paragraph 3 of this Article.

~~Or. en~~

~~Justification~~

~~Wording suggestion from EDPB.~~

~~Amendment 191~~

~~Proposal for a regulation~~

~~Article 23~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 23~~

~~deleted~~

~~Registration in relation to a decision under Article 65(1), point (a), of Regulation (EU) 2016/679~~

The Chair of the Board shall register the referral of a subject-matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679 no later than one week after having received all of the following documents:

(a) the draft decision or revised draft decision subject to the relevant and reasoned objections;

(b) a summary of the relevant facts;

~~(c) view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;~~

▌

(d) views made in writing by ~~complainants,~~the parties under investigation, as the case may be, pursuant to Articles ~~11, 12~~14 and ~~15;~~17 at least to the extent they relate to the subject matter submitted to the Board;

~~(e) the retained relevant and reasoned objections;~~

(e) views made in writing by complainants, as the case may be, pursuant to Articles 11, 12, and 15 at least to the extent they relate to the subject matter submitted to the Board;

(f) the ~~reasons on~~relevant ~~the~~and ~~basis~~reasoned ofobjections which were not followed by the lead supervisory authority ~~did~~and ~~not~~the ~~follow~~objections that the ~~retained~~lead ~~relevant~~supervisory ~~and~~authority ~~reasoned~~has ~~objections.~~rejected as being not relevant or reasoned;

~~Or. en~~

(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or rejected the objections as not ▌relevant or reasoned.

~~Justification~~

▌

~~Covered by Article 22(2) and (3) now.~~

2a. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to the Board.

~~Amendment 192~~

3. The Board shall, within four weeks of being provided with the documents pursuant to paragraph 2, make a preliminary determination of whether the objections referred to in Article 65(1), point (a) are relevant and reasoned objections as defined in Article 4(24) of Regulation (EU) 2016/679 and whether they comply with Article 18 of this Regulation. Within the same period, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the file is registered, it shall be provided to the members of the Board.

~~Proposal for a regulation~~

3a. The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall not run during the period provided for in paragraph 3.

~~Article 24~~

▌

~~Text proposed by the Commission~~

Article 24 Hearing the party under investigation and the complainant prior to adoption of decision under Article 65(1), point (a), of Regulation (EU) 2016/679

~~Amendment~~

1. Prior to adopting the binding decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679, the ▌Board shall ▌provide the party under investigation, or, in case where the Board decision could result in the rejection of a complaint, the complainant, with the opportunity to make their views known in writing on any new factual or legal elements on which its decision is to be based, including on the relevant and reasoned objections which it intends to follow in its decision.

~~Article 24~~

2. Where parties under investigations or the complainant, as applicable, are provided with an opportunity to make their views known in accordance with paragraph 1, the Board shall set an appropriate time limit not longer than two weeks.

~~deleted~~

3. ▌The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall be suspended until the parties under investigation or the complainant, as applicable, have made their views known or until the expiry of the time limit referred to in paragraph 2 of this Article, whichever is earlier.

~~Statement of reasons prior to adoption of decision under Article 65(1), point (a), of Regulation (EU) 2016/679~~

▌

1. Prior to adopting the binding decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679, the Chair of the Board shall, through the lead supervisory authority, provide the parties under investigation and/or, in the case of full or partial rejection of a complaint, the complainant, with a statement of reasons explaining the reasoning the Board intends to adopt in its decision. Where the Board intends to adopt a binding decision requiring the lead supervisory authority to amend its draft decision or revised draft decision, the Board shall decide whether such statement of reasons should be accompanied by the retained relevant and reasoned objections on the basis of which the Board intends to adopt its decision.

Article 25 Procedure in relation to decision under Article 65(1), point (b), of Regulation (EU) 2016/679

2. The parties under investigation and/or, in the case of full or partial rejection of a complaint, the complainant, shall have one week from receipt of the statement of reasons referred to in paragraph 1 to make their views known.

1. When referring a subject-matter to the Board under Article 65(1), point (b), of Regulation (EU) 2016/679, the supervisory authority referring the subject-matter regarding the competence for the main establishment shall provide the Board with all of the following documents:

~~3. The deadline in paragraph 2 shall be extended by one week where the Board extends the period for adoption of the binding decision in accordance with Article 65(2) of Regulation (EU) 2016/679.~~

(a) a summary of the relevant facts, including regarding the processing at stake;

~~4. The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall not run during the periods provided for in paragraphs 2 and 3.~~

(b) the assessment of these facts as far as the conditions of Article 56(1) of Regulation (EU) 2016/679 are concerned, in particular the assessment as to whether the processing is to be considered as a cross-border processing and as to where the main establishment of the controller or processor is located;

~~Or. en~~

~~Justification~~

EDPB paras 143-153. “Statement of Reasons” is not defined, and the whole procedure would require the EDPB to take three decisions in extremely limited time, see para 150. EDPB para 153 therefore recommends to delete Article 24.

~~Amendment 193~~

~~Proposal for a regulation~~

~~Article 24 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 24a~~

~~Request for information by the Board~~

1. In cases in which the Board is otherwise unable to determine the matter, it may request further information from the parties or supervisory authorities, or it may conduct further factual investigations.

~~2. The deadlines in Article 65(2) of Regulation (EU) 2016/679 are extended for the duration of the procedure under paragraph 1, but no more than one month.~~

~~Or. en~~

~~Justification~~

~~Proposal from EDPS to replace the cumbersome procedure in Article 24.~~

~~Amendment 194~~

~~Proposal for a regulation~~

~~Article 25~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 25~~

~~deleted~~

~~Procedure in relation to decision under Article 65(1), point (b), of Regulation (EU) 2016/679~~

1. When referring a subject-matter to the Board under Article 65(1), point (b), of Regulation 2016/679, the supervisory authority referring the subject-matter regarding the competence for the main establishment shall provide the Board with all of the following documents:

~~(a) a summary of the relevant facts;~~

~~(b) the assessment of these facts as far as the conditions of Article 56(1) of Regulation (EU) 2016/679 are concerned;~~

(e) any other document or information the referring supervisory authority considers relevant and necessary in order to find a resolution on the subject-matter.

~~2. The Chair of the Board shall register the referral no later than one week after having received the documents referred to in paragraph 1.~~

1a. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to the Board.

~~Or. en~~

2. Within one week of being provided with the documents pursuant to paragraph 2, the Chair of the Board shall register the referral of the subject-matter submitted to it. As soon as the file is registered, it shall be provided to the members of the Board.

~~Justification~~

▌

~~Duplication with Article 22(2).~~

Article 26 Procedure in relation to decision under Article 65(1), point (c), of Regulation (EU) 2016/679

~~Amendment 195~~

1. When referring a subject-matter to the Board under Article 65(1), point (c), of Regulation (EU) 2016/679, the supervisory authority referring the subject-matter or the Commission shall provide the Board with all of the following documents:

~~Proposal for a regulation~~

~~Article 26~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 26~~

~~deleted~~

~~Procedure in relation to decision under Article 65(1), point (c), of Regulation (EU) 2016/679~~

1. When referring a subject-matter to the Board under Article 65(1), point (c), of Regulation 2016/679, the supervisory authority referring the subject-matter or the Commission shall provide the Board with all of the following documents:

(a) a summary of the relevant facts;

(b) the opinion, as the case may be, issued by the Board pursuant to Article 64 of Regulation (EU) 2016/679;

~~(c) the views of the supervisory authority referring the subject-matter or~~(ba) the ~~Commission as to whether,~~decision, as the case may be, ~~a supervisory authority was required to communicate the draft decision~~adopted toby the ~~Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a~~competent supervisory authority ~~did not follow~~following anthe opinion ofissued by the Board ~~issued~~ pursuant to Article 64 of Regulation (EU) ~~2016/679.~~2016/679;

~~2. The Chair of the Board shall request the following documents:~~

(c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an indication of which points were not followed and a reference to the relevant part of the adopted decision.

▌

2. The ▌Board shall request the following documents:

(a) the views of the supervisory authority alleged to have breached the requirement to communicate a draft decision to the Board or to have failed to follow an opinion of the Board;

(b) any other document or information the supervisory authority considers relevant and necessary in order to find a resolution on the subject-matter.

If any supervisory authority declares a need to submit its views on the referred ~~subject-matter,~~subjectmatter, it shall submit those views within two weeks of the referral referred to in paragraph 1.

~~3. The Chair of the Board shall register the referral no later than one week after having received the documents referred to in paragraphs 1 and 2.~~

2a. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to the Board.

~~Or. en~~

3. Within one week of being provided with the documents pursuant to paragraph 2, the Chair of the Board shall register the referral of the subject-matter submitted to it. As soon as the file is registered, it shall be provided to the members of the Board.

~~Justification~~

▌

~~Duplication with Article 22(2).~~

Chapter VI Urgency procedure

~~Amendment 196~~

Article 27 Urgent opinion under Article 66(2) of Regulation (EU) 2016/679

~~Proposal for a regulation~~

1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than four weeks prior to the expiry of provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679 and shall contain all of the following items:

~~Article 26 a (new)~~

(a) a summary of the relevant facts, including an allegation of an infringement of Regulation (EU) 2016/679;

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 26a~~

~~Procedural determinations by the Board~~

1. Without prejudice to Articles 65 and 66 of Regulation (EU) 2016/679, supervisory authorities may request from the Board to make a procedural determination on any dispute arising during a cooperation procedure, including whether a case meets the requirements of Article 56 of Regulation (EU) 2016/679.

2. Parties to the procedure may request from the Board to make a determination when no supervisory authority considers itself competent to handle a complaint under Article 55 or 56 of Regulation (EU) 2016/679 or in exceptional cases when a case can otherwise not progress, because a supervisory authority manifestly violates its duties under Regulation (EU) 2016/679 or this Regulation.

3. Where the lead supervisory authority is of the view that it cannot possibly comply with the deadline from Article 4(1b), especially because of the need for exceptionally complex factual investigations, it shall request from the Board a prolongation of up to twelve months. The supervisory authority shall submit a detailed plan of the investigation that demonstrates that despite its compliance with Article 2c(1) the prolongation sought is strictly necessary.

~~4. Requests under paragraph 2 and 3 shall be brought within two weeks from the delivery of the procedural determination or a rejection by a supervisory authority and must at least contain:~~

~~(a) the facts relied upon and any evidence available to the authority or party;~~

~~(b) the legal grounds for the request;~~

~~(c) the determination pursuant to paragraphs 1 and 2 or the prolongation pursuant to paragraph 3 that the authority or party requests from the Board;~~

5. Within two weeks,, the Board shall determine the matter based on the information before it or it shall reject the application if the requirements under paragraphs 1 to 4 are not fulfilled. Determinations are binding on the supervisory authorities.

~~Or. en~~

~~Justification~~

~~To avoid “deadlocked” cases, e.g. where SAs can’t agree on who is lead authority, etc. EDPS paras 108-111.~~

~~Amendment 197~~

~~Proposal for a regulation~~

~~Article 26 b (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 26b~~

~~Select Committees~~

1. The Board may appoint one or more select committees of three or more members, who can be part of the supervisory authorities or of the secretariat under Article 75 of Regulation (EU) 2016/679. The mandate of each of the committees is determined by the Board. Select committee Members perform their tasks under the instructions of the Board and may only be discharged by the Board.

2. In its rules of procedure, the Board may designate any tasks, such as determinations under Article 26a, or other tasks aimed at ensuring harmonised implementation of Regulation (EU) 2016/679 and this Regulation by the supervisory authorities, to the select committees and specify the procedures of the select committees further. Each of the committees shall present their findings to the Board.

~~Or. en~~

~~Justification~~

~~To avoid overloading the whole Board with little cases, e.g. missing documents etc.~~

~~Amendment 198~~

~~Proposal for a regulation~~

~~Article 26 c (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 26c~~

~~Right to an effective judicial remedy against a supervisory authority~~

1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy:

~~(a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure;~~

~~(b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or~~

~~(c) where a supervisory authority does not comply with a binding decision of the Board.~~

2. Any party to the procedure or a not-for-profit body under Article 80(1) of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) independently of an infringement of the rights of a data subject.

~~Or. en~~

~~Justification~~

~~To prevent cases from being dead-locked when a supervisory authority simply does not act.~~

~~Amendment 199~~

~~Proposal for a regulation~~

~~Article 27 – paragraph 1 – introductory part~~

~~Text proposed by the Commission~~

~~Amendment~~

1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks prior to the expiry of provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679 and shall contain all of the following items:

1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679 and shall contain all of the following items:

~~Or. en~~

~~Justification~~

~~To allow for more time for the EDPB, see EDPB paras 124-125~~

~~Amendment 200~~

~~Proposal for a regulation~~

~~Article 27 – paragraph 1 – point b~~

~~Text proposed by the Commission~~

~~Amendment~~

(b) a description of the provisional measure adopted on its own territory, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(b) a description of the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the opinion, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

~~Or. en~~

(c) a justification of the urgent need for final measures to be adopted ▌, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

~~Justification~~

▌

~~Aligned with Article 28, see EDPB para 118.~~

1a. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to the Board.

~~Amendment 201~~

1b. Within one week of being provided with the documents pursuant to paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the file is registered, it shall be provided to the members of the Board.

~~Proposal for a regulation~~

▌

~~Article 27 – paragraph 1 – point c~~

Article 28 Urgent binding decision under Article 66(2) of Regulation (EU) 2016/679

~~Text proposed by the Commission~~

1. A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than four weeks prior to the expiry of provisional measures adopted under Article 61(8), Article 62(7) or Article 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

~~Amendment~~

(a) a summary of the relevant facts, including allegation of an infringement of Regulation (EU) 2016/679;

(c) a justification of the urgent need for final measures to be adopted on the territory of the Member State of the requesting supervisory authority, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

~~(c) a justification of the urgent need for final measures to be adopted, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.~~

~~Or. en~~

~~Justification~~

~~In cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.~~

~~Amendment 202~~

~~Proposal for a regulation~~

~~Article 27 – paragraph 2~~

~~Text proposed by the Commission~~

~~Amendment~~

2. The urgent opinion of the Board shall be addressed to the supervisory authority that submitted the request. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the requesting authority to maintain or amend its provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

~~2. The urgent opinion of the Board shall be addressed to all supervisory authorities.~~

~~Or. en~~

~~Justification~~

In cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.“all supervisory authorities ” as in EDPB para 121, because EDPB opinions have general applicability. EDPB para 119.

~~Amendment 203~~

~~Proposal for a regulation~~

~~Article 28 – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Urgent decisions under Article 66(2) of Regulation (EU) 2016/679~~

~~Urgent binding decisions under Article 66(2) of Regulation (EU) 2016/679~~

~~Or. en~~

~~Justification~~

~~Aligned with wording of Article 66(2) GDPR.~~

~~Amendment 204~~

~~Proposal for a regulation~~

~~Article 28 – paragraph 1 – introductory part~~

~~Text proposed by the Commission~~

~~Amendment~~

1. A request for an urgent decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks prior to the expiry of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

1. A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

~~Or. en~~

~~Justification~~

~~“binding” aligned with wording of Article 66(2) GDPR.~~

~~Amendment 205~~

~~Proposal for a regulation~~

~~Article 28 – paragraph 1 – point b~~

~~Text proposed by the Commission~~

~~Amendment~~

(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting the provisional measures, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting it, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(c) information on any investigatory measures taken on its own territory and replies received from ▌the parties under investigation or any other information in the possession of the requesting supervisory authority;

~~Or. en~~

(d) a justification of the urgent need for final measures to be adopted ▌, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to comply with Article 61(5) or Article 62(2) of Regulation (EU) 2016/679 ▌

~~Justification~~

(e) where the requesting authority is not the lead supervisory authority, the views of the lead supervisory authority;

~~Aligned with Article 27, see EDPB para 118.~~

(f) where applicable, the views of the local establishment of the parties under investigation to which the provisional measures were addressed pursuant to Article 66(1) of Regulation (EU) 2016/679.

~~Amendment 206~~

1a. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to the Board.

~~Proposal for a regulation~~

~~Article 28 – paragraph 1 – point c~~

▌

~~Text proposed by the Commission~~

~~Amendment~~

(c) information on any investigatory measures taken on its own territory and replies received from the local establishment of the parties under investigation or any other information in the possession of the requesting supervisory authority;

(c) information on any investigatory measures taken on its own territory and replies received from the parties under investigation or any other information in the possession of the requesting supervisory authority;

~~Or. en~~

~~Justification~~

~~EDPB para 122~~

~~Amendment 207~~

~~Proposal for a regulation~~

~~Article 28 – paragraph 1 – point d~~

~~Text proposed by the Commission~~

~~Amendment~~

(d) a justification of the urgent need for final measures to be adopted on the territory of the requesting supervisory authority, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to respond to a request under Article 61(3) or 62(2) of Regulation (EU) 2016/679;

(d) a justification of the urgent need for final measures to be adopted on the territory of the requesting supervisory authority, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to provide the information requested under Article 61(5) of Regulation (EU) 2016/679 or failed to respond to a request under Article 62(2) of Regulation (EU) 2016/679;

~~Or. en~~

~~Justification~~

~~Wording suggestion by EDPB.~~

~~Amendment 208~~

~~Proposal for a regulation~~

~~Article 28 – paragraph 1 – point f~~

~~Text proposed by the Commission~~

~~Amendment~~

~~(f) where applicable, the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.~~

~~(f) where applicable, the views of the parties.~~

~~Or. en~~

~~Justification~~

~~Where applicable, all parties, including complainants, should be heard. EDPB para 128.~~

~~Amendment 209~~

~~Proposal for a regulation~~

~~Article 28 – paragraph 2~~

~~Text proposed by the Commission~~

~~Amendment~~

2. The urgent decision referred to in paragraph 1 shall be addressed to the supervisory authority that submitted the request and shall enable the requesting authority to maintain or amend its provisional measure.

2. The urgent binding decision referred to in paragraph 1 shall be addressed to the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

~~Or. en~~

~~Justification~~

~~“all the supervisory authorities concerned” as in EDPB para 121, so it applies everywhere where the cross-border processing takes place.~~

~~Amendment 210~~

~~Proposal for a regulation~~

~~Article 28 – paragraph 3~~

~~Text proposed by the Commission~~

~~Amendment~~

3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the lead supervisory authority shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

▌

~~Or. en~~

5. Where the urgent binding decision indicates that final measures do not urgently need to be adopted, the lead and supervisory authorities concerned shall follow the procedure in Article 60 of Regulation (EU) 2016/679.

~~Amendment 211~~

Article 28a Urgent opinion or urgent binding decision under Article 66(3) of Regulation (EU) 2016/679

~~Proposal for a regulation~~

1. A request for an urgent opinion or an urgent binding decision of the Board pursuant to Article 66(3) of Regulation (EU) 2016/679 shall contain all of the following items:

~~Article 28 – paragraph 4~~

(a) a summary of the relevant facts;

~~Text proposed by the Commission~~

(b) the justification of the urgent need to take appropriate measures in order to protect the rights and freedoms of data subjects, bearing in mind the exceptional circumstances requiring the adoption of such measures, in particular elements which the competent authority should have taken into account in order to protect the rights and freedoms of data subjects;

~~Amendment~~

(c) where relevant and available, information on any investigatory measures taken by the requesting supervisory authority on its own territory and replies received from the parties under investigation or any other information in the possession of the requesting supervisory authority;

4. The supervisory authority that submitted the request referred to in paragraph 1 shall notify its decision on the final measures to the establishment of the controller or processor on the territory of its Member State and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the lead supervisory authority of the final measure.

(d) the views of the competent supervisory authority referred to in Article 66(3) of Regulation (EU) 2016/679.

4. The supervisory authority that submitted the request referred to in paragraph 1 shall notify its decision on the final measures to the controller or processor and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the lead supervisory authority of the final measure.

2. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to the Board.

~~Or. en~~

3. Within one week of being provided with the documents pursuant to paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the file is registered, it shall be provided to the members of the Board.

~~Justification~~

▌

~~EDPB para 122~~

Chapter VII General and final provisions

~~Amendment 212~~

Article 28b Enforcement statistics on cross-border cases

~~Proposal for a regulation~~

1. As part of the annual report to be drawn up under Article 71 of Regulation (EU) 2016/679, the European Data Protection Board shall provide statistics on the enforcement of Regulation (EU) 2016/679 in cases falling under the scope of this Regulation, and in particular:

~~Article 29~~

(a) the number of complaint-based and ex officio procedures initiated;

~~Text proposed by the Commission~~

(b) the number of complaint-based and ex officio procedures concluded;

~~Amendment~~

(c) the number of investigations requested by concerned supervisory authorities pursuant to Article 61(1) of Regulation (EU) 2016/679;

~~Article 29~~

(d) the number of complaints lodged;

~~deleted~~

(e) the number of complaints fully or partially rejected or dismissed;

~~Beginning of time periods and definition of working day~~

(f) the average duration of ex officio and complaint-based procedures concluded;

1. Time-limits provided for in or fixed by the supervisory authorities pursuant to Regulation (EU) 2016/679 shall be calculated in accordance with Regulation (EEC, Euratom) No 1182/71 of the Council17 .

(g) the number and amounts of administrative fines imposed pursuant to Articles 83 and 84 of Regulation (EU) 2016/679.

~~2. Time periods shall begin on the working day following the event to which the relevant provision of Regulation (EU) 2016/679 or this Regulation refers.~~

▌

~~__________________~~

2. Where the statistics referred to in paragraph 1 are not directly available to the Board, the supervisory authorities shall, upon request, provide them to the Board in a timely manner.

~~17 Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits (OJ L 124, 8.6.1971, p. 1).~~

▌

~~Or. en~~

Article 29a Commission report

~~Justification~~

The Commission, as part of its report on the evaluation and review of the Regulation (EU) 2016/679 under Article 97 Regulation (EU) 2016/679, shall also report on the application and functioning of this regulation.

~~EDPB para 191 - Regulation No. 1182/71 applies anyway.~~

Article 30 Transitional provisions

~~Amendment 213~~

Chapters III and IV shall apply to ex officio investigations opened after 15 months after the date of entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after 15 months after the date of entry into force of this Regulation.

~~Proposal for a regulation~~

Chapters V and VI shall apply to all cases submitted to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after 15 months after the date of entry into force of this Regulation.

~~Article 30 – paragraph 1~~

▌

~~Text proposed by the Commission~~

Article 31 Entry into force and application

~~Amendment~~

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

~~Chapters III~~2. ~~and~~This IVRegulation shall apply ~~to ex officio~~from ~~investigations~~15 ~~opened~~months after ~~the entry into~~its ~~force~~date of ~~this Regulation and to complaint-based investigations where the complaint was lodged after the~~ entry into ~~force of this Regulation.~~force.

Chapters I, II and III shall apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

~~Or. en~~

Done at ...,

~~Justification~~

For the European Parliament For the Council

~~Following the introduction of new Articles in Chapters I and II.~~

The President The President

~~Amendment 214~~

~~Proposal for a regulation~~

~~Article 30 – paragraph 2~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Chapter V shall apply to all cases submitted to dispute resolution under Article 65 of Regulation (EU) 2016/679 after the entry into force of this Regulation.~~

Chapters V and VI shall apply to all cases submitted to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after the entry into force of this Regulation.

~~Or. en~~

~~Amendment 215~~

~~Proposal for a regulation~~

~~Article 30 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Article 30a~~

~~Evaluation and review~~

~~The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.~~

~~Or. en~~

~~Justification~~

~~While additional reports might be excessive, the reports on the GDPR must include an evaluation of the functioning of this Regulation. EDPB para 190.~~

~~Amendment 216~~

~~Proposal for a regulation~~

~~Article 31 – title~~

~~Text proposed by the Commission~~

~~Amendment~~

~~Entry into force~~

~~Entry into force and application~~

~~Or. en~~

~~Amendment 217~~

~~Proposal for a regulation~~

~~Article 31 – paragraph 1 a (new)~~

~~Text proposed by the Commission~~

~~Amendment~~

~~It shall apply from ... [one year from the date of entry into force of this Regulation].~~

~~Or. en~~

~~Justification~~

~~EDPB para 192 – transition period for necessary adjustments in EDPB secretariat and tools (IMI), national DPAs, and possibly national laws.~~

~~Amendment 218~~

~~Proposal for a regulation~~

~~Annex I~~

~~Text proposed by the Commission~~

~~Amendment~~

~~[...]~~

~~deleted~~

~~__________________~~

~~18 The complaint should be completed and submitted electronically or completed and submitted to the supervisory authority by post.~~

~~19 For example, passport, driving licence, national ID.~~

~~20 In the case a complaint is submitted by a body referred to in Article 80 of Regulation (EU) 2016/679, all of the information in point 2 should be provided.~~

~~Or. en~~

~~Justification~~

~~Instead of a mandatory form, there should be minimum requirements to ensure that the complaint can be processed by the LSA.~~

~~EXPLANATORY STATEMENT~~

~~Short Justification~~

~~Background~~

The General Data Protection Regulation seeks to harmonise the protection of fundamental rights and freedoms of natural persons in respect of processing of their data and to ensure the free flow of personal data between Member States. The Parliament has in the past expressed concerns with regard to “the uneven and sometimes non-existent enforcement of the GDPR by national [Data Protection Authorities] DPAs”. It underlined that lengthy procedures can produce an “adverse effect on effective enforcement and on citizens’ trust”, and, in particular for cross-border complaints, has suggested to establish “a common administrative procedure to handle complaints” to strengthen enforcement. The Commission proposal at hand for a GDPR Enforcement Procedures Regulation (GDPR-EPR) suggests to facilitate in particular cross-border cases. It also takes up demands of national DPAs to clarify and streamline cross-border procedures, as spelled out in the European Data Protection Board’s "Vienna Statement" from April 2022, the EDPB "Wish List" from October 2022, the European Data Protection Supervisor’s (EDPS) contribution from April 2023, and the EDPB-EDPS joint opinion on the Commission proposal from September 2023.

~~The Rapporteur’s Position~~

- The national procedural laws should continue to apply insofar as they are not in conflict with the GDPR-EPR, thereby ensuring more detailed rules such as on oral hearings continue to be valid, while national procedural standards are not lowered.

- The report consolidates and expands on the provisions on general procedural rules in a new Section 2 in Chapter I in order for the right to be heard, translations, confidentiality, and the sincere cooperation of authorities to always apply, not only in the case of complaints or for dispute resolution among authorities.

~~- The right to be heard is streamlined following Article 42(1) of the Charter on good administration, and applies to all parties of a case equally.~~

- A joint case file is introduced, containing all information relating to a case, and making them accessible to all parties and supervisory authorities, thus avoiding a back and forth of documents and ensuring all parties and authorities have the same, most current information, while internal deliberations of authorities and confidential information remain protected.

~~- In case new information or infringements are revealed over the course of an investigation, the scope of a case can be expanded.~~

- Amicable settlements are limited to cases of data subject rights, requiring the explicit agreement of the complainant, while not preventing ex-officio investigations of a supervisory authority for larger scale infringements of the GDPR.

- Deadlines and the respective roles and duties of a lead authority and other supervisory authorities are clarified, in particular with regard to procedures to draft a decision, to reach consensus, or to resolve disputes, including procedural determinations by the EDPB.

~~- A right to judicial remedies in case a competent supervisory authority does not act is introduced.~~

- The transition period of one year should allow for the necessary changes to the Internal Market Information System used by the authorities, and the Rules of Procedure of the Board, as well as possible amendments of national laws.

~~ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT~~

~~The following list is drawn up under the exclusive responsibility of the rapporteur. The rapporteur has received input from the following entities or persons in the preparation of the draft report:~~

~~Person (consented to having their name published)~~

~~Entity~~

~~Chiara Manfredi~~

~~Access Now~~

~~Fernando Hortal Foronda~~

~~BEUC~~

~~Claudia Canelles Quaroni~~

~~CCIA~~

~~DIGITALEUROPE~~

~~Francesco Bondi~~

~~DOT Europe~~

~~Diego Naranjo~~

~~EDRi~~

~~Enrico Girotto~~

~~FEDMA Federation of European Data and Marketing~~

~~Miglė Alenčikaitė (Blomeyer)~~

~~Google~~

~~Ines Talavera de la Esperanza~~

~~IAB Europe~~

~~Laura Pliauskaite~~

~~IAPP International Association of Privacy Professionals~~

~~Guillermo Ferrer Hernáez~~

~~Information Technology Industry Council (ITI)~~

~~Dr Johnny Ryan FRHistS~~

~~Irish Council for Civil Liberties~~

~~Max Schrems~~

~~NOYB None of Your Business~~

~~Clara Fecke~~

~~Rakuten~~