On the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

PR_COD_1amCom

Symbols for procedures

* Consultation procedure

*** Consent procedure

***I Ordinary legislative procedure (first reading)

***II Ordinary legislative procedure (second reading)

***III Ordinary legislative procedure (third reading)

(The type of procedure depends on the legal basis proposed by the draft act.)

Amendments to a draft act

Amendments by Parliament set out in two columns

Deletions are indicated in bold italics in the left-hand column. Replacements are indicated in bold italics in both columns. New text is indicated in bold italics in the right-hand column.

The first and second lines of the header of each amendment identify the relevant part of the draft act under consideration. If an amendment pertains to an existing act that the draft act is seeking to amend, the amendment heading includes a third line identifying the existing act and a fourth line identifying the provision in that act that Parliament wishes to amend.

Amendments by Parliament in the form of a consolidated text

New text is highlighted in bold italics. Deletions are indicated using either the ▌symbol or strikeout. Replacements are indicated by highlighting the new text in bold italics and by deleting or striking out the text that has been replaced.

By way of exception, purely technical changes made by the drafting departments in preparing the final text are not highlighted.

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

(COM(2023)0348 – C90231/2023 – 2023/0202(COD))

(Ordinary legislative procedure: first reading)

– having regard to the Commission proposal to Parliament and the Council (COM(2023)0348),

– having regard to Article 294(2) and Article 16 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90231/2023),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to the reasoned opinion submitted, within the framework of Protocol No 2 on the application of the principles of subsidiarity and proportionality, by the Swedish Parliament, asserting that the draft legislative act does not comply with the principle of subsidiarity,

– having regard to the opinion of the European Economic and Social Committee of 13 December 2023,

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the opinion of the Committee on Legal Affairs,

– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0045/2024),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Amendment 1

Proposal for a regulation

Recital 2

Text proposed by the Commission

Amendment

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board.

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

Amendment 2

Proposal for a regulation

Recital 2 a (new)

Text proposed by the Commission

Amendment

(2a) This Regulation and Chapter VII of Regulation (EU) 2016/679 only govern certain elements of the cooperation procedure, when supervisory authorities of more than one Member State participate in the procedure. This Regulation does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State.

Amendment 3

Proposal for a regulation

Recital 2 b (new)

Text proposed by the Commission

Amendment

(2b) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. Some procedural elements, such as the horizontal burden of proof of the controller in Article 5(2) of Regulation (EU) 2016/679, are already governed by Union law. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law. Supervisory authorities shall make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video participation, interpreters or generally available means of communication.

Amendment 4

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities should be created used so as to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Amendment 5

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post. The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679. No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible.

(4) In order to be admissible a complaint should contain certain minimum information about the alleged violation, whether ongoing or past. The cessation of a violation should not be sufficient grounds to reject a complaint. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint template should be provided. The information specified in the template should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the template may be used by supervisory authorities for cases that do not concern cross-border processing. The information may be submitted electronically or by post. No additional information should be required for a complaint to be deemed admissible. Where a complaint does not meet the minimum requirements, the supervisory authority should reject it and inform the complainant about the missing information. The complainant can then resubmit a complete complaint. While the complainant should not be required to contact the party under investigation before submitting a complaint, if the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she should submit the communication related to that contact. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

Amendment 6

Proposal for a regulation

Recital 5

Text proposed by the Commission

Amendment

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case.

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. Article 6 of the European Convention on Human Rights (ECHR) and Articles 41 and 47 of the Charter require a reasonable overall duration of procedures. Given that this includes judicial remedies under Article 78 of Regulation (EU) 2016/679, procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations for delays or disruptions that are outside of the control of the lead supervisory authority. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

Amendment 7

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5a) The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

Amendment 8

Proposal for a regulation

Recital 5 b (new)

Text proposed by the Commission

Amendment

(5b) To ensure that minimum requirements of fair and efficient procedures are met in all cross-border cases, including in Member States where there is no codified national procedural law, the Regulation sets directly applicable rules based on Article 41 of the Charter.

Amendment 9

Proposal for a regulation

Recital 5 c (new)

Text proposed by the Commission

Amendment

(5c) It should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why.

__________________

1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj).

Amendment 10

Proposal for a regulation

Recital 5 d (new)

Text proposed by the Commission

Amendment

(5d) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities in a spirit of common understanding and trust. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities. At the same time, the procedure should be in line with Regulation (EU) 2016/679, in particular the one-stop-shop dispute resolution architecture and the competences of the lead supervisory authority.

Amendment 11

Proposal for a regulation

Recital 5 e (new)

Text proposed by the Commission

Amendment

(5e) Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should however, not lead to any interference with the rights of the parties.

Amendment 12

Proposal for a regulation

Recital 5 f (new)

Text proposed by the Commission

Amendment

(5f) Violations may concern the rights of multiple data subjects, therefore, evidence from procedures may need to be used in other procedures to facilitate an efficient procedure and consistent decision making. In order to objectively assess the amount of non-material damages based on the average data subject, civil courts may benefit from relying on established facts and evidence to determine a claim under Article 82 of Regulation (EU) 2016/679.

Amendment 13

Proposal for a regulation

Recital 5 g (new)

Text proposed by the Commission

Amendment

(5g) Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the accepted languages.

Amendment 14

Proposal for a regulation

Recital 6

Text proposed by the Commission

Amendment

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be effective, proportionate and dissuasive in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective remedy to the complainant can be quickly delivered. Without prejudice to the necessity of providing a satisfactory resolution to the complainant within a short timeframe, supervisory authorities should investigate to a degree that allows them to satisfy themselves as to whether a complaint is indicative of more serious or systemic infringements. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision that can be submitted to judicial review.

Amendment 15

Proposal for a regulation

Recital 7

Text proposed by the Commission

Amendment

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant.

(7) The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information, as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one with which the complaint was lodged.

Amendment 16

Proposal for a regulation

Recital 8

Text proposed by the Commission

Amendment

(8) The competent supervisory authority should provide the complainant with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint.

(8) The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Amendment 17

Proposal for a regulation

Recital 9

Text proposed by the Commission

Amendment

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should endeavour, where appropriate, to resolve complaints by amicable settlement. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should bind the authorities. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be used to defer decisions on complaints.

Amendment 18

Proposal for a regulation

Recital 10

Text proposed by the Commission

Amendment

(10) In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679.

(10) In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679. This should be in line with the ‘one-stop-shop’ mechanism of Regulation (EU) 2016/679 and guarantee, where applicable, non-discriminatory treatment of parties, legal certainty and independence of issuing of decisions by the supervisory authorities.

Amendment 19

Proposal for a regulation

Recital 11

Text proposed by the Commission

Amendment

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the investigation as early as possible and prior to the communication of allegations to the parties under investigation and adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case via the summary of key issues and comments on that summary as early as possible and prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

Amendment 20

Proposal for a regulation

Recital 12

Text proposed by the Commission

Amendment

(12) Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority, with due regard for the margin of discretion enjoyed by each supervisory authority, including in the assessment of the extent appropriate to investigate a case, and for the varying traditions of the Member States. For this purpose, the lead supervisory authority should provide concerned supervisory authorities with a summary of key issues setting out its preliminary view on the main issues in an investigation. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned but at the same time at a stage where the lead supervisory authority’s views on the case are sufficiently mature. Concerned supervisory authorities should have the opportunity to provide their comments on a broad range of questions, such as the scope of the investigation and the identification of complex factual and legal assessments. Given that the scope of the investigation determines the matters which require investigation by the lead supervisory authority, supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

(12) Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority. The supervisory authority with which a complaint has been lodged or which requests an ex-officio action may provide the lead supervisory authority with a summary of key issues setting out its preliminary view on the main issues in an investigation. The lead supervisory authority should draft the final summary of key issues. The summary of key issues should be part of the joint case file, and should be a living document that is updated by the lead supervisory authority during the course of the procedure. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned. Concerned supervisory authorities should have the opportunity to provide their comments on any update of the summary of key issues. The supervisory authorities should be able to raise any dispute with the Board. Supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

Amendment 21

Proposal for a regulation

Recital 13

Text proposed by the Commission

Amendment

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, any documents submitted by concerned supervisory authorities and the parties should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. Supervisory authorities may therefore limit the length of submissions by the parties. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. .

Amendment 22

Proposal for a regulation

Recital 14

Text proposed by the Commission

Amendment

(14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

(14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the draft decision within three months from the receipt of the complaint.

Amendment 23

Proposal for a regulation

Recital 15

Text proposed by the Commission

Amendment

(15) Supervisory authorities should avail of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope of a complaint-based investigation, including the provisions of Regulation (EU) 2016/679 the infringement of which will be investigated, or where the comments of the supervisory authorities concerned relate to an important change in the complex legal or technological assessment, the concerned authority should use the tools provided for under Articles 61 and 62 of Regulation (EU) 2016/679.

(15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should raise the matter quickly with the Board. The Board should make the necessary procedural determinations. The Board and supervisory authorities should endeavour to complete ongoing proceedings as quickly as possible. The lead supervisory authority or one of the supervisory authorities concerned should also be able to request an urgent binding decision of the Board without a request under Articles 61 or 62 having been made.

Amendment 24

Proposal for a regulation

Recital 16

Text proposed by the Commission

Amendment

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the lead supervisory authority should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. For this purpose, the requirement of urgency should be presumed. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings. The urgent binding decision of the Board cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the rights of the parties under investigation to be heard. In particular, the Board should not extend the scope of the investigation on its own initiative.

deleted

Amendment 25

Proposal for a regulation

Recital 17

Text proposed by the Commission

Amendment

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, handling of any complaint should always lead to a decision which may be challenged before a national court.

Amendment 26

Proposal for a regulation

Recital 18

Text proposed by the Commission

Amendment

(18) Complainants should have the opportunity to express their views before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the non-confidential version of the documents on which the decision fully or partially rejecting the complaint is based.

deleted

Amendment 27

Proposal for a regulation

Recital 19

Text proposed by the Commission

Amendment

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed rejection of the complaint and should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also have the responsibility of preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Amendment 28

Proposal for a regulation

Recital 21

Text proposed by the Commission

Amendment

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shall have the right to decline the right to be heard.

Amendment 29

Proposal for a regulation

Recital 22

Text proposed by the Commission

Amendment

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them, by receiving access to the administrative file.

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the the right to be heard and opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to effectively comment on matters relevant to the investigation, by receiving access to the administrative joint case file.

Amendment 30

Proposal for a regulation

Recital 23

Text proposed by the Commission

Amendment

(23) The preliminary findings define the scope of the investigation and therefore the scope of any future final decision (as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a) of Regulation (EU) 2016/679) which may be addressed to controllers or processors. The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties under investigation have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the Article 65(1), point (a), decision resolving the dispute between the supervisory authorities. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties under investigation in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of defence rights.

(23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary to enable them to be heard is satisfied if the final decision only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a), of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Amendment 31

Proposal for a regulation

Recital 24

Text proposed by the Commission

Amendment

(24) The parties under investigation should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

(24) The parties should be provided with a right to be heard at appropriate stages of the procedure, in particular prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Amendment 32

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt the complaint does not bar the qualification of a data subject as complainant. However, an investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor does not constitute an adversarial procedure between the complainant and the parties under investigation. It is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are, therefore, not in the same procedural situation and the latter cannot invoke the right to a fair hearing when the decision does not adversely affect her or his legal position. The complainant’s involvement in the procedure against the parties under investigation cannot compromise the right of these parties to be heard.

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt of the complaint does not bar the qualification of a data subject as complainant.

Amendment 33

Proposal for a regulation

Recital 25 a (new)

Text proposed by the Commission

Amendment

(25a) Notwithstanding the fact that the parties under investigation and the complainant are not in the same procedural situation, there are circumstances in which complainants can be in a position to adduce arguments and evidence during an investigation which can help the progress of the investigation. This is particularly the case in circumstances in which a not-for-profit body, organisation or association has lodged a complaint on behalf of a data subject or on its own initiative under Article 80 of Regulation (EU) 2016/679. Supervisory authorities should facilitate the hearing of such complainants at all stages of the investigation, including ex officio investigations, while also maintaining their independence.

Amendment 34

Proposal for a regulation

Recital 26

Text proposed by the Commission

Amendment

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the administrative file.

deleted

Amendment 35

Proposal for a regulation

Recital 27

Text proposed by the Commission

Amendment

(27) When setting deadlines for parties under investigation and complainants to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, in order to ensure that the parties under investigation and complainants have sufficient opportunity to meaningfully provide their views on the issues raised.

(27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to unduly long procedures.

Amendment 36

Proposal for a regulation

Recital 28

Text proposed by the Commission

Amendment

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject. Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant and reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation.

deleted

Amendment 37

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length, should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

Amendment 38

Proposal for a regulation

Recital 30

Text proposed by the Commission

Amendment

(30) Access to the administrative file is provided for as a part of the rights of defence and the right to good administration enshrined in the Charter. Access to the administrative file should be provided to the parties under investigation when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

(30) Access to the joint case file may be provided for in the spirit of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties. Access of the parties to the joint case file may be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest. Such limitation must be proportionate in light of the respective recognised rights of others or the public interest pursued.

Amendment 39

Proposal for a regulation

Recital 31

Text proposed by the Commission

Amendment

(31) When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(31) When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information and the protection of information in the public interest in accordance with applicable national law. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information and provide a non-confidential version.

Amendment 40

Proposal for a regulation

Recital 33

Text proposed by the Commission

Amendment

(33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents listed in Article 23, the Chair of the Board should register the referral of the subject-matter in the sense of Article 65(2) of Regulation (EU) 2016/679.

(33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

Amendment 41

Proposal for a regulation

Recital 34

Text proposed by the Commission

Amendment

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in a way which allows the lead supervisory authority to adopt its final decision on the basis of the decision of the Board while maintaining its discretion.

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Amendment 42

Proposal for a regulation

Recital 36

Text proposed by the Commission

Amendment

(36) In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board.

(36) In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board. Provisional measures pursuant to Article 66(1) of Regulation (EU) 2016/679 should include all possible measures within the powers of supervisory authorities, pursuant to Article 58 of that Regulation.

Amendment 43

Proposal for a regulation

Recital 36 a (new)

Text proposed by the Commission

Amendment

(36a) The Board should be able to request any further information from supervisory authorities necessary for it to take a binding decision.

Amendment 44

Proposal for a regulation

Recital 36 b (new)

Text proposed by the Commission

Amendment

(36b) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

Amendment 45

Proposal for a regulation

Recital 38

Text proposed by the Commission

Amendment

(38) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on [ ],

(38) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on 19 September 2023,

Amendment 46

Proposal for a regulation

Section 1 a (new)

Text proposed by the Commission

Amendment

Section 1a

Subject matter, scope, and definitions

Amendment 47

Proposal for a regulation

Article 1 – title

Text proposed by the Commission

Amendment

Article 1

Article 1

Subject matter

Subject matter and scope

Amendment 48

Proposal for a regulation

Article 1 – paragraph 1

Text proposed by the Commission

Amendment

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities whenever supervisory authorities of more than one Member State are involved in the case, as well as procedural rules on related judicial remedies.

Amendment 49

Proposal for a regulation

Article 1 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

Article 26b of this Regulation also applies to cases before a supervisory authority of a single Member State, pursuant to Article 56(2) of Regulation (EU) 2016/679.

Amendment 50

Proposal for a regulation

Article 2 – paragraph 2 – point 1

Text proposed by the Commission

Amendment

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;

(1) ‘party under investigation’ means the controller(s) and/or processor(s) complained about, or investigated for alleged infringement of Regulation (EU) 2016/679, as well as their representative(s);

Amendment 51

Proposal for a regulation

Article 2 – paragraph 2 – point 1 a (new)

Text proposed by the Commission

Amendment

(1a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the proceedings;

Amendment 52

Proposal for a regulation

Article 2 – paragraph 2 – point 1 b (new)

Text proposed by the Commission

Amendment

(1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party involved in the proceedings as defined under national law;

Amendment 53

Proposal for a regulation

Article 2 – paragraph 2 – point 1 c (new)

Text proposed by the Commission

Amendment

(1c) ‘national procedural law’ means laws, regulations and administrative provisions of the Member State that regulate the procedure before a supervisory authority;

Amendment 54

Proposal for a regulation

Article 2 – paragraph 2 – point 1 d (new)

Text proposed by the Commission

Amendment

(1d) ‘complaints procedure’ means a procedure determining the outcome of a complaint under Article 77 of Regulation (EU) 2016/679;

Amendment 55

Proposal for a regulation

Article 2 – paragraph 2 – point 1 e (new)

Text proposed by the Commission

Amendment

(1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1), point (a), of Regulation (EU) 2016/679;

Amendment 56

Proposal for a regulation

Article 2 – paragraph 2 – point 1 f (new)

Text proposed by the Commission

Amendment

(1f) ‘joint case file’ means a dedicated electronic file for any case falling under the scope of this Regulation, that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case, are stored and made remotely accessible to supervisory authorities concerned and parties to the case;

Amendment 57

Proposal for a regulation

Article 2 – paragraph 2 – point 1 g (new)

Text proposed by the Commission

Amendment

(1g) ‘complaint-receiving authority’ means the supervisory authority with which the complaint has been lodged as referred to in Article 4(22), point (c), of Regulation (EU) 2016/679;

Amendment 58

Proposal for a regulation

Article 2 – paragraph 2 – point 2

Text proposed by the Commission

Amendment

(2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned identifying the main relevant facts and the lead supervisory authority’s views on the case;

(2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned, identifying the main relevant factual and legal issues within the preliminary scope of the investigation and the lead supervisory authority’s factual and legal views on the case;

Amendment 59

Proposal for a regulation

Article 2 – paragraph 2 – point 3

Text proposed by the Commission

Amendment

(3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties under investigation setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

(3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

Amendment 60

Proposal for a regulation

Article 2 – paragraph 2 – point 4 a (new)

Text proposed by the Commission

Amendment

(4a) ‘confidential version of a document’ means a document containing confidential or sensitive information which may be subject to legal privilege under the applicable Union or national law and data protection rules;

Amendment 61

Proposal for a regulation

Article 2 – paragraph 2 – point 4 b (new)

Text proposed by the Commission

Amendment

(4b) ‘non-confidential version of a document’ means a version of a document from which confidential or sensitive information has been redacted and which can be provided to the complainant without breaching Union or national law or data protection rules.

Amendment 62

Proposal for a regulation

Section 1 b (new) – title

Text proposed by the Commission

Amendment

Section 1b

Procedural rules

Amendment 63

Proposal for a regulation

Article 2 a (new)

Text proposed by the Commission

Amendment

Article 2a

Applicable Procedural Law

1. In addition to this Regulation, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. This Regulation shall not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.

2. This Regulation and Regulation (EU) 2016/679 and govern the interaction between supervisory authorities of different Member States that falls within the scope of this Regulation.

3. A complainant shall have the right to communicate exclusively with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679.

Amendment 64

Proposal for a regulation

Article 2 b (new)

Text proposed by the Commission

Amendment

Article 2b

Common procedural standards

1. Without prejudice to additional rights under national procedural law, each party shall have at least the following rights:

(a) to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure”);

(b) to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“right to be heard”);

(c) to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“procedural transparency”).

2. The lead supervisory authority shall inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority.

3. The joint case file shall include all evidence, inculpatory and exculpatory, including documents and other evidence provided by the parties under investigation.

4. On the request of a party to protect their legally recognised rights or to protect the rights of others, or when it is in the public interest or in order to protect operational security and cybersecurity a supervisory authority may limit the rights referred to in paragraph 1, point (c). Any such limitation shall be carried out in accordance with the national procedural law applicable under Article 2a(1) to any direct interaction between a supervisory authority and the party receiving limited information, and must be proportionate in light of the respective recognised rights of others or the public interest pursued. The party claiming confidentiality shall provide a confidential version of any information, as well as a suggested non-confidential version.

5. The non-confidential version of documents that were provided by a party shall be determined by the supervisory authority making a determination pursuant to first sentence of paragraph 4, applying only strictly proportionate measures, such as redacting specific parts of documents.

6. Supervisory authorities concerned shall always have access to the confidential version of all documents, and may object to redactions that they consider not strictly proportionate. Supervisory authorities pursuant to first sentence of paragraph 4 shall immediately inform the parties about the fact that information is withheld. The lead supervisory authority shall keep records of each access to the joint case file.

7. In the interest of efficiency of procedures, supervisory authorities shall limit the length of submissions by the parties to not more than 50 pages. Those authorities shall set reasonable and appropriate time limits not shorter than three weeks and not longer than six weeks, unless exceptional circumstances require a reasonable extension. The supervisory authorities shall not be obliged to take into account written views received after the expiry of that time-limit.

8. The lead supervisory authority may join and separate cases in accordance with national procedural law, insofar as this does not undermine the rights of the parties.

Amendment 65

Proposal for a regulation

Article 2 c (new)

Text proposed by the Commission

Amendment

Article 2c

Cooperation between supervisory authorities

1. The lead supervisory authority shall structure, coordinate and manage the case in an efficient and expedient way, in accordance with Regulation (EU) 2016/679, this Regulation and any applicable national procedural law.

2. Any supervisory authority may declare that it is concerned, setting out the reasons why it meets the definition of a supervisory authority concerned under Article 4(22) of Regulation (EU) 2016/679. The lead supervisory authority shall maintain a list of supervisory authorities concerned for each case in the joint case file.

Where the lead supervisory authority considers that a supervisory authority which has made a declaration that it is concerned according to this paragraph does not meet the definition of a supervisory authority concerned, it shall inform that authority of its assessment. The supervisory authority which declared that it is concerned shall within one week of receiving that assessment either withdraw its declaration, or produce a reasoned opinion setting out the reasons why it considers the assessment of the lead supervisory authority to be incorrect. Where the diverging assessments of the lead supervisory authority and the supervisory authority which declared to be concerned cannot be resolved in a different manner, the lead supervisory authority shall request a determination of the Board under Article 26a.

3. Any supervisory authority concerned which receives relevant information for a case shall provide it to the lead supervisory authority without delay, but no later than one week from the day that it received such information.

4. Where diverging views cannot be overcome or in the case of inactivity of another supervisory authority, supervisory authorities shall use the powers intended for resolution of such situations under this Regulation and under Chapter VII of Regulation (EU) 2016/679.

5. All written documents by the supervisory authorities shall be provided by electronic means and in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Amendment 66

Proposal for a regulation

Article 2 d (new)

Text proposed by the Commission

Amendment

Article 2d

Use of Languages and Translations

1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation between authorities (“cooperation language”).

2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts.

3. The lead supervisory authority shall provide submissions into the joint case file in the original language, and shall provide translations into the cooperation language.

4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication.

5. A supervisory authority may provide automated translations, if it finds that the automated translation is not substantially different from the original.

6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State.

Amendment 67

Proposal for a regulation

Article 3 – paragraph 1

Text proposed by the Commission

Amendment

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

1. A complaint subject to this Regulation shall provide the information required in the template, as set out in the Annex.

No additional information shall be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.

Amendment 68

Proposal for a regulation

Article 3 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The complainant shall not be required to contact the party under investigation before submitting a complaint. Where the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she shall submit the communication related to that contact pursuant to the Annex.

Amendment 69

Proposal for a regulation

Article 3 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. The supervisory authority with which a complaint has been lodged shall, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

Amendment 70

Proposal for a regulation

Article 3 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

1c. The supervisory authority shall attribute a case number to the complaint and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c), point (i).

Amendment 71

Proposal for a regulation

Article 3 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.

2. The supervisory authority with which the complaint has been lodged shall, within three weeks after acknowledging the admissibility of the complaint pursuant to paragraph 1b:

Amendment 72

Proposal for a regulation

Article 3 – paragraph 2 – point a (new)

Text proposed by the Commission

Amendment

(a) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant, considering at least the following:

(i) relevant controller or processor for the processing in question;

(ii) number of establishments of the controller or processor in the EU;

(iii) place of the main establishment;

(iv) activities of establishments in more than one Member State;

(v) substantial effect or likely substantial effect on data subjects in more than one Member State.

Amendment 73

Proposal for a regulation

Article 3 – paragraph 2 – point b (new)

Text proposed by the Commission

Amendment

(b) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

Amendment 74

Proposal for a regulation

Article 3 – paragraph 2 – point c (new)

Text proposed by the Commission

Amendment

(c) take one of the following actions:

(i) transmit the complaint to the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679 and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority; or

(ii) handle the complaint under Article 56(2) of Regulation (EU) 2016/679.

Amendment 75

Proposal for a regulation

Article 3 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. The lead supervisory authority shall immediately provide the complaint to the party under investigation and request a reply without undue delay, but no later than three weeks from the day the party under investigation was informed by the lead supervisory authority. In complex cases, and where requested and duly justified by the party under investigation, the time for replying can be extended by the lead supervisory authority by another three weeks.

Amendment 76

Proposal for a regulation

Article 3 – paragraph 2 b (new)

Text proposed by the Commission

Amendment

2b. The parties or the assumed lead supervisory authority shall raise any objection in relation to the competence of the assumed lead supervisory authority or to the handling of a complaint under Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the action taken pursuant to Article 3(2), point (c).

Amendment 77

Proposal for a regulation

Article 3 – paragraph 2 c (new)

Text proposed by the Commission

Amendment

2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were taken, or where differing assessments of the supervisory authorities involved cannot be resolved otherwise, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a. It shall provide the Board with a description of relevant processing activities, of the company's organisation and a description of where decisions are taken.

Amendment 78

Proposal for a regulation

Article 3 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.

deleted

Amendment 79

Proposal for a regulation

Article 3 – paragraph 4

Text proposed by the Commission

Amendment

4. Upon assessment of the completeness of the information required by the Form, the supervisory authority with which the complaint was lodged shall transmit the complaint to the lead supervisory authority.

deleted

Amendment 80

Proposal for a regulation

Article 3 – paragraph 5

Text proposed by the Commission

Amendment

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also submit a non-confidential version of the complaint.

deleted

Amendment 81

Proposal for a regulation

Article 3 – paragraph 6

Text proposed by the Commission

Amendment

6. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

deleted

Amendment 82

Proposal for a regulation

Chapter II – title

Text proposed by the Commission

Amendment

II Submission and handling of complaints

II Complaints and ex officio procedures

(Heading “Chapter II” is placed after article 3 and its title is changed)

Amendment 83

Proposal for a regulation

Article 4 – title

Text proposed by the Commission

Amendment

Investigation of complaints

Handling of complaints

Amendment 84

Proposal for a regulation

Article 4 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

While assessing the extent appropriate to which a complaint should be investigated in each case the supervisory authority shall take into account all relevant circumstances, including all of the following:

1. While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall endeavour to ensure the following:

Amendment 85

Proposal for a regulation

Article 4 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the expediency of delivering an effective and timely remedy to the complainant;

(a) the delivery of an effective and timely remedy to the complainant;

Amendment 86

Proposal for a regulation

Article 4 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) the gravity of the alleged infringement;

(b) the investigation of relevant factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7), (8) and (9) of Regulation (EU) 2016/679;

Amendment 87

Proposal for a regulation

Article 4 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the systemic or repetitive nature of the alleged infringement.

(c) the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemic, grave or repetitive infringements.

Amendment 88

Proposal for a regulation

Article 4 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Amendment 89

Proposal for a regulation

Article 4 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. The lead supervisory authority shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, and no later than nine months from the receipt of the complaint.

This deadline may exceptionally be extended by:

(a) eight weeks when comments under Article 9(3) are submitted with regard to a summary of key issues or an updated summary of key issues;

(b) eight weeks where the lead supervisory authority intends to issue fines or other penalties;

(c) the period of time between a reference under Article 26a(1) or (2) and the decision by the Board;

(d) the period of any prolongation permitted by the Board under Article 26a(3).

Each extension under points (a) to (d) may only be done once.

Amendment 90

Proposal for a regulation

Article 4 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

1c. Paragraph 1b shall not apply once a case is submitted to the consistency mechanism in accordance with Article 60(4) of Regulation (EU) 2016/679.

Amendment 91

Proposal for a regulation

Article 5 – paragraph 1

Text proposed by the Commission

Amendment

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

1. A complaint may be resolved by amicable settlement between the complainant and the party under investigation at any stage of the proceedings. The complaint-receiving or the lead supervisory authority may encourage and facilitate that voluntary process.

Amendment 92

Proposal for a regulation

Article 5 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. Where an amicable settlement to the complaint has been found, the parties shall within one month communicate the settlement to the lead supervisory authority and the supervisory authority where the complaint has been lodged.

Amendment 93

Proposal for a regulation

Article 5 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. Within one month after the communication of the amicable settlement under paragraph 1a, a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679 shall be submitted, indicating:

(a) whether the conditions of an amicable settlement under paragraph 1a are fulfilled, and

(b) whether to open an ex officio investigation under paragraph 1d.

Amendment 94

Proposal for a regulation

Article 5 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

1c. Where, within one month, none of the other supervisory authorities concerned have objected to the draft decision under paragraph 1b or the Board confirms the amicable settlement in the procedure under Article 65(1), point (a) of Regulation (EU) 2016/679, the complaint shall be deemed withdrawn and the settlement shall become valid.

Amendment 95

Proposal for a regulation

Article 5 – paragraph 1 d (new)

Text proposed by the Commission

Amendment

1d. An amicable settlement does not prevent the lead supervisory authority from conducting an ex officio investigation in the same matter. It may open an ex officio investigation instead, in particular where:

(a) the party under investigation is a repeat offender;

(b) the party under investigation has been the subject of a large number of other amicable settlements;

(c) the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, is of long duration, or is of serious nature; or

(d) the exercise of powers is otherwise required to ensure effective, proportionate and dissuasive enforcement of Regulation (EU) 2016/679.

Amendment 96

Proposal for a regulation

Article 5 a (new)

Text proposed by the Commission

Amendment

Article 5a

Request for an ex officio procedure

1. Where it considers that Regulation (EU) 2016/679 may be violated and data subjects in the territory of its Member State are affected, any supervisory authority concerned may request an ex officio procedure by submitting a written request for a discretionary action pursuant to paragraph 2 to the lead supervisory authority. Such a request shall contain at least:

(a) a declaration to be a supervisory authority concerned, and

(b) a summary of key issues pursuant to Article 9.

2. Within three weeks, the assumed lead supervisory authority shall:

(a) inform the supervisory authority concerned that it has opened an ex officio procedure;

(b) inform the supervisory authority concerned that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself; or

(c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no prima facie violation of Regulation (EU) 2016/679.

In the case referred to in point (a) of this paragraph, the supervisory authority concerned may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679.

In the cases referred to in point (b) and (c) of this paragraph, the supervisory authority concerned may resubmit an amended request for an ex officio procedure, or request a determination on the opening of the procedure by the Board in accordance with Article 26a(1).

3. Where the lead supervisory authority opens an ex officio procedure, it shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, but no later than nine months from the receipt of the request pursuant to paragraph 1. This deadline may exceptionally be extended by:

(a) eight weeks when comments under Article 9(3) are submitted against a summary of key issues or an updated summary of key issues;

(b) eight weeks where the lead supervisory authority intends to issue fines or other penalties;

(c) the period of time between a reference under Article 26a and the decision by the Board;

(d) the period of any prolongation permitted by the Board under Article 26a(3).

Amendment 97

Proposal for a regulation

Article 6

Text proposed by the Commission

Amendment

Article 6

deleted

Translations

1. The supervisory authority with which the complaint was lodged shall be responsible for:

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;

(b) translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

2. In its rules of procedure, the Board shall determine the procedure for the translation of comments or relevant and reasoned objections expressed by supervisory authorities concerned in a language other than the language used by the lead supervisory authority for the purposes of the investigation.

Amendment 98

Proposal for a regulation

Chapter III – title

Text proposed by the Commission

Amendment

Cooperation under Article 60 of Regulation (EU) 2016/679

Cooperation under Article 60 of Regulation (EU) 2016/679 and with other relevant authorities

Amendment 99

Proposal for a regulation

Article 7 – paragraph 2

Text proposed by the Commission

Amendment

The provisions in this section concern the relations between supervisory authorities and are not intended to confer rights on individuals or the parties under investigation.

deleted

Amendment 100

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

1. The lead supervisory authority shall provide the other supervisory authorities concerned with instant, unrestricted and continuous remote access to the full joint case file, and shall include in the joint case file all relevant information, in particular documents, submissions, memos and other information related to the case within one week from producing or receiving them.

Amendment 101

Proposal for a regulation

Article 8 – paragraph 2 – introductory part

Text proposed by the Commission

Amendment

2. Relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679 shall include, where applicable:

2. The lead supervisory authority shall actively provide and notify the other supervisory authorities concerned and, where necessary for dispute resolution under Article 65 of Regulation (EU) 2016/679, the Board, with relevant information within the meaning of Article 60(1) and (3) of that Regulation, within one week from producing or receiving it. This information shall cover information on major steps in the procedure, including where applicable:

Amendment 102

Proposal for a regulation

Article 8 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) information on the opening of an investigation of an alleged infringement of Regulation (EU) 2016/679;

(a) information on the opening of an ex officio investigation or of a complaints procedure;

Amendment 103

Proposal for a regulation

Article 8 – paragraph 2 – point e

Text proposed by the Commission

Amendment

(e) summary of key issues in an investigation in accordance with Article 9;

(e) the issuing or updating of the summary of key issues in an investigation in accordance with Article 9;

Amendment 104

Proposal for a regulation

Article 8 – paragraph 2 – point e a (new)

Text proposed by the Commission

Amendment

(ea) any comments to a summary of key issues in accordance with Article 9(3);

Amendment 105

Proposal for a regulation

Article 8 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings;

(f) information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision;

Amendment 106

Proposal for a regulation

Article 8 – paragraph 2 – point i

Text proposed by the Commission

Amendment

(i) the views of the complainant on the preliminary findings;

(i) the views of the complainant on the non-confidential version of the preliminary findings and, if applicable, other aspects of the investigation on which formal written submissions have been made by the complainant;

Amendment 107

Proposal for a regulation

Article 8 – paragraph 2 – point k a (new)

Text proposed by the Commission

Amendment

(ka) any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;

Amendment 108

Proposal for a regulation

Article 8 – paragraph 2 – point k b (new)

Text proposed by the Commission

Amendment

(kb) any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;

Amendment 109

Proposal for a regulation

Article 8 – paragraph 2 – point k c (new)

Text proposed by the Commission

Amendment

(kc) any judicial remedy brought during a procedure under Article 60 of Regulation (EU) 2016/679 or against a decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Amendment 110

Proposal for a regulation

Article 9 – paragraph 1

Text proposed by the Commission

Amendment

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

1. Within four weeks after having received a complaint, or a request to open an ex officio procedure, the lead supervisory authority shall draft a summary of key issues that presumably need to be determined in order to decide the case, for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679, and provide this summary to the supervisory authorities concerned. The summary shall be drafted in an impartial way, taking into account any diverging facts and arguments. When transferring a case to the lead supervisory authority pursuant to Article 3(2), point (c), point (i), the concerned supervisory authority may provide a draft of a summary of key issues, which is not binding on the lead supervisory authority.

Amendment 111

Proposal for a regulation

Article 9 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the main relevant facts;

(a) the relevant facts;

Amendment 112

Proposal for a regulation

Article 9 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which will be investigated;

(b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement, and, where applicable, an indication of whether they appear to have been infringed;

Amendment 113

Proposal for a regulation

Article 9 – paragraph 2 – point c

Text proposed by the Commission

Amendment

(c) identification of complex legal and technological assessments which are relevant for preliminary orientation of their assessment;

(c) preliminary factual or legal assessments, dealing with all relevant views as expressed by parties when the summary is drafted, and including relevant European case law, as well as guidelines, recommendations and best practices issued by the Board;

Amendment 114

Proposal for a regulation

Article 9 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any factual or legal changes that emerge during the course of the procedure.

Amendment 115

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues.

3. The supervisory authorities concerned may provide factual or legal comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update of it, in accordance with Article 60 of Regulation (EU) 2016/679.

Amendment 116

Proposal for a regulation

Article 9 – paragraph 4

Text proposed by the Commission

Amendment

4. Comments provided pursuant to paragraph 3 shall meet the following requirements:

deleted

(a) language used is sufficiently clear and contains precise terms to enable the lead supervisory authority, and, as the case may be, supervisory authorities concerned, to prepare their positions;

(b) legal arguments are set out succinctly and grouped by reference to the part of the summary of key issues to which they relate;

(c) the comments of the supervisory authority concerned may be supported by documents, which may supplement the comments on specific points.

Amendment 117

Proposal for a regulation

Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. The Board may specify in its rules of procedure restrictions on the maximum length of comments submitted by supervisory authorities concerned on the summary of key issues.

deleted

Amendment 118

Proposal for a regulation

Article 9 – paragraph 6

Text proposed by the Commission

Amendment

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article which challenge the summary of key issues or raise other important factual or legal questions shall be considered non-contentious cases. In such cases, the deadline to issue a draft decision referred to in Article 4(1b) shall be 3 months.

Amendment 119

Proposal for a regulation

Chapter III – Section 2 – title

Text proposed by the Commission

Amendment

Full or partial rejection of complaints

Cooperation with other relevant authorities

(Heading “Section II” is placed after Article 9 and its title is changed)

Amendment 120

Proposal for a regulation

Article 10 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. A supervisory authority concerned shall make a request to the lead supervisory authority under Article 61 of Regulation (EU) 2016/679, Article 62 of Regulation (EU) 2016/679, or both, where, following the comments of supervisory authorities concerned pursuant to Article 9(3), a supervisory authority concerned disagrees with the assessment of the lead supervisory authority on:

1. A supervisory authority concerned shall make a request to the lead supervisory authority under Article 61 or Article 62 of Regulation (EU) 2016/679, or both, where, following the comments of supervisory authorities concerned pursuant to Article 9(3), a supervisory authority concerned disagrees with the assessment of the lead supervisory authority on:

Amendment 121

Proposal for a regulation

Article 10 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) preliminary orientation in relation to complex legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

(b) preliminary factual or legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

Amendment 122

Proposal for a regulation

Article 10 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) preliminary orientation in relation to complex technological assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c).

deleted

Amendment 123

Proposal for a regulation

Article 10 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(ca) preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

Amendment 124

Proposal for a regulation

Article 10 – paragraph 3

Text proposed by the Commission

Amendment

3. The lead supervisory authority shall engage with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings or, where applicable, provide the supervisory authority with which the complaint was lodged with its reasoning for the purposes of Article 11(2).

3. In cases not falling under Article 9(6) of this Regulation, the lead supervisory authority shall investigate facts relevant for diverging views and engage, making its best effort, with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings.

Amendment 125

Proposal for a regulation

Article 10 – paragraph 4

Text proposed by the Commission

Amendment

4. Where, in a complaint-based investigation, there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matter referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

4. Where within four weeks after the expiry of the deadlines for comments, the procedure provided for in paragraph 3 of this Article fails to generate consensus between the lead supervisory authority and one or more supervisory authorities concerned on the matters referred to in Article 9(2), the lead supervisory authority or a supervisory authority concerned shall request a procedural determination of the Board under Article 26a of this Regulation.

Amendment 126

Proposal for a regulation

Article 10 – paragraph 5 – introductory part

Text proposed by the Commission

Amendment

5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the lead supervisory authority shall provide all of the following:

5. When requesting a procedural determination of the Board pursuant to paragraph 4 of this Article, the requesting supervisory authority shall provide all of the following:

Amendment 127

Proposal for a regulation

Article 10 – paragraph 5 – point a

Text proposed by the Commission

Amendment

(a) the documents referred to in Article 9(2), points (a) and (b);

(a) the relevant information referred to in Article 9(2), including any updates when they occur;

Amendment 128

Proposal for a regulation

Article 10 – paragraph 5 – point b

Text proposed by the Commission

Amendment

(b) the comments of the supervisory authority concerned that disagrees with the lead supervisory authority’s preliminary identification of the scope of the investigation.

(b) the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation or the factual or legal assessment of the elements of the summary of key issues referred to in Article 9(2);

Amendment 129

Proposal for a regulation

Article 10 – paragraph 5 – point b a (new)

Text proposed by the Commission

Amendment

(ba) access to the joint case file.

Amendment 130

Proposal for a regulation

Article 10 – paragraph 5 a (new)

Text proposed by the Commission

Amendment

5a. The Board may request the supervisory authorities to provide other documents or information, as it deems appropriate in the particular case.

Amendment 131

Proposal for a regulation

Article 10 – paragraph 6

Text proposed by the Commission

Amendment

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

6. The Board shall adopt an urgent binding decision on the summary of key issues or on extending the period referred to in paragraph 4, in accordance with Article 26a, on the basis of all documents received.

Amendment 132

Proposal for a regulation

Article 10 a (new)

Text proposed by the Commission

Amendment

Article 10a

Cooperation with other relevant authorities

Supervisory authorities shall strive to communicate non-personal information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in data protection and other areas, including competition, financial services, energy, telecommunications, consumer protection, digital services, or artificial intelligence supervisory authorities, where the information is deemed relevant to the tasks and duties of those authorities, in particular for opening administrative procedures and investigations into possible violations of legislation under their competences. Information can be only used for the purposes of which it was gathered. However, that does not preclude the supervisory authority to initiate other proceedings based on that information or to share it with other authorities for that purpose.

Amendment 133

Proposal for a regulation

Article 11

Text proposed by the Commission

Amendment

Article 11

deleted

Hearing of complainant prior to full or partial rejection of a complaint

1. Following the procedure provided for in Article 9 and 10, the lead supervisory authority shall provide the supervisory authority with which the complaint was lodged with the reasons for its preliminary view that the complaint should be fully or partially rejected.

2. The supervisory authority with which the complaint was lodged shall inform the complainant of the reasons for the intended full or partial rejection of the complaint and set a time-limit within which the complainant may make known her or his views in writing. The time-limit shall be no less than three weeks. The supervisory authority with which the complaint was lodged shall inform the complainant of the consequences of the failure to make her or his views known.

3. If the complainant fails to make known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged, the complaint shall be deemed to have been withdrawn.

4. The complainant may request access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

Amendment 134

Proposal for a regulation

Article 12

Text proposed by the Commission

Amendment

Article 12

deleted

Revised draft decision fully or partially rejecting a complaint

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements.

2. The supervisory authority with which the complaint was lodged shall set a time-limit within which the complainant may make known her or his views.

Amendment 135

Proposal for a regulation

Article 13

Text proposed by the Commission

Amendment

Article 13

deleted

Decision fully or partially rejecting a complaint

When adopting a decision fully or partially rejecting a complaint in accordance with Article 60(8) of Regulation (EU) 2016/679, the supervisory authority with which the complaint was lodged shall inform the complainant of the judicial remedy available to him or her in accordance with Article 78 of Regulation (EU) 2016/679.

Amendment 136

Proposal for a regulation

Chapter III – Section 3 – title

Text proposed by the Commission

Amendment

Decisions addressed to controllers and processors

Decisions addressed to parties under investigation

Amendment 137

Proposal for a regulation

Article 14 – title

Text proposed by the Commission

Amendment

Preliminary findings and reply

Preliminary findings and the right to be heard

Amendment 138

Proposal for a regulation

Article 14 – paragraph 1

Text proposed by the Commission

Amendment

1. When the lead supervisory authority intends to submit a draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

1. Following the consultations and procedures under Articles 9 and 10 of this Regulation, when the lead supervisory authority intends to submit a draft decision Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

Amendment 139

Proposal for a regulation

Article 14 – paragraph 2 – subparagraph 1

Text proposed by the Commission

Amendment

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they must set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts, including listing all the evidence relied upon, and the entire legal assessment raised against the parties under investigation, so that they are heard and can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Amendment 140

Proposal for a regulation

Article 14 – paragraph 2 – subparagraph 2

Text proposed by the Commission

Amendment

The preliminary findings shall indicate corrective measures the lead supervisory authority intends to use.

The preliminary findings shall indicate the corrective measures that are considered by the lead supervisory authority.

Amendment 141

Proposal for a regulation

Article 14 – paragraph 2 – subparagraph 3

Text proposed by the Commission

Amendment

Where the lead supervisory authority intends to impose a fine, it shall list in the preliminary findings the relevant elements on which it relies while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

Amendment 142

Proposal for a regulation

Article 14 – paragraph 3

Text proposed by the Commission

Amendment

3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation.

3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation that may be subject to the exercise of a corrective power, as well as to the supervisory authority with which the complaint was lodged and the supervisory authorities concerned. The supervisory authority with which the complaint was lodged shall notify preliminary findings to the complainant.

Amendment 143

Proposal for a regulation

Article 14 – paragraph 4

Text proposed by the Commission

Amendment

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

deleted

Amendment 144

Proposal for a regulation

Article 14 – paragraph 5

Text proposed by the Commission

Amendment

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Article 20.

deleted

Amendment 145

Proposal for a regulation

Article 14 – paragraph 6

Text proposed by the Commission

Amendment

6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties under investigation have been given the opportunity to comment.

6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Amendment 146

Proposal for a regulation

Article 15

Text proposed by the Commission

Amendment

Article 15

deleted

Transmission of preliminary findings to complainants

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings and set a time-limit within which the complainant may make known its views in writing.

2. Paragraph 1 shall apply also when a supervisory authority, where appropriate, treats several complaints jointly, splits the complaints in several parts or in any other way exercises its discretion concerning the scope of the investigation as set out in preliminary findings.

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the administrative file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1.

4. The complainant shall be provided with the non-confidential version of the preliminary findings only for the purpose of the concrete investigation in which the preliminary findings were issued.

5. Before receiving the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the complainant shall send to the lead supervisory authority a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than the concrete investigation in which those findings were issued.

Amendment 147

Proposal for a regulation

Article 16 – title

Text proposed by the Commission

Amendment

Adoption of final decision

Submission of draft decisions, revised draft decisions and adoption of final decision

Amendment 148

Proposal for a regulation

Article 16 – paragraph 1

Text proposed by the Commission

Amendment

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation 2016/679, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Amendment 149

Proposal for a regulation

Article 16 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intends to follow that objection, the lead supervisory authority shall, within four weeks, submit a revised draft decision pursuant to Article 60(5) of that Regulation.

Amendment 150

Proposal for a regulation

Article 16 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1b. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit the matter to the consistency mechanism referred to in Article 63, in accordance with Article 60(4) of that Regulation.

Amendment 151

Proposal for a regulation

Article 16 – paragraph 1 c (new)

Text proposed by the Commission

Amendment

1c. Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements:

(a) the name of the supervisory authority which issued the decision;

(b) the date of issuing the decision;

(c) an impartial summary of the relevant facts of the case and their source;

(d) the legal grounds for the decision;

(e) the exercised corrective powers, penalties or other measures; and

(f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

Amendment 152

Proposal for a regulation

Article 16 – paragraph 1 d (new)

Text proposed by the Commission

Amendment

1d. In the event where the legally binding decision is to be issued by the supervisory authority with which the complaint has been lodged in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the lead supervisory authority shall ensure that the decision contains all elements necessary under the applicable national procedural law of the supervisory authority concerned. The supervisory authority concerned with which the complaint has been lodged shall assist the lead supervisory authority in drafting the decision in such a manner.

Amendment 153

Proposal for a regulation

Article 16 – paragraph 1 e (new)

Text proposed by the Commission

Amendment

1e. Any draft decision or final decision shall only rely on factual findings made on the basis of documents or other evidence, on which the parties under investigation had the opportunity to make their views known.

Amendment 154

Proposal for a regulation

Article 16 – paragraph 1 f (new)

Text proposed by the Commission

Amendment

1f. The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision, and information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

Amendment 155

Proposal for a regulation

Article 16 – paragraph 1 g (new)

Text proposed by the Commission

Amendment

1g. Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless the new decisions do not materially depart from previously published decisions. In accordance with applicable national law, supervisory authorities may redact party names, any other information that may allow the identification of parties, and other information that is protected under applicable law.

Amendment 156

Proposal for a regulation

Article 17

Text proposed by the Commission

Amendment

Article 17

deleted

Right to be heard in relation to revised draft decision

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.

Amendment 157

Proposal for a regulation

Article 18 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) be based exclusively on factual elements included in the draft decision; and

(a) be based on factual elements included in the draft decision, or on the evidence the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;

Amendment 158

Proposal for a regulation

Article 18 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) not change the scope of the allegations by raising points amounting to identification of additional allegations of infringement of Regulation (EU) 2016/679 or changing the intrinsic nature of the allegations raised.

(b) not change the scope of the case as defined in the latest version of the summary of key issues; and

Amendment 159

Proposal for a regulation

Article 18 – paragraph 1 – point b a (new)

Text proposed by the Commission

Amendment

(ba) clearly identify the elements of the draft decision that should be changed, including, when possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

Amendment 160

Proposal for a regulation

Article 18 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

deleted

Amendment 161

Proposal for a regulation

Chapter IV

Text proposed by the Commission

Amendment

[...]

deleted

Amendment 162

Proposal for a regulation

Article 22 – title

Text proposed by the Commission

Amendment

Referral to dispute resolution under Article 65 of Regulation (EU) 2016/679

Referral to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679

Amendment 163

Proposal for a regulation

Article 22 – paragraph 1

Text proposed by the Commission

Amendment

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679.

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections or from the lapse of the deadline pursuant to Article 60(4) of Regulation (EU) 2016/679. Relevant and reasoned objections that have been received after the deadline shall not be taken into consideration.

Amendment 164

Proposal for a regulation

Article 22 – paragraph 2 – introductory part

Text proposed by the Commission

Amendment

2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following documents:

2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following:

Amendment 165

Proposal for a regulation

Article 22 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(aa) the summary of key issues;

Amendment 166

Proposal for a regulation

Article 22 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) a summary of the relevant facts;

(b) a summary of the relevant facts, including the description of processing activities, the description of the controller’s organisation and where the relevant decisions on the purposes and means of the processing of personal data are taken;

Amendment 167

Proposal for a regulation

Article 22 – paragraph 2 – point d

Text proposed by the Commission

Amendment

(d) view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;

(d) views made in writing by the parties, pursuant to Article 14;

Amendment 168

Proposal for a regulation

Article 22 – paragraph 2 – point e

Text proposed by the Commission

Amendment

(e) views made in writing by complainants, as the case may be, pursuant to Articles 11, 12, and 15;

deleted

Amendment 169

Proposal for a regulation

Article 22 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority;

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as not relevant or reasoned;

Amendment 170

Proposal for a regulation

Article 22 – paragraph 2 – point g

Text proposed by the Commission

Amendment

(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.

(g) the reasons on the basis of which the lead supervisory authority did not follow objections or rejected the objections as not relevant or reasoned;

Amendment 171

Proposal for a regulation

Article 22 – paragraph 2 – point g a (new)

Text proposed by the Commission

Amendment

(ga) access to the joint case file.

Amendment 172

Proposal for a regulation

Article 22 – paragraph 3

Text proposed by the Commission

Amendment

3. The Board shall within four weeks of receiving the documents listed in paragraph 2 identify retained relevant and reasoned objections.

3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving all of the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to all supervisory authorities.

Amendment 173

Proposal for a regulation

Article 22 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. Once all information specified in paragraph 2 have been received, the Chair of the Board is empowered to request from the lead supervisory authority or the supervisory authorities concerned any additional information, documents or clarifications necessary for the Board to take a binding decision concerning all of the matters which are the subject of the relevant and reasoned objections. The authorities shall provide this additional information no later than one week after having received the request.

Amendment 174

Proposal for a regulation

Article 22 – paragraph 3 b (new)

Text proposed by the Commission

Amendment

3b. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit other relevant information that they have on that case which was not included in the objections, including but not limited to, facts and documentation related to their objection.

Amendment 175

Proposal for a regulation

Article 22 – paragraph 3 c (new)

Text proposed by the Commission

Amendment

3c. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 22(2) are available and translated in accordance with Article 2d.

Amendment 176

Proposal for a regulation

Article 22 – paragraph 3 d (new)

Text proposed by the Commission

Amendment

3d. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) and (3) of Regulation (EU) 2016/679 shall also apply during the periods referred in paragraph 3 of this Article.

Amendment 177

Proposal for a regulation

Article 23

Text proposed by the Commission

Amendment

Article 23

deleted

Registration in relation to a decision under Article 65(1), point (a), of Regulation (EU) 2016/679

The Chair of the Board shall register the referral of a subject-matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679 no later than one week after having received all of the following documents:

(a) the draft decision or revised draft decision subject to the relevant and reasoned objections;

(b) a summary of the relevant facts;

(c) view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;

(d) views made in writing by complainants, as the case may be, pursuant to Articles 11, 12 and 15;

(e) the retained relevant and reasoned objections;

(f) the reasons on the basis of which the lead supervisory authority did not follow the retained relevant and reasoned objections.

Amendment 178

Proposal for a regulation

Article 24

Text proposed by the Commission

Amendment

Article 24

deleted

Statement of reasons prior to adoption of decision under Article 65(1), point (a), of Regulation (EU) 2016/679

1. Prior to adopting the binding decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679, the Chair of the Board shall, through the lead supervisory authority, provide the parties under investigation and/or, in the case of full or partial rejection of a complaint, the complainant, with a statement of reasons explaining the reasoning the Board intends to adopt in its decision. Where the Board intends to adopt a binding decision requiring the lead supervisory authority to amend its draft decision or revised draft decision, the Board shall decide whether such statement of reasons should be accompanied by the retained relevant and reasoned objections on the basis of which the Board intends to adopt its decision.

2. The parties under investigation and/or, in the case of full or partial rejection of a complaint, the complainant, shall have one week from receipt of the statement of reasons referred to in paragraph 1 to make their views known.

3. The deadline in paragraph 2 shall be extended by one week where the Board extends the period for adoption of the binding decision in accordance with Article 65(2) of Regulation (EU) 2016/679.

4. The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall not run during the periods provided for in paragraphs 2 and 3.

Amendment 179

Proposal for a regulation

Article 25

Text proposed by the Commission

Amendment

Article 25

deleted

Procedure in relation to decision under Article 65(1), point (b), of Regulation (EU) 2016/679

1. When referring a subject-matter to the Board under Article 65(1), point (b), of Regulation 2016/679, the supervisory authority referring the subject-matter regarding the competence for the main establishment shall provide the Board with all of the following documents:

(a) a summary of the relevant facts;

(b) the assessment of these facts as far as the conditions of Article 56(1) of Regulation (EU) 2016/679 are concerned;

(c) views made by the controller or processor whose main establishment is the subject of the referral;

(d) the views of other supervisory authorities concerned by the referral;

(e) any other document or information the referring supervisory authority considers relevant and necessary in order to find a resolution on the subject-matter.

2. The Chair of the Board shall register the referral no later than one week after having received the documents referred to in paragraph 1.

Amendment 180

Proposal for a regulation

Article 26 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679.

(c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an explanation of which points were not followed and a reference to the relevant part of the adopted decision.

Amendment 181

Proposal for a regulation

Article 26 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. The Chair of the Board shall inform all supervisory authorities of the referral made to the Board under paragraph 1, so as to allow the supervisory authorities to make their views known.

Amendment 182

Proposal for a regulation

Article 26 – paragraph 3

Text proposed by the Commission

Amendment

3. The Chair of the Board shall register the referral no later than one week after having received the documents referred to in paragraphs 1 and 2.

3. The Chair of the Board shall register the referral no later than one week after having received all of the documents referred to in paragraphs 1 and 2.

Amendment 183

Proposal for a regulation

Article 26 a (new)

Text proposed by the Commission

Amendment

Article26a

Procedural determinations by the Board

1. Pursuant to Article 66 of Regulation (EU) 2016/679, a supervisory authority may request from the Board to take an urgent binding decision in the form of a procedural determination on any procedural dispute arising between supervisory authorities in cases foreseen by this Regulation.

2. Where the lead supervisory authority is of the view that it cannot possibly comply with a deadline pursuant to Article 4(1b) or Article 5a(3), especially because of the need for exceptionally complex factual investigations, it shall request from the Board an urgent binding decision pursuant to paragraph 1, regarding an extension of the deadline of up to nine more months. The supervisory authority shall demonstrate that despite its compliance with Article 2c(1), the extension sought is inevitable.

3. Requests under paragraph 1 and 2 shall at least contain:

(a) the facts relied upon and any evidence available to the authority or party;

(b) the legal grounds for the request;

(c) the determination pursuant to paragraph 1 or the deadline extension pursuant to paragraph 2 that the authority or party requests from the Board;

4. Within two weeks, the Board shall determine the matter based on the information before it or it shall reject the application. Determinations are binding on the supervisory authorities.

Amendment 184

Proposal for a regulation

Article 26 b (new)

Text proposed by the Commission

Amendment

Article 26b

Right to an effective judicial remedy against a supervisory authority

1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy:

(a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure;

(b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or

(c) where a supervisory authority does not comply with a binding decision of the Board.

2. Any party to the procedure or a not-for-profit body under Article 80 of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) if it considers that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

3. Where a court or tribunal exercising the review pursuant to paragraph 1 finds that a supervisory authority has not fulfilled its duties, it shall have the power to order that supervisory authority to take the necessary action.

Amendment 185

Proposal for a regulation

Article 27 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) a summary of the relevant facts;

(a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Amendment 186

Proposal for a regulation

Article 27 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) a description of the provisional measure adopted on its own territory, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(b) a description of the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the opinion, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

Amendment 187

Proposal for a regulation

Article 27 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) a justification of the urgent need for final measures to be adopted on the territory of the Member State of the requesting supervisory authority, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

(c) a justification of the urgent need for final measures, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

Amendment 188

Proposal for a regulation

Article 27 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(ca) where the requesting authority is not the lead supervisory authority, the views of the lead supervisory authority.

Amendment 189

Proposal for a regulation

Article 27 – paragraph 2

Text proposed by the Commission

Amendment

2. The urgent opinion of the Board shall be addressed to the supervisory authority that submitted the request. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the requesting authority to maintain or amend its provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

2. The urgent opinion of the Board shall be addressed to all supervisory authorities. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the authorities to maintain or amend provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

Amendment 190

Proposal for a regulation

Article 28 – title

Text proposed by the Commission

Amendment

Urgent decisions under Article 66(2) of Regulation (EU) 2016/679

Urgent binding decisions under Article 66(2) of Regulation (EU) 2016/679

Amendment 191

Proposal for a regulation

Article 28 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

1. A request for an urgent decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks prior to the expiry of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

1. A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

Amendment 192

Proposal for a regulation

Article 28 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) a summary of the relevant facts;

(a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Amendment 193

Proposal for a regulation

Article 28 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting the provisional measures, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting it, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

Amendment 194

Proposal for a regulation

Article 28 – paragraph 1 – point c

Text proposed by the Commission

Amendment

(c) information on any investigatory measures taken on its own territory and replies received from the local establishment of the parties under investigation or any other information in the possession of the requesting supervisory authority;

(c) information on any investigatory measures taken on its own territory and replies received from the parties under investigation or any other information in the possession of the requesting supervisory authority;

Amendment 195

Proposal for a regulation

Article 28 – paragraph 1 – point d

Text proposed by the Commission

Amendment

(d) a justification of the urgent need for final measures to be adopted on the territory of the requesting supervisory authority, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to respond to a request under Article 61(3) or 62(2) of Regulation (EU) 2016/679;

(d) a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to provide the information requested under Article 61(5) of Regulation (EU) 2016/679 or failed to respond to a request pursuant to Article 61(8) or 62(2) of Regulation (EU) 2016/679;

Amendment 196

Proposal for a regulation

Article 28 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) where applicable, the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

(f) where available, the views of the parties. In case the requesting authority is not the lead supervisory authority, the requesting authority shall grant the right to be heard to the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

Amendment 197

Proposal for a regulation

Article 28 – paragraph 2

Text proposed by the Commission

Amendment

2. The urgent decision referred to in paragraph 1 shall be addressed to the supervisory authority that submitted the request and shall enable the requesting authority to maintain or amend its provisional measure.

2. The urgent binding decision referred to in paragraph 1 shall be addressed to the lead supervisory authority and all the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

Amendment 198

Proposal for a regulation

Article 28 – paragraph 3

Text proposed by the Commission

Amendment

3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority or authorities to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

Amendment 199

Proposal for a regulation

Article 28 – paragraph 4

Text proposed by the Commission

Amendment

4. The supervisory authority that submitted the request referred to in paragraph 1 shall notify its decision on the final measures to the establishment of the controller or processor on the territory of its Member State and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the lead supervisory authority of the final measure.

4. A supervisory authority that is responsible to adopt final measures shall notify its decision on the final measures to the parties under investigation and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the parties under investigation against which the provisional measures were adopted about the Board’s decision and the final measures adopted by the lead supervisory authority. The complaint-receiving supervisory authority shall inform the complainant about the Board’s decision and the final measures adopted by the lead supervisory authority.

Amendment 200

Proposal for a regulation

Article 28 a (new)

Text proposed by the Commission

Amendment

Article 28a

Remedies against procedural determinations

Remedies against procedural determinations by a supervisory authority under national law shall only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.

Amendment 201

Proposal for a regulation

Article 28 b (new)

Text proposed by the Commission

Amendment

Article28b

Enforcement Statistics

Supervisory authorities shall report the following numbers in their activity report under Article 59 of Regulation (EU) 2016/679:

(a) the number of ex officio investigations initiated by the supervisory authority;

(b) the number of ex officio investigations initiated by other supervisory authorities;

(c) the number of complaints received, including the number that were rejected, dismissed, withdrawn, partly upheld, fully upheld or otherwise closed;

(d) the number of legally binding decisions currently on appeal;

(e) the number and average duration of open and decided procedures under (a) to (d) to date;

(f) the number of each type of measure taken in accordance with Article 58(2) of Regulation (EU) 2016/679 or applicable national law;

(g) the number and the amount of fines issued and collected under Article 83 and 84 of Regulation (EU) 2016/679 or relevant national law; and

(h) the annual budget and the number of staff, by training, tasks and organizational units.

2. Supervisory authorities shall publish the activity report for the past year without undue delay, but no later than by 30 June.

3. The Board shall make the information of all supervisory authorities in paragraph 1 available to the public no later than 31 July of each year for the previous year.

(Article 28 b in placed in Chapter VII “General and final provisions”)

Amendment 202

Proposal for a regulation

Article 29

Text proposed by the Commission

Amendment

Article 29

deleted

Beginning of time periods and definition of working day

1. Time-limits provided for in or fixed by the supervisory authorities pursuant to Regulation (EU) 2016/679 shall be calculated in accordance with Regulation (EEC, Euratom) No 1182/71 of the Council17 .

2. Time periods shall begin on the working day following the event to which the relevant provision of Regulation (EU) 2016/679 or this Regulation refers.

__________________

17 Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits (OJ L 124, 8.6.1971, p. 1).

Amendment 203

Proposal for a regulation

Article 30 – paragraph 1

Text proposed by the Commission

Amendment

Chapters III and IV shall apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation.

Chapters I, II and III shall apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation.

Amendment 204

Proposal for a regulation

Article 30 – paragraph 2

Text proposed by the Commission

Amendment

Chapter V shall apply to all cases submitted to dispute resolution under Article 65 of Regulation (EU) 2016/679 after the entry into force of this Regulation.

Chapters V and VI shall apply to all cases submitted to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after the entry into force of this Regulation.

Amendment 205

Proposal for a regulation

Article 30 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

Until ... [six months from the date of application of this Regulation], the lead supervisory authority shall, upon request, provide all documents in its own file to other supervisory authorities by other electronic means.

Amendment 206

Proposal for a regulation

Article 30 a (new)

Text proposed by the Commission

Amendment

Article 30a

Evaluation and review

The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.

Amendment 207

Proposal for a regulation

Article 31 – title

Text proposed by the Commission

Amendment

Entry into force

Entry into force and application

Amendment 208

Proposal for a regulation

Article 31 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. It shall apply from … [one year from the date of entry into force of this Regulation].

However, Article 2b(1), point(c), Article 2b(3), last sentence, Article 2c(2), last sentence, and (5), Article 2d(3) and (6), Articles 8(1) and 18(1), point (a) shall apply from ... [six months from the date of application of this Regulation].

Amendment 209

Proposal for a regulation

Annex I – Part A – point 1

Text proposed by the Commission

Amendment

1. Identification of person or entity filing the complaint

1. Identification of person or entity filing the complaint

Where the complainant is a natural person, submit a form of identification.1a

Where the complaint is submitted by a body referred to in Article 80 of Regulation (EU) 2016/679, submit proof that the body has been properly constituted in accordance with the law of a Member State.

Where the complaint is submitted by a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, submit proof that the body, organisation or association has been properly constituted in accordance with the law of a Member State.

Where the complaint is submitted on the basis of Article 80(1) of Regulation 2016/679, proof that the body lodging the complaint is acting on the basis of the mandate of a data subject.

Where the complaint is submitted on the basis of Article 80(1) of Regulation 2016/679, proof that the body, organisation or association lodging the complaint is acting on the basis of the mandate of a data subject.

-------

1a For example, passport, driving licence, national ID.

Amendment 210

Proposal for a regulation

Annex I – Part A – point 2

Text proposed by the Commission

Amendment

2. Contact details 1a

2. Contact details 1a

Where the complaint is submitted electronically, email address.

The name, address and any other available contact details of the complainant, including, where the complaint is submitted electronically, email address.

Where the complaint is submitted by post, postal address.

Telephone number.

------------

-----------

1a In the case a complaint is submitted by a body referred to in Article 80 of Regulation (EU) 2016/679, all of the information in point 2 should be provided.

1a In the case a complaint is submitted by a body referred to in Article 80 of Regulation (EU) 2016/679, all of the information in point 2 should be provided.

Amendment 211

Proposal for a regulation

Annex I – Part A – point 3

Text proposed by the Commission

Amendment

3. Entity whose processing of your personal data infringes Regulation (EU) 2016/679

3. Entity whose processing of your personal data infringes Regulation (EU) 2016/679

Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint.

Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including the name, address and any other contact details of that entity.

EXPLANATORY STATEMENT

Short Justification

Background

The General Data Protection Regulation seeks to harmonise the protection of fundamental rights and freedoms of natural persons in respect of processing of their data and to ensure the free flow of personal data between Member States. The Parliament has in the past expressed concerns with regard to “the uneven and sometimes non-existent enforcement of the GDPR by national [Data Protection Authorities] DPAs”. It underlined that lengthy procedures can produce an “adverse effect on effective enforcement and on citizens’ trust”, and, in particular for cross-border complaints, has suggested to establish “a common administrative procedure to handle complaints” to strengthen enforcement. The Commission proposal at hand for a GDPR Enforcement Procedures Regulation (GDPR-EPR) suggests to facilitate in particular cross-border cases. It also takes up demands of national DPAs to clarify and streamline cross-border procedures, as spelled out in the European Data Protection Board’s "Vienna Statement" from April 2022, the EDPB "Wish List" from October 2022, the European Data Protection Supervisor’s (EDPS) contribution from April 2023, and the EDPB-EDPS joint opinion on the Commission proposal from September 2023.

The Rapporteur’s Position

- The national procedural laws should continue to apply insofar as they are not in conflict with the GDPR-EPR, thereby ensuring more detailed rules such as on oral hearings continue to be valid, while national procedural standards are not lowered.

- The report consolidates and expands on the provisions on general procedural rules in a new Section 2 in Chapter I in order for the right to be heard, translations, confidentiality, and the sincere cooperation of authorities to always apply, not only in the case of complaints or for dispute resolution among authorities.

- The right to be heard is streamlined following Article 42(1) of the Charter on good administration, and applies to all parties of a case equally.

- A joint case file is introduced, containing all information relating to a case, and making them accessible to all parties and supervisory authorities, thus avoiding a back and forth of documents and ensuring all parties and authorities have the same, most current information, while internal deliberations of authorities and confidential information remain protected.

- In case new information or infringements are revealed over the course of an investigation, the scope of a case can be expanded.

- Amicable settlements are limited to cases of data subject rights, requiring the explicit agreement of the complainant, while not preventing ex-officio investigations of a supervisory authority for larger scale infringements of the GDPR.

- Deadlines and the respective roles and duties of a lead authority and other supervisory authorities are clarified, in particular with regard to procedures to draft a decision, to reach consensus, or to resolve disputes, including procedural determinations by the EDPB.

- A right to judicial remedies in case a competent supervisory authority does not act is introduced.

- The transition period of one year should allow for the necessary changes to the Internal Market Information System used by the authorities, and the Rules of Procedure of the Board, as well as possible amendments of national laws.

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR HAS RECEIVED INPUT

Pursuant to Article 8 of Annex I to the Rules of Procedure, the rapporteur declares that he has received input from the following entities or persons in the preparation of the report, until the adoption thereof in committee:

Entity and/or person

Person (consented to having their name published)

Entity

Chiara Manfredi

Access Now

Fernando Hortal Foronda

BEUC

Claudia Canelles Quaroni

CCIA

DIGITALEUROPE

Francesco Bondi

DOT Europe

Diego Naranjo

EDRi

Enrico Girotto

FEDMA Federation of European Data and Marketing

Miglė Alenčikaitė (Blomeyer)

Google

Ines Talavera de la Esperanza

IAB Europe

Laura Pliauskaite

IAPP International Association of Privacy Professionals

Guillermo Ferrer Hernáez

Information Technology Industry Council (ITI)

Dr Johnny Ryan FRHistS

Irish Council for Civil Liberties

Max Schrems

NOYB None of Your Business

Clara Fecke

Rakuten

The list above is drawn up under the exclusive responsibility of the rapporteur.

30.1.2024

OPINION OF THE COMMITTEE ON LEGAL AFFAIRS

for the Committee on Civil Liberties, Justice and Home Affairs

on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

(COM(2023)0348 – C90231/2023 – 2023/0202(COD))

Rapporteur for opinion: Ibán García Del Blanco

SHORT JUSTIFICATION

This proposal is amending the GDPR in view of the cross-border cooperation mechanism in the framework of the “one stop shop” approach. In that regard, the Commission proposed certain harmonisation measures on the cooperation between the lead supervisory authority and the concerned supervisory authorities, the harmonisation of certain procedural rights of the parties under the investigation and the complainant, the dispute resolution mechanism, and deadlines.

The Rapporteur for opinion agrees with the overall objective to achieve harmonisation of certain aspects of the mentioned issues based on the empirical experience with the current GDPR in that regard and based on the input of a whole variety of actors as listed in the Commission proposal. However, it notes, in line with the institutional principles of better law-making, that no impact assessment has been made by the Commission on such an important topic.

This opinion focuses on certain aspects where further improvement could be achieved, namely the issue of rights of parties to the proceedings in view of administrative proceedings, such as the right to be heard or to access to the case file. A clarification is equally necessary on the procedural role of the complainant throughout the EU. Moreover, certain improvements on the right to access to a file were introduced, taking into account the importance of such access to understand decisions by affected parties to the proceedings and to provide them the possibility for an effective judicial review. Several of the points raised by the EDPS and EDPB were also taken into account such as the assessment of the cross-border nature of cases or common rules in the admissibility phase of the proceedings. The rapporteur for opinion also introduced some deadlines lacking in the initial Commission proposal that are important for legal certainty across the EU.

AMENDMENT

The Committee on Legal Affairs calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 2

Text proposed by the Commission

Amendment

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board.

(2) In an effort of modernizing EU data protection rules, inter alia, by streamlining them with the European data strategy, and in order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

Amendment 2

Proposal for a regulation

Recital 2 a (new)

Text proposed by the Commission

Amendment

(2 a) This Regulation and Chapter VII of Regulation (EU) 2016/679 only govern certain elements of the cooperation procedure, when supervisory authorities of more than one Member State participate in the procedure. This Regulation does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State.

Amendment 3

Proposal for a regulation

Recital 2 b (new)

Text proposed by the Commission

Amendment

(2 b) Supervisory authorities shall make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video conference, or generally available electronic means of communication.

Amendment 4

Proposal for a regulation

Recital 2 c (new)

Text proposed by the Commission

Amendment

(2 c) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law.

Amendment 5

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities be created so as to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Amendment 6

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post. The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679. No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible.

(4) In order to be admissible a complaint should contain certain specified information about the alleged violation, whether ongoing or past. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a model complaint form should be provided. Where a complaint does not meet the minimum requirements, the supervisory authority should require the complainant to resubmit a complete complaint within a reasonable period of time. No additional information should be required for a complaint to be deemed admissible. The complaint may be submitted in written, electronically or by post. In particular, complainants should not be required to use a national electronic ID or e-government system to submit the complaint. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

Amendment 7

Proposal for a regulation

Recital 5

Text proposed by the Commission

Amendment

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case.

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case, including judicial remedies under Article 78 of Regulation (EU) 2016/679. This Regulation foresees specific deadlines to provide for a foreseeable procedure in line with the requirement of legal certainty as a part of the right to good administration enshrined in Article 41 of the EU Charter, and Article 6 ECHR. Procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations for delays or disruptions that are outside of the control of the lead supervisory authority. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

Amendment 8

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5 a) The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

Amendment 9

Proposal for a regulation

Recital 5 b (new)

Text proposed by the Commission

Amendment

(5b) Article 6 of the ECHR and Article 47 of the Charter require that fair procedures are public. Article 42 of the Charter and the law of many Member States foresee the right of access to public documents and the transparency of actions of authorities. However, it should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/943. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why.

Amendment 10

Proposal for a regulation

Recital 5 c (new)

Text proposed by the Commission

Amendment

(5c) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities.

Amendment 11

Proposal for a regulation

Recital 6

Text proposed by the Commission

Amendment

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate, as well as effective and dissuasive, in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective and quick remedy to the complainant can be quickly delivered. Planning the procedure is important to ensure a quick result. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the reason for the complaint. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision that can be submitted to judicial review.

Amendment 12

Proposal for a regulation

Recital 7

Text proposed by the Commission

Amendment

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant.

(7) The lead supervisory authority should regularly provide the supervisory authority with which the complaint was lodged with all the necessary information on the progress of the investigation without undue delay and for the purpose of providing updates to the complainant. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

Amendment 13

Proposal for a regulation

Recital 8

Text proposed by the Commission

Amendment

(8) The competent supervisory authority should provide the complainant with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint.

(8) The competent supervisory authority should provide the parties with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Amendment 14

Proposal for a regulation

Recital 9

Text proposed by the Commission

Amendment

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should endeavour, where appropriate, to resolve complaints by amicable settlement. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Settlements should be of a voluntary nature, and should be able to take the form of a contract between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be misused to defer decisions on complaints.

Amendment 15

Proposal for a regulation

Recital 9 a (new)

Text proposed by the Commission

Amendment

(9a) The supervisory authority is not bound by the amicable settlement. It should in particular open an ex officio investigation instead, where the party under investigation is a repeat offender, the party under investigation has been the subject of a large number of other amicable settlements, the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, the consequence of the processing which has been subject to the complaint is of long duration or serious nature.

Amendment 16

Proposal for a regulation

Recital 11

Text proposed by the Commission

Amendment

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the investigation as early as possible and prior to the communication of allegations to the parties under investigation and adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case as early as possible and at least prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

Amendment 17

Proposal for a regulation

Recital 13

Text proposed by the Commission

Amendment

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. To ensure that they are coherent and easy to understand, the legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

Amendment 18

Proposal for a regulation

Recital 14

Text proposed by the Commission

Amendment

(14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

(14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within three months after the deadline for comments.

Amendment 19

Proposal for a regulation

Recital 16

Text proposed by the Commission

Amendment

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the lead supervisory authority should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. For this purpose, the requirement of urgency should be presumed. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings. The urgent binding decision of the Board cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the rights of the parties under investigation to be heard. In particular, the Board should not extend the scope of the investigation on its own initiative.

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the involved supervisory authorities should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings.

Amendment 20

Proposal for a regulation

Recital 17

Text proposed by the Commission

Amendment

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and to ensure compliance with Article 47 of the Charter, the handling of any complaint should always lead to a decision which may be challenged before a national court.

Amendment 21

Proposal for a regulation

Recital 18

Text proposed by the Commission

Amendment

(18) Complainants should have the opportunity to express their views before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the non-confidential version of the documents on which the decision fully or partially rejecting the complaint is based.

(18) Complainants as parties to the procedure should have the opportunity to express their views and the right to be heard before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known at least prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the documents on which the decision fully or partially rejecting the complaint is based, in a way to allow him or her the possibility of effective judicial review.

Amendment 22

Proposal for a regulation

Recital 19

Text proposed by the Commission

Amendment

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed rejection of the complaint and should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also have the responsibility of preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

Justification

Clarification in line with Article 60(3), (8) and (9) GDPR.

Amendment 23

Proposal for a regulation

Recital 21

Text proposed by the Commission

Amendment

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shall have the right to decline the right to be heard.

Amendment 24

Proposal for a regulation

Recital 22

Text proposed by the Commission

Amendment

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them, by receiving access to the administrative file.

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the right to be heard and the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to make and defend their case effectively and to comment on the allegations made, by receiving access to the case file. Where, at any stage in an investigation, a submission is made to a lead supervisory authority, which materially changes the lead supervisory authority’s view of a case, parties should be given an opportunity to respond to this submission before the lead supervisory authority takes its final decision.

Amendment 25

Proposal for a regulation

Recital 23

Text proposed by the Commission

Amendment

(23) The preliminary findings define the scope of the investigation and therefore the scope of any future final decision (as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a) of Regulation (EU) 2016/679) which may be addressed to controllers or processors. The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties under investigation have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the Article 65(1), point (a), decision resolving the dispute between the supervisory authorities. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties under investigation in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of defence rights.

(23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Amendment 26

Proposal for a regulation

Recital 24

Text proposed by the Commission

Amendment

(24) The parties under investigation should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

(24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Amendment 27

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt the complaint does not bar the qualification of a data subject as complainant. However, an investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor does not constitute an adversarial procedure between the complainant and the parties under investigation. It is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are, therefore, not in the same procedural situation and the latter cannot invoke the right to a fair hearing when the decision does not adversely affect her or his legal position. The complainant’s involvement in the procedure against the parties under investigation cannot compromise the right of these parties to be heard.

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt of the complaint does not bar the qualification of a data subject as complainant.

Amendment 28

Proposal for a regulation

Recital 26

Text proposed by the Commission

Amendment

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the administrative file.

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the case file, in view of protection of confidential information and integrity of the decision-making process, without prejudice to their right for an effective judicial remedy.

Amendment 29

Proposal for a regulation

Recital 27

Text proposed by the Commission

Amendment

(27) When setting deadlines for parties under investigation and complainants to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, in order to ensure that the parties under investigation and complainants have sufficient opportunity to meaningfully provide their views on the issues raised.

(27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to undue long procedures.

Amendment 30

Proposal for a regulation

Recital 28

Text proposed by the Commission

Amendment

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject. Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant and reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation.

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject.

Amendment 31

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length, should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length taking into account the complexity of the cases and the relevancy of the contributions by other supervisory authorities; they should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

Justification

It limits the length of written contributions that other supervisory authorities can make (to specific amount of pages), disregarding the different complexity of cases.

Amendment 32

Proposal for a regulation

Recital 30

Text proposed by the Commission

Amendment

(30) Access to the administrative file is provided for as a part of the rights of defence and the right to good administration enshrined in the Charter. Access to the administrative file should be provided to the parties under investigation when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

(30) Access to the case file is provided for as a part of the rights of defence, effective judicial remedy and the right to good administration enshrined in the Charter. Access to the case file should be provided to the parties under investigation at the latest when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

Amendment 33

Proposal for a regulation

Recital 31

Text proposed by the Commission

Amendment

(31) When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(31) When granting access to the case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

Amendment 34

Proposal for a regulation

Recital 34

Text proposed by the Commission

Amendment

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in a way which allows the lead supervisory authority to adopt its final decision on the basis of the decision of the Board while maintaining its discretion.

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Amendment 35

Proposal for a regulation

Recital 37 a (new)

Text proposed by the Commission

Amendment

(37 a) In order to enhance the provision for the smooth and effective functioning of the cooperation and dispute resolution mechanism in cross-border cases, the European Data Protection Board and the European Data Protection Supervisor should be increasingly provided with competences and a more prominent role in coordination to foster cooperation with the supervisory authorities.

Amendment 36

Proposal for a regulation

Article 1 – title

Text proposed by the Commission

Amendment

Subject matter

Subject matter and scope

Amendment 37

Proposal for a regulation

Article 1 – paragraph 1

Text proposed by the Commission

Amendment

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

1. This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities related to the cross-border processing withing the meaning of Regulation (EU) 2016/679.

Amendment 38

Proposal for a regulation

Article 1 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

This Regulation does not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.

Amendment 39

Proposal for a regulation

Article 2 – paragraph 2 – point 1

Text proposed by the Commission

Amendment

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing, as well as their representative(s);

Amendment 40

Proposal for a regulation

Article 2 – paragraph 2 – point 1 a (new)

Text proposed by the Commission

Amendment

(1 a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the procedure;

Amendment 41

Proposal for a regulation

Article 2 – paragraph 2 – point 2 a (new)

Text proposed by the Commission

Amendment

(2 a) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case as defined under national law;

Amendment 42

Proposal for a regulation

Article 2 – paragraph 2 – point 4 a (new)

Text proposed by the Commission

Amendment

(4 a) ‘Confidential version of documents’ means documents containing confidential or sensitive information which may be legally privileged under the applicable laws and data protection rules.

Amendment 43

Proposal for a regulation

Article 2 – paragraph 2 – point 4 b (new)

Text proposed by the Commission

Amendment

(4 b) ‘Non-confidential version of documents’ means a version of documents from which confidential or sensitive information has been redacted and which can be provided to the complainant without contravening laws or data protection rules.

Amendment 44

Proposal for a regulation

Article 2 a (new)

Text proposed by the Commission

Amendment

Article 2a

Common minimum procedural standards

(1) Without prejudice to additional rights under national law, each party to the procedure shall have at least the following rights:

(a) have their case handled impartially and fairly, and to be treated equally, even in different jurisdictions (‘fair procedure and equality of arms’);

(b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (‘right to be heard’);

(c) have access to the case file (‘procedural transparency’).

(2) The rights in paragraph (1) shall be applied as provided in this Regulation and Regulation (EU) 2016/679, and, where applicable, national law.

Amendment 45

Proposal for a regulation

Article 3 – paragraph 1

Text proposed by the Commission

Amendment

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

1. A complaint that relates to cross-border cooperation and consistency in line with Article 60 of Regulation (EU) 2016/679 shall provide at least the following information:

(a) the name, address and any other available contact details of the complainant;

(b) if known, the name, address and any other contact details of the party under investigation;

(c) the facts of the case and any evidence available to the complainant;

(d) the measures that the complainant demands from the supervisory authority.

No additional information shall be required in order for the complaint to be admissible.

The complaint may be submitted in written, electronically or by post.

To facilitate the complaint procedure a model form is attached in the Annex.

Amendment 46

Proposal for a regulation

Article 3 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1 a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.

Amendment 47

Proposal for a regulation

Article 3 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1 b. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

Amendment 48

Proposal for a regulation

Article 3 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.

2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.

In that regard at least the following shall be considered:

- relevant controller or processor for the processing in question;

- number of establishments of the controller or processor in the EU;

- place of the main establishment;

- activities of establishments in more than one Member State;

- substantial affect or likely substantial affect on data subjects in more than one Member State.

Amendment 49

Proposal for a regulation

Article 3 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.

3. The supervisory authority with which the complaint was lodged shall determine the admissibility of the complaint, including the completeness of the information required, and transmit it to the lead supervisory authority within three weeks upon receipt of the complaint.

Amendment 50

Proposal for a regulation

Article 3 – paragraph 4

Text proposed by the Commission

Amendment

4. Upon assessment of the completeness of the information required by the Form, the supervisory authority with which the complaint was lodged shall transmit the complaint to the lead supervisory authority.

deleted

Amendment 51

Proposal for a regulation

Article 3 – paragraph 5

Text proposed by the Commission

Amendment

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also submit a non-confidential version of the complaint.

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also provide a non-confidential version of the complaint alongside the confidential version. The supervisory authority shall only disclose it if such disclosure is necessary for the parties under investigation to exercise their rights of defence efficiently.

Amendment 52

Proposal for a regulation

Article 3 – paragraph 6

Text proposed by the Commission

Amendment

6. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

deleted

Amendment 53

Proposal for a regulation

Article 4 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

While assessing the extent appropriate to which a complaint should be investigated in each case the supervisory authority shall take into account all relevant circumstances, including all of the following:

While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall take into account all relevant circumstances, including all of the following:

Amendment 54

Proposal for a regulation

Article 4 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the expediency of delivering an effective and timely remedy to the complainant;

(a) the delivery of an effective and timely remedy to the complainant, including taking into account what is at stake for the complainant;

Amendment 55

Proposal for a regulation

Article 4 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(c a) the complainant’s use of internal complaint mechanism (CM) provided by the parties under investigation.

Amendment 56

Proposal for a regulation

Article 4 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

(1 a) The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Amendment 57

Proposal for a regulation

Article 5

Text proposed by the Commission

Amendment

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

1. A complaint may be resolved by amicable settlement between the complainant and the parties under investigation at any stage of the investigation. The supervisory authority may encourage and facilitate such a voluntary process. Amicable settlements may not be reached on the basis of payments to the complainant. A resolution of the dispute by an amicable settlement, is without prejudice to the complainant claiming compensation pursuant to Article 82 of Regulation (EU) 2016/679.

(1a) An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement.

(1b) The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it. The supervisory authority may encourage and facilitate amicable settlements where relevant.

(1c) Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

(1d) If the amicable settlement was reached by the lead supervisory authority Article 60(3) and (4) of Regulation 2016/679 applies.

(1e) The supervisory authorities are not bound by the amicable settlement in view of a further ex officio investigation.

Amendment 58

Proposal for a regulation

Article 5 a (new)

Text proposed by the Commission

Amendment

Article 5a

Request for an ex officio procedure

1. The lead supervisory authority may open an ex officio procedure at any time.

2. Where it considers that Regulation (EU) 2016/679 may be violated, any concerned supervisory authority may request an ex officio procedure by submitting a written request to the lead supervisory authority. Such a request shall contain at least:

(a) a declaration to be a concerned supervisory authority;

(b) any evidence of the violation;

(c) a summary of key issues pursuant to Article 9.

3. Within three weeks, the assumed lead supervisory authority shall:

(a) inform the concerned supervisory authority that it has opened an ex officio procedure;

(b) inform the concerned supervisory authority that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself in line; or

(c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no violation of Regulation (EU) 2016/679.

In the case referred to in point (a) of this paragraph, the concerned supervisory authority may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679.

In the case referred to in point (c) of this paragraph, the concerned supervisory authority may resubmit an amended request for an ex officio procedure, or request a determination on the opening of the procedure by the Board.

Amendment 59

Proposal for a regulation

Article 6 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation, or into the working language agreed on between the supervisory authorities concerned, for the purposes of the investigation;

Amendment 60

Proposal for a regulation

Article 6 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

(b) translation of documents provided by the lead supervisory authority into the language used or agreed for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679

Amendment 61

Proposal for a regulation

Article 6 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1 a. A supervisory authority may provide automated translations and unofficial translations.

Amendment 62

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, without undue delay, and at the latest within one week with all relevant information once available.

Amendment 63

Proposal for a regulation

Article 9 – paragraph 1

Text proposed by the Commission

Amendment

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues as soon as possible and on the latest within 9 months for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

Amendment 64

Proposal for a regulation

Article 9 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(a a) the response of the parties under investigation;

Amendment 65

Proposal for a regulation

Article 9 – paragraph 2 – point d a (new)

Text proposed by the Commission

Amendment

(d a) an overview of both, the replies of all parties under investigation as well as the views of the complainant on to the preliminary findings;

Amendment 66

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues.

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues, in accordance with Article 60 of Regulation (EU) 2016/679.

Amendment 67

Proposal for a regulation

Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. The Board may specify in its rules of procedure restrictions on the maximum length of comments submitted by supervisory authorities concerned on the summary of key issues.

deleted

Amendment 68

Proposal for a regulation

Article 9 – paragraph 6

Text proposed by the Commission

Amendment

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

6. In non-contentious cases the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

Amendment 69

Proposal for a regulation

Article 10 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(c a) the potential corrective measures.

Amendment 70

Proposal for a regulation

Article 10 – paragraph 4

Text proposed by the Commission

Amendment

4. Where, in a complaint-based investigation, there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matter referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority or the concerned supervisory authorities may request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679.

Amendment 71

Proposal for a regulation

Article 10 – paragraph 5 – point a

Text proposed by the Commission

Amendment

(a) the documents referred to in Article 9(2), points (a) and (b);

(a) the relevant information referred to in Article 9(2);

Amendment 72

Proposal for a regulation

Article 10 – paragraph 5 – point b a (new)

Text proposed by the Commission

Amendment

(b a) other documents or information, as the European Data Protection Board deems appropriate in the particular case.

Amendment 73

Proposal for a regulation

Article 10 – paragraph 6

Text proposed by the Commission

Amendment

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

6. The Board shall adopt an urgent binding decision limited on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

Amendment 74

Proposal for a regulation

Article 11 – paragraph 4

Text proposed by the Commission

Amendment

4. The complainant may request access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.

4. The complainant may request access to the documents on which the proposed rejection of the complaint is based using mutatis mutandis Chapter IV of this Regulation.

Amendment 75

Proposal for a regulation

Article 11 – paragraph 5

Text proposed by the Commission

Amendment

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, under Article 60(8) or Article 60(9) of Regulation (EU) 2016/679, as applicable, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

Amendment 76

Proposal for a regulation

Article 12 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements. The time limit set should not be less than two weeks.

Justification

It should be clear that the consideration that a complainant should be re-heard is not an arbitrary power but should take place if there are essential changes to the draft. At the same time, there should be a minimum level of time for an answer like in Article 11(2) of the proposed regulation. The limit was set to two weeks per analogy with Article 60(5) GDPR. Para. 2 was merged with para.1.

Amendment 77

Proposal for a regulation

Article 12 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall set a time-limit within which the complainant may make known her or his views.

deleted

Amendment 78

Proposal for a regulation

Article 14 – title

Text proposed by the Commission

Amendment

Preliminary findings and reply

Preliminary finding and the right to be heard by parties under investigation

Amendment 79

Proposal for a regulation

Article 14 – paragraph 2 – subparagraph 1

Text proposed by the Commission

Amendment

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they must set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties are heard and can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Amendment 80

Proposal for a regulation

Article 14 – paragraph 4

Text proposed by the Commission

Amendment

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. That time-limit must be reasonable and proportionate and take into account the results of the investigations, and shall be no less than three weeks. The lead supervisory authority may receive additional written views from the parties under investigation after the expiry of this time limit but it shall not be obliged to take it into account.

Amendment 81

Proposal for a regulation

Article 14 – paragraph 5

Text proposed by the Commission

Amendment

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Article 20.

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the case file in accordance with Chapter IV.

Amendment 82

Proposal for a regulation

Article 15 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings and set a time-limit within which the complainant may make known its views in writing.

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings within 30 days following receipt of the preliminary findings, and set a time-limit within which the complainant may make known its views in writing. The time-limit shall be proportionate to afford the complainants adequate time to provide their response, and shall be no less than three weeks.

Amendment 83

Proposal for a regulation

Article 15 – paragraph 3

Text proposed by the Commission

Amendment

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the administrative file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1.

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the case file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1, without prejudice for the rights for an effective remedy.

Amendment 84

Proposal for a regulation

Article 15 – paragraph 4

Text proposed by the Commission

Amendment

4. The complainant shall be provided with the non-confidential version of the preliminary findings only for the purpose of the concrete investigation in which the preliminary findings were issued.

4. The complainant shall be provided with the non-confidential version of the preliminary findings for the purpose of the investigation concerning her or his specific complaint in which the preliminary findings were issued. The non-confidential version shall be provided in order to facilitate the complainant’s participation in the investigation procedure and to enable her or him to put forward her or his views and arguments adequately within that investigation.

Amendment 85

Proposal for a regulation

Article 15 – paragraph 5

Text proposed by the Commission

Amendment

5. Before receiving the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the complainant shall send to the lead supervisory authority a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than the concrete investigation in which those findings were issued.

5. Before providing the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the supervisory authority with which the complaint was lodged shall request the complainant to sign a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than making submission on the concrete investigation in which those findings were issued. Legal consequences of refusing to sign or to comply with the confidentiality declaration shall be specified.

Amendment 86

Proposal for a regulation

Article 16 – paragraph 1

Text proposed by the Commission

Amendment

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

In such case, the supervisory authority shall also provide the controller or processor information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

Justification

Clear time period as regards the application of Article 60(7) GDPR once all the procedures on reasoned opinions or consistency mechanism are finished. See also EDPS and EDPB joint opinion 1/2023.

Amendment 87

Proposal for a regulation

Article 17 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to exercise their right to be heard and to make their views known on such new elements.

Amendment 88

Proposal for a regulation

Article 17 – paragraph 2

Text proposed by the Commission

Amendment

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views. That time-limit must be reasonable and proportionate and take into account the results of the investigations, and shall not be less than two weeks.

Amendment 89

Proposal for a regulation

Article 18 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

(a) the reasoned objection shall be concise, transparent, intelligible and provided in an easily accessible form, using clear and plain language;

Justification

The provision is too formalistic, not taking into account the diversity of possible cases. The duty is to have concise documents but not in the form of specific number of pages.

Amendment 90

Proposal for a regulation

Chapter IV – title

Text proposed by the Commission

Amendment

Access to the administrative file and treatment of confidential information

Access to the case file and treatment of confidential information

Amendment 91

Proposal for a regulation

Article 19 – title

Text proposed by the Commission

Amendment

Content of the administrative file

Content of the case file

Amendment 92

Proposal for a regulation

Article 19 – paragraph 1

Text proposed by the Commission

Amendment

1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

1. The case file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

Amendment 93

Proposal for a regulation

Article 19 – paragraph 2

Text proposed by the Commission

Amendment

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority may return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the administrative file.

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority shall return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the case file.

Amendment 94

Proposal for a regulation

Article 19 – paragraph 3

Text proposed by the Commission

Amendment

3. The right of access to the administrative file shall not extend to correspondence and exchange of views between the lead supervisory authority and supervisory authorities concerned. The information exchanged between the supervisory authorities for the purpose of the investigation of an individual case are internal documents and shall not be accessible to the parties under investigation or the complainant.

deleted

Amendment 95

Proposal for a regulation

Article 20 – title

Text proposed by the Commission

Amendment

Access to the administrative file and use of documents

Access to the case file and use of documents

Amendment 96

Proposal for a regulation

Article 20 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall grant access to the administrative file to the parties under investigation, enabling them to exercise their right to be heard. Access to the administrative file shall be granted after the lead supervisory authority notifies the preliminary findings to the parties under investigation.

1. The lead supervisory authority shall grant access to the case file to the parties, enabling them to exercise their right to be heard and the right to an effective judicial remedy. Access to the case file shall be granted at the latest after the lead supervisory authority notifies the preliminary findings to the parties.

Amendment 97

Proposal for a regulation

Article 20 – paragraph 2

Text proposed by the Commission

Amendment

2. The administrative file shall include all documents, inculpatory and exculpatory, including facts and documents which are known to the parties under investigation.

2. The case file shall include all documents, inculpatory and exculpatory, including facts and documents concerning the parties under investigation.

Amendment 98

Proposal for a regulation

Article 20 – paragraph 3

Text proposed by the Commission

Amendment

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties under investigation had the opportunity to make their views known.

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties had the opportunity to make their views known.

Amendment 99

Proposal for a regulation

Article 20 – paragraph 4

Text proposed by the Commission

Amendment

4. Documents obtained through access to the administrative file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided.

4. Documents obtained through access to the case file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided to the parties.

Amendment 100

Proposal for a regulation

Article 21 – paragraph 2

Text proposed by the Commission

Amendment

2. Any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, is excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing.

2. In line with applicable national and EU law on access to documents any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, may be excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing. The same exclusion applies to business secrets and other confidential information.

Amendment 101

Proposal for a regulation

Article 21 – paragraph 3

Text proposed by the Commission

Amendment

3. When communicating preliminary findings to parties under investigation and providing for access to the administrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties under investigation to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of defence of the parties under investigation with due regard for the confidentiality of the information.

3. When communicating preliminary findings to parties and providing for access to the case file on the basis of Article 20, the lead supervisory authority shall ensure that the parties to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of the parties with due regard for the confidentiality of the information. The final assessment whether information is confidential lies within the lead supervisory authority.

Amendment 102

Proposal for a regulation

Article 21 – paragraph 6 – introductory part

Text proposed by the Commission

Amendment

6. The lead supervisory authority may set a time-limit for parties under investigation and any other party raising a confidentiality claim to:

6. The lead supervisory authority may set a proportionate and reasonable time-limit for parties under investigation and any other party raising a confidentiality claim to:

Amendment 103

Proposal for a regulation

Article 22 – title

Text proposed by the Commission

Amendment

Referral to dispute resolution under Article 65 of Regulation (EU) 2016/679

Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679

Amendment 104

Proposal for a regulation

Article 22 – paragraph 1

Text proposed by the Commission

Amendment

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679.

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections.

Amendment 105

Proposal for a regulation

Article 22 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(a a) (aa) the summary of key issues;

Amendment 106

Proposal for a regulation

Article 22 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) a summary of the relevant facts;

(b) a summary of the relevant facts, including the description of processing activities, the description of the company's organisation and the description of where decisions are taken;

Amendment 107

Proposal for a regulation

Article 22 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority;

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as being neither relevant nor reasoned;

Amendment 108

Proposal for a regulation

Article 22 – paragraph 2 – point g

Text proposed by the Commission

Amendment

(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.

(g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned.

Amendment 109

Proposal for a regulation

Article 22 – paragraph 2 – point g a (new)

Text proposed by the Commission

Amendment

(g a) access to the joint case file.

Amendment 110

Proposal for a regulation

Article 22 – paragraph 3

Text proposed by the Commission

Amendment

3. The Board shall within four weeks of receiving the documents listed in paragraph 2 identify retained relevant and reasoned objections.

3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to the supervisory authorities.

Amendment 111

Proposal for a regulation

Article 22 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3 a. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit any relevant information that they have on that case, including but not limited to, facts and documentation that underlie their objection.

Amendment 112

Proposal for a regulation

Article 22 – paragraph 3 b (new)

Text proposed by the Commission

Amendment

3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

Amendment 113

Proposal for a regulation

Article 22 – paragraph 3 c (new)

Text proposed by the Commission

Amendment

3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation shall also apply during the periods referred in paragraph 3 of this Article.

Amendment 114

Proposal for a regulation

Article 23 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Articles 22(2) and 23 are available and translated.

Justification

Request by EDPB and EDPS opinion 1/2023.

Amendment 115

Proposal for a regulation

Article 26 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(aa) views made in writing by the parties under investigation as well as by complainants;

Amendment 116

Proposal for a regulation

Article 28 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) where applicable, the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

(f) the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

Amendment 117

Proposal for a regulation

Article 28 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the Board shall request a joint assessment carried out by at least five experts from the 'Support Pool of Experts' of the EDPB. This joint assessment shall be published together with the urgent binding decision.

Amendment 118

Proposal for a regulation

Article 29 – paragraph 2

Text proposed by the Commission

Amendment

2. Time periods shall begin on the working day following the event to which the relevant provision of Regulation (EU) 2016/679 or this Regulation refers.

deleted

Justification

As Regulation No. 1182/71 fully applies such an additional text is not necessary.

Amendment 119

Proposal for a regulation

Article 30 a (new)

Text proposed by the Commission

Amendment

Article 30a

Evaluation and review

The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.

Amendment 120

Proposal for a regulation

Article 31 – title

Text proposed by the Commission

Amendment

Entry into force

Entry into force and application

Amendment 121

Proposal for a regulation

Article 31 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

It shall apply from … [one year from the date of entry into force of this Regulation].

Justification

EDPB para 192 – transition period for necessary adjustments in EDPB secretariat and tools (IMI), national DPAs, and possibly national laws.

Amendment 122

Proposal for a regulation

Annex I – title

Text proposed by the Commission

Amendment

Part A - 3. Entity whose processing of your personal data infringes Regulation (EU) 2016/679. Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including whether you have contacted the entity prior to your complaint and outline the result of any such actions. If possible, please attach any relevant correspondence between you and the entity. In return, delete the second paragraph of Section B.

Amendment 123

Proposal for a regulation

Annex - Part A - Point 1 - paragraph 1

Text proposed by the Commission

Amendment

Where the complainant is a natural person, submit a form of identification2.

deleted

__________________

2 For example, passport, driving licence, national ID.

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 124

Proposal for a regulation

Annex - Part A - Point 2 - paragraph 3

Text proposed by the Commission

Amendment

Telephone number

deleted

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 125

Proposal for a regulation

Annex - Part B - paragraph 4 a (new)

Text proposed by the Commission

Amendment

Telephone number

Justification

Addition proposal (under”Supplementary information”) from the EDPS/EDPB joint opinion 1/2023.

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR FOR THE OPINION HAS RECEIVED INPUT

The rapporteur declares under his exclusive responsibility that he did not receive input from any entity or person to be mentioned in this Annex pursuant to Article 8 of Annex I to the Rules of Procedure.

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

Laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

References

COM(2023)0348 – C9-0231/2023 – 2023/0202(COD)

Committee responsible

Date announced in plenary

LIBE

13.7.2023

Opinion by

Date announced in plenary

JURI

13.7.2023

Rapporteur for the opinion

Date appointed

Ibán García Del Blanco

16.11.2023

Discussed in committee

11.12.2023

Date adopted

24.1.2024

Result of final vote

+:

–:

0:

14

9

0

Members present for the final vote

Pascal Arimont, Gunnar Beck, Jorge Buxadé Villalba, Ilana Cicurel, Ibán García Del Blanco, Virginie Joron, Sergey Lagodinsky, Gilles Lebreton, Sabrina Pignedoli, Jiří Pospíšil, Franco Roberti, Raffaele Stancanelli, Adrián Vázquez Lázara, Axel Voss, Marion Walsmann, Tiemo Wölken

Substitutes present for the final vote

Pascal Durand, Angelika Niebler, Nacho Sánchez Amor, Jana Toom

Substitutes under Rule 209(7) present for the final vote

Benoît Biteau, Christian Ehler, Witold Pahl

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols:

PROCEDURE – COMMITTEE RESPONSIBLE

Title

Laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

References

COM(2023)0348 – C9-0231/2023 – 2023/0202(COD)

Date submitted to Parliament

4.7.2023

Committee responsible

Date announced in plenary

LIBE

13.7.2023

Committees asked for opinions

Date announced in plenary

EMPL

13.7.2023

ITRE

13.7.2023

IMCO

13.7.2023

JURI

13.7.2023

Not delivering opinions

Date of decision

EMPL

18.7.2023

ITRE

19.7.2023

IMCO

18.7.2023

Rapporteurs

Date appointed

Sergey Lagodinsky

18.7.2023

Discussed in committee

18.7.2023

28.11.2023

Date adopted

15.2.2024

Result of final vote

+:

–:

0:

32

24

4

Members present for the final vote

Magdalena Adamowicz, Abir Al-Sahlani, Katarina Barley, Pietro Bartolo, Malin Björk, Karolin Braunsberger-Reinhold, Patrick Breyer, Saskia Bricmont, Patricia Chagnon, Clare Daly, Lena Düpont, Cornelia Ernst, Maria Grapini, Evin Incir, Sophia in ‘t Veld, Assita Kanko, Alice Kuhnke, Jeroen Lenaers, Juan Fernando López Aguilar, Lukas Mandl, Erik Marquardt, Javier Moreno Sánchez, Maite Pagazaurtundúa, Emil Radev, Diana Riba i Giner, Tineke Strik, Ramona Strugariu, Jana Toom, Milan Uhrík, Tom Vandendriessche

Substitutes present for the final vote

Beata Kempa, Dietmar Köster, Sergey Lagodinsky, Peter Pollák, Cristian Terheş, Róża Thun und Hohenstein, Axel Voss

Substitutes under Rule 209(7) present for the final vote

Alexander Alexandrov Yordanov, Catherine Amalric, Pablo Arias Echeverría, François-Xavier Bellamy, Milan Brglez, Katalin Cseh, Frances Fitzgerald, Ibán García Del Blanco, Isabel García Muñoz, Eider Gardiazabal Rubial, Catherine Griset, Jan Huitema, Stelios Kympouropoulos, Marian-Jean Marinescu, Radka Maxová, Jozef Mihál, Sven Mikser, Andrey Novakov, Witold Pahl, Evelyn Regner, Maria Veronica Rossi, Eleni Stavrou, Rainer Wieland

Date tabled

20.2.2024

FINAL VOTE BY ROLL CALL IN COMMITTEE RESPONSIBLE

Key to symbols: