Sittings · Document

OPINION (COM(2023)0348 – C90231/2023 – 2023/0202(COD)) 2024-01-30

On the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Committee on Legal Affairs · Rapporteur: Ibán García Del Blanco

PA_Legam

SHORT JUSTIFICATION

This proposal is amending the GDPR in view of the cross-border cooperation mechanism in the framework of the “one stop shop” approach. In that regard, the Commission proposed certain harmonisation measures on the cooperation between the lead supervisory authority and the concerned supervisory authorities, the harmonisation of certain procedural rights of the parties under the investigation and the complainant, the dispute resolution mechanism, and deadlines.

The Rapporteur for opinion agrees with the overall objective to achieve harmonisation of certain aspects of the mentioned issues based on the empirical experience with the current GDPR in that regard and based on the input of a whole variety of actors as listed in the Commission proposal. However, it notes, in line with the institutional principles of better law-making, that no impact assessment has been made by the Commission on such an important topic.

This opinion focuses on certain aspects where further improvement could be achieved, namely the issue of rights of parties to the proceedings in view of administrative proceedings, such as the right to be heard or to access to the case file. A clarification is equally necessary on the procedural role of the complainant throughout the EU. Moreover, certain improvements on the right to access to a file were introduced, taking into account the importance of such access to understand decisions by affected parties to the proceedings and to provide them the possibility for an effective judicial review. Several of the points raised by the EDPS and EDPB were also taken into account such as the assessment of the cross-border nature of cases or common rules in the admissibility phase of the proceedings. The rapporteur for opinion also introduced some deadlines lacking in the initial Commission proposal that are important for legal certainty across the EU.

AMENDMENT

The Committee on Legal Affairs calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 2

Text proposed by the Commission

Amendment

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board.

(2) In an effort of modernizing EU data protection rules, inter alia, by streamlining them with the European data strategy, and in order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

Amendment 2

Proposal for a regulation

Recital 2 a (new)

Text proposed by the Commission

Amendment

(2 a) This Regulation and Chapter VII of Regulation (EU) 2016/679 only govern certain elements of the cooperation procedure, when supervisory authorities of more than one Member State participate in the procedure. This Regulation does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State.

Amendment 3

Proposal for a regulation

Recital 2 b (new)

Text proposed by the Commission

Amendment

(2 b) Supervisory authorities shall make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video conference, or generally available electronic means of communication.

Amendment 4

Proposal for a regulation

Recital 2 c (new)

Text proposed by the Commission

Amendment

(2 c) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law.

Amendment 5

Proposal for a regulation

Recital 3

Text proposed by the Commission

Amendment

(3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities be created so as to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Amendment 6

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post. The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679. No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible.

(4) In order to be admissible a complaint should contain certain specified information about the alleged violation, whether ongoing or past. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a model complaint form should be provided. Where a complaint does not meet the minimum requirements, the supervisory authority should require the complainant to resubmit a complete complaint within a reasonable period of time. No additional information should be required for a complaint to be deemed admissible. The complaint may be submitted in written, electronically or by post. In particular, complainants should not be required to use a national electronic ID or e-government system to submit the complaint. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

Amendment 7

Proposal for a regulation

Recital 5

Text proposed by the Commission

Amendment

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case, including judicial remedies under Article 78 of Regulation (EU) 2016/679. This Regulation foresees specific deadlines to provide for a foreseeable procedure in line with the requirement of legal certainty as a part of the right to good administration enshrined in Article 41 of the EU Charter, and Article 6 ECHR. Procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations for delays or disruptions that are outside of the control of the lead supervisory authority. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

Amendment 8

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5 a) The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

Amendment 9

Proposal for a regulation

Recital 5 b (new)

Text proposed by the Commission

Amendment

(5b) Article 6 of the ECHR and Article 47 of the Charter require that fair procedures are public. Article 42 of the Charter and the law of many Member States foresee the right of access to public documents and the transparency of actions of authorities. However, it should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/943. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why.

Amendment 10

Proposal for a regulation

Recital 5 c (new)

Text proposed by the Commission

Amendment

(5c) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities.

Amendment 11

Proposal for a regulation

Recital 6

Text proposed by the Commission

Amendment

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate, as well as effective and dissuasive, in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective and quick remedy to the complainant can be quickly delivered. Planning the procedure is important to ensure a quick result. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the reason for the complaint. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision that can be submitted to judicial review.

Amendment 12

Proposal for a regulation

Recital 7

Text proposed by the Commission

Amendment

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant.

(7) The lead supervisory authority should regularly provide the supervisory authority with which the complaint was lodged with all the necessary information on the progress of the investigation without undue delay and for the purpose of providing updates to the complainant. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

Amendment 13

Proposal for a regulation

Recital 8

Text proposed by the Commission

Amendment

(8) The competent supervisory authority should provide the complainant with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint.

(8) The competent supervisory authority should provide the parties with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Amendment 14

Proposal for a regulation

Recital 9

Text proposed by the Commission

Amendment

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Settlements should be of a voluntary nature, and should be able to take the form of a contract between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be misused to defer decisions on complaints.

Amendment 15

Proposal for a regulation

Recital 9 a (new)

Text proposed by the Commission

Amendment

(9a) The supervisory authority is not bound by the amicable settlement. It should in particular open an ex officio investigation instead, where the party under investigation is a repeat offender, the party under investigation has been the subject of a large number of other amicable settlements, the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, the consequence of the processing which has been subject to the complaint is of long duration or serious nature.

Amendment 16

Proposal for a regulation

Recital 11

Text proposed by the Commission

Amendment

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the investigation as early as possible and prior to the communication of allegations to the parties under investigation and adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case as early as possible and at least prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

Amendment 17

Proposal for a regulation

Recital 13

Text proposed by the Commission

Amendment

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. To ensure that they are coherent and easy to understand, the legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

Amendment 18

Proposal for a regulation

Recital 14

Text proposed by the Commission

Amendment

(14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

(14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within three months after the deadline for comments.

Amendment 19

Proposal for a regulation

Recital 16

Text proposed by the Commission

Amendment

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the lead supervisory authority should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. For this purpose, the requirement of urgency should be presumed. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings. The urgent binding decision of the Board cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the rights of the parties under investigation to be heard. In particular, the Board should not extend the scope of the investigation on its own initiative.

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the involved supervisory authorities should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings.

Amendment 20

Proposal for a regulation

Recital 17

Text proposed by the Commission

Amendment

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and to ensure compliance with Article 47 of the Charter, the handling of any complaint should always lead to a decision which may be challenged before a national court.

Amendment 21

Proposal for a regulation

Recital 18

Text proposed by the Commission

Amendment

(18) Complainants should have the opportunity to express their views before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the non-confidential version of the documents on which the decision fully or partially rejecting the complaint is based.

(18) Complainants as parties to the procedure should have the opportunity to express their views and the right to be heard before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known at least prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the documents on which the decision fully or partially rejecting the complaint is based, in a way to allow him or her the possibility of effective judicial review.

Amendment 22

Proposal for a regulation

Recital 19

Text proposed by the Commission

Amendment

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed rejection of the complaint and should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also have the responsibility of preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

Justification

Clarification in line with Article 60(3), (8) and (9) GDPR.

Amendment 23

Proposal for a regulation

Recital 21

Text proposed by the Commission

Amendment

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

Amendment 24

Proposal for a regulation

Recital 22

Text proposed by the Commission

Amendment

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them, by receiving access to the administrative file.

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the right to be heard and the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to make and defend their case effectively and to comment on the allegations made, by receiving access to the case file. Where, at any stage in an investigation, a submission is made to a lead supervisory authority, which materially changes the lead supervisory authority’s view of a case, parties should be given an opportunity to respond to this submission before the lead supervisory authority takes its final decision.

Amendment 25

Proposal for a regulation

Recital 23

Text proposed by the Commission

Amendment

(23) The preliminary findings define the scope of the investigation and therefore the scope of any future final decision (as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a) of Regulation (EU) 2016/679) which may be addressed to controllers or processors. The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties under investigation have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the Article 65(1), point (a), decision resolving the dispute between the supervisory authorities. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties under investigation in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of defence rights.

(23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Amendment 26

Proposal for a regulation

Recital 24

Text proposed by the Commission

Amendment

(24) The parties under investigation should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

(24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Amendment 27

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt the complaint does not bar the qualification of a data subject as complainant. However, an investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor does not constitute an adversarial procedure between the complainant and the parties under investigation. It is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are, therefore, not in the same procedural situation and the latter cannot invoke the right to a fair hearing when the decision does not adversely affect her or his legal position. The complainant’s involvement in the procedure against the parties under investigation cannot compromise the right of these parties to be heard.

Amendment 28

Proposal for a regulation

Recital 26

Text proposed by the Commission

Amendment

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the case file, in view of protection of confidential information and integrity of the decision-making process, without prejudice to their right for an effective judicial remedy.

Amendment 29

Proposal for a regulation

Recital 27

Text proposed by the Commission

Amendment

(27) When setting deadlines for parties under investigation and complainants to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, in order to ensure that the parties under investigation and complainants have sufficient opportunity to meaningfully provide their views on the issues raised.

(27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings, as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to undue long procedures.

Amendment 30

Proposal for a regulation

Recital 28

Text proposed by the Commission

Amendment

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject. Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant and reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation.

Amendment 31

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length, should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length taking into account the complexity of the cases and the relevancy of the contributions by other supervisory authorities; they should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

Justification

It limits the length of written contributions that other supervisory authorities can make (to specific amount of pages), disregarding the different complexity of cases.

Amendment 32

Proposal for a regulation

Recital 30

Text proposed by the Commission

Amendment

(30) Access to the administrative file is provided for as a part of the rights of defence and the right to good administration enshrined in the Charter. Access to the administrative file should be provided to the parties under investigation when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

(30) Access to the case file is provided for as a part of the rights of defence, effective judicial remedy and the right to good administration enshrined in the Charter. Access to the case file should be provided to the parties under investigation at the latest when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

Amendment 33

Proposal for a regulation

Recital 31

Text proposed by the Commission

Amendment

(31) When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(31) When granting access to the case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

Amendment 34

Proposal for a regulation

Recital 34

Text proposed by the Commission

Amendment

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in a way which allows the lead supervisory authority to adopt its final decision on the basis of the decision of the Board while maintaining its discretion.

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Amendment 35

Proposal for a regulation

Recital 37 a (new)

Text proposed by the Commission

Amendment

(37 a) In order to enhance the provision for the smooth and effective functioning of the cooperation and dispute resolution mechanism in cross-border cases, the European Data Protection Board and the European Data Protection Supervisor should be increasingly provided with competences and a more prominent role in coordination to foster cooperation with the supervisory authorities.

Amendment 36

Proposal for a regulation

Article 1 – title

Text proposed by the Commission

Amendment

Subject matter

Subject matter and scope

Amendment 37

Proposal for a regulation

Article 1 – paragraph 1

Text proposed by the Commission

Amendment

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

1. This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities related to the cross-border processing withing the meaning of Regulation (EU) 2016/679.

Amendment 38

Proposal for a regulation

Article 1 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1a. This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

This Regulation does not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.

Amendment 39

Proposal for a regulation

Article 2 – paragraph 2 – point 1

Text proposed by the Commission

Amendment

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing, as well as their representative(s);

Amendment 40

Proposal for a regulation

Article 2 – paragraph 2 – point 1 a (new)

Text proposed by the Commission

Amendment

(1 a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the procedure;

Amendment 41

Proposal for a regulation

Article 2 – paragraph 2 – point 2 a (new)

Text proposed by the Commission

Amendment

(2 a) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case as defined under national law;

Amendment 42

Proposal for a regulation

Article 2 – paragraph 2 – point 4 a (new)

Text proposed by the Commission

Amendment

(4 a) ‘Confidential version of documents’ means documents containing confidential or sensitive information which may be legally privileged under the applicable laws and data protection rules.

Amendment 43

Proposal for a regulation

Article 2 – paragraph 2 – point 4 b (new)

Text proposed by the Commission

Amendment

(4 b) ‘Non-confidential version of documents’ means a version of documents from which confidential or sensitive information has been redacted and which can be provided to the complainant without contravening laws or data protection rules.

Amendment 44

Proposal for a regulation

Article 2 a (new)

Text proposed by the Commission

Amendment

Article 2a

Common minimum procedural standards

(1) Without prejudice to additional rights under national law, each party to the procedure shall have at least the following rights:

(a) have their case handled impartially and fairly, and to be treated equally, even in different jurisdictions (‘fair procedure and equality of arms’);

(b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (‘right to be heard’);

(2) The rights in paragraph (1) shall be applied as provided in this Regulation and Regulation (EU) 2016/679, and, where applicable, national law.

Amendment 45

Proposal for a regulation

Article 3 – paragraph 1

Text proposed by the Commission

Amendment

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

1. A complaint that relates to cross-border cooperation and consistency in line with Article 60 of Regulation (EU) 2016/679 shall provide at least the following information:

(a) the name, address and any other available contact details of the complainant;

(b) if known, the name, address and any other contact details of the party under investigation;

(d) the measures that the complainant demands from the supervisory authority.

No additional information shall be required in order for the complaint to be admissible.

The complaint may be submitted in written, electronically or by post.

To facilitate the complaint procedure a model form is attached in the Annex.

Amendment 46

Proposal for a regulation

Article 3 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1 a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.

Amendment 47

Proposal for a regulation

Article 3 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1 b. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

Amendment 48

Proposal for a regulation

Article 3 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.

In that regard at least the following shall be considered:

- relevant controller or processor for the processing in question;

- number of establishments of the controller or processor in the EU;

- place of the main establishment;

- activities of establishments in more than one Member State;

- substantial affect or likely substantial affect on data subjects in more than one Member State.

Amendment 49

Proposal for a regulation

Article 3 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.

3. The supervisory authority with which the complaint was lodged shall determine the admissibility of the complaint, including the completeness of the information required, and transmit it to the lead supervisory authority within three weeks upon receipt of the complaint.

Amendment 50

Proposal for a regulation

Article 3 – paragraph 4

Text proposed by the Commission

Amendment

4. Upon assessment of the completeness of the information required by the Form, the supervisory authority with which the complaint was lodged shall transmit the complaint to the lead supervisory authority.

deleted

Amendment 51

Proposal for a regulation

Article 3 – paragraph 5

Text proposed by the Commission

Amendment

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also submit a non-confidential version of the complaint.

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also provide a non-confidential version of the complaint alongside the confidential version. The supervisory authority shall only disclose it if such disclosure is necessary for the parties under investigation to exercise their rights of defence efficiently.

Amendment 52

Proposal for a regulation

Article 3 – paragraph 6

Text proposed by the Commission

Amendment

6. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

deleted

Amendment 53

Proposal for a regulation

Article 4 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

While assessing the extent appropriate to which a complaint should be investigated in each case the supervisory authority shall take into account all relevant circumstances, including all of the following:

While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall take into account all relevant circumstances, including all of the following:

Amendment 54

Proposal for a regulation

Article 4 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the expediency of delivering an effective and timely remedy to the complainant;

(a) the delivery of an effective and timely remedy to the complainant, including taking into account what is at stake for the complainant;

Amendment 55

Proposal for a regulation

Article 4 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(c a) the complainant’s use of internal complaint mechanism (CM) provided by the parties under investigation.

Amendment 56

Proposal for a regulation

Article 4 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

(1 a) The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Amendment 57

Proposal for a regulation

Article 5

Text proposed by the Commission

Amendment

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

1. A complaint may be resolved by amicable settlement between the complainant and the parties under investigation at any stage of the investigation. The supervisory authority may encourage and facilitate such a voluntary process. Amicable settlements may not be reached on the basis of payments to the complainant. A resolution of the dispute by an amicable settlement, is without prejudice to the complainant claiming compensation pursuant to Article 82 of Regulation (EU) 2016/679.

(1a) An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement.

(1b) The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it. The supervisory authority may encourage and facilitate amicable settlements where relevant.

(1c) Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

(1d) If the amicable settlement was reached by the lead supervisory authority Article 60(3) and (4) of Regulation 2016/679 applies.

(1e) The supervisory authorities are not bound by the amicable settlement in view of a further ex officio investigation.

Amendment 58

Proposal for a regulation

Article 5 a (new)

Text proposed by the Commission

Amendment

Article 5a

Request for an ex officio procedure

1. The lead supervisory authority may open an ex officio procedure at any time.

2. Where it considers that Regulation (EU) 2016/679 may be violated, any concerned supervisory authority may request an ex officio procedure by submitting a written request to the lead supervisory authority. Such a request shall contain at least:

(a) a declaration to be a concerned supervisory authority;

(b) any evidence of the violation;

3. Within three weeks, the assumed lead supervisory authority shall:

(a) inform the concerned supervisory authority that it has opened an ex officio procedure;

(b) inform the concerned supervisory authority that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself in line; or

(c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no violation of Regulation (EU) 2016/679.

In the case referred to in point (a) of this paragraph, the concerned supervisory authority may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679.

In the case referred to in point (c) of this paragraph, the concerned supervisory authority may resubmit an amended request for an ex officio procedure, or request a determination on the opening of the procedure by the Board.

Amendment 59

Proposal for a regulation

Article 6 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation, or into the working language agreed on between the supervisory authorities concerned, for the purposes of the investigation;

Amendment 60

Proposal for a regulation

Article 6 – paragraph 1 – point b

Text proposed by the Commission

Amendment

(b) translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

(b) translation of documents provided by the lead supervisory authority into the language used or agreed for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679

Amendment 61

Proposal for a regulation

Article 6 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1 a. A supervisory authority may provide automated translations and unofficial translations.

Amendment 62

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, without undue delay, and at the latest within one week with all relevant information once available.

Amendment 63

Proposal for a regulation

Article 9 – paragraph 1

Text proposed by the Commission

Amendment

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues as soon as possible and on the latest within 9 months for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

Amendment 64

Proposal for a regulation

Article 9 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(a a) the response of the parties under investigation;

Amendment 65

Proposal for a regulation

Article 9 – paragraph 2 – point d a (new)

Text proposed by the Commission

Amendment

(d a) an overview of both, the replies of all parties under investigation as well as the views of the complainant on to the preliminary findings;

Amendment 66

Proposal for a regulation

Article 9 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues.

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues, in accordance with Article 60 of Regulation (EU) 2016/679.

Amendment 67

Proposal for a regulation

Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. The Board may specify in its rules of procedure restrictions on the maximum length of comments submitted by supervisory authorities concerned on the summary of key issues.

deleted

Amendment 68

Proposal for a regulation

Article 9 – paragraph 6

Text proposed by the Commission

Amendment

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

6. In non-contentious cases the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

Amendment 69

Proposal for a regulation

Article 10 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(c a) the potential corrective measures.

Amendment 70

Proposal for a regulation

Article 10 – paragraph 4

Text proposed by the Commission

Amendment

4. Where, in a complaint-based investigation, there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matter referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority or the concerned supervisory authorities may request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679.

Amendment 71

Proposal for a regulation

Article 10 – paragraph 5 – point a

Text proposed by the Commission

Amendment

(a) the documents referred to in Article 9(2), points (a) and (b);

(a) the relevant information referred to in Article 9(2);

Amendment 72

Proposal for a regulation

Article 10 – paragraph 5 – point b a (new)

Text proposed by the Commission

Amendment

(b a) other documents or information, as the European Data Protection Board deems appropriate in the particular case.

Amendment 73

Proposal for a regulation

Article 10 – paragraph 6

Text proposed by the Commission

Amendment

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

6. The Board shall adopt an urgent binding decision limited on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

Amendment 74

Proposal for a regulation

Article 11 – paragraph 4

Text proposed by the Commission

Amendment

4. The complainant may request access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.

4. The complainant may request access to the documents on which the proposed rejection of the complaint is based using mutatis mutandis Chapter IV of this Regulation.

Amendment 75

Proposal for a regulation

Article 11 – paragraph 5

Text proposed by the Commission

Amendment

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, under Article 60(8) or Article 60(9) of Regulation (EU) 2016/679, as applicable, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

Amendment 76

Proposal for a regulation

Article 12 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements. The time limit set should not be less than two weeks.

Justification

It should be clear that the consideration that a complainant should be re-heard is not an arbitrary power but should take place if there are essential changes to the draft. At the same time, there should be a minimum level of time for an answer like in Article 11(2) of the proposed regulation. The limit was set to two weeks per analogy with Article 60(5) GDPR. Para. 2 was merged with para.1.

Amendment 77

Proposal for a regulation

Article 12 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall set a time-limit within which the complainant may make known her or his views.

deleted

Amendment 78

Proposal for a regulation

Article 14 – title

Text proposed by the Commission

Amendment

Preliminary findings and reply

Preliminary finding and the right to be heard by parties under investigation

Amendment 79

Proposal for a regulation

Article 14 – paragraph 2 – subparagraph 1

Text proposed by the Commission

Amendment

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they must set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties are heard and can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Amendment 80

Proposal for a regulation

Article 14 – paragraph 4

Text proposed by the Commission

Amendment

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. That time-limit must be reasonable and proportionate and take into account the results of the investigations, and shall be no less than three weeks. The lead supervisory authority may receive additional written views from the parties under investigation after the expiry of this time limit but it shall not be obliged to take it into account.

Amendment 81

Proposal for a regulation

Article 14 – paragraph 5

Text proposed by the Commission

Amendment

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Article 20.

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the case file in accordance with Chapter IV.

Amendment 82

Proposal for a regulation

Article 15 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings within 30 days following receipt of the preliminary findings, and set a time-limit within which the complainant may make known its views in writing. The time-limit shall be proportionate to afford the complainants adequate time to provide their response, and shall be no less than three weeks.

Amendment 83

Proposal for a regulation

Article 15 – paragraph 3

Text proposed by the Commission

Amendment

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the administrative file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1.

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the case file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1, without prejudice for the rights for an effective remedy.

Amendment 84

Proposal for a regulation

Article 15 – paragraph 4

Text proposed by the Commission

Amendment

4. The complainant shall be provided with the non-confidential version of the preliminary findings only for the purpose of the concrete investigation in which the preliminary findings were issued.

4. The complainant shall be provided with the non-confidential version of the preliminary findings for the purpose of the investigation concerning her or his specific complaint in which the preliminary findings were issued. The non-confidential version shall be provided in order to facilitate the complainant’s participation in the investigation procedure and to enable her or him to put forward her or his views and arguments adequately within that investigation.

Amendment 85

Proposal for a regulation

Article 15 – paragraph 5

Text proposed by the Commission

Amendment

5. Before receiving the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the complainant shall send to the lead supervisory authority a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than the concrete investigation in which those findings were issued.

5. Before providing the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the supervisory authority with which the complaint was lodged shall request the complainant to sign a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than making submission on the concrete investigation in which those findings were issued. Legal consequences of refusing to sign or to comply with the confidentiality declaration shall be specified.

Amendment 86

Proposal for a regulation

Article 16 – paragraph 1

Text proposed by the Commission

Amendment

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

In such case, the supervisory authority shall also provide the controller or processor information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

Justification

Clear time period as regards the application of Article 60(7) GDPR once all the procedures on reasoned opinions or consistency mechanism are finished. See also EDPS and EDPB joint opinion 1/2023.

Amendment 87

Proposal for a regulation

Article 17 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to exercise their right to be heard and to make their views known on such new elements.

Amendment 88

Proposal for a regulation

Article 17 – paragraph 2

Text proposed by the Commission

Amendment

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views. That time-limit must be reasonable and proportionate and take into account the results of the investigations, and shall not be less than two weeks.

Amendment 89

Proposal for a regulation

Article 18 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

(a) the reasoned objection shall be concise, transparent, intelligible and provided in an easily accessible form, using clear and plain language;

Justification

The provision is too formalistic, not taking into account the diversity of possible cases. The duty is to have concise documents but not in the form of specific number of pages.

Amendment 90

Proposal for a regulation

Chapter IV – title

Text proposed by the Commission

Amendment

Access to the administrative file and treatment of confidential information

Access to the case file and treatment of confidential information

Amendment 91

Proposal for a regulation

Article 19 – title

Text proposed by the Commission

Amendment

Content of the administrative file

Content of the case file

Amendment 92

Proposal for a regulation

Article 19 – paragraph 1

Text proposed by the Commission

Amendment

1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

1. The case file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

Amendment 93

Proposal for a regulation

Article 19 – paragraph 2

Text proposed by the Commission

Amendment

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority may return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the administrative file.

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority shall return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the case file.

Amendment 94

Proposal for a regulation

Article 19 – paragraph 3

Text proposed by the Commission

Amendment

3. The right of access to the administrative file shall not extend to correspondence and exchange of views between the lead supervisory authority and supervisory authorities concerned. The information exchanged between the supervisory authorities for the purpose of the investigation of an individual case are internal documents and shall not be accessible to the parties under investigation or the complainant.

deleted

Amendment 95

Proposal for a regulation

Article 20 – title

Text proposed by the Commission

Amendment

Access to the administrative file and use of documents

Access to the case file and use of documents

Amendment 96

Proposal for a regulation

Article 20 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall grant access to the administrative file to the parties under investigation, enabling them to exercise their right to be heard. Access to the administrative file shall be granted after the lead supervisory authority notifies the preliminary findings to the parties under investigation.

1. The lead supervisory authority shall grant access to the case file to the parties, enabling them to exercise their right to be heard and the right to an effective judicial remedy. Access to the case file shall be granted at the latest after the lead supervisory authority notifies the preliminary findings to the parties.

Amendment 97

Proposal for a regulation

Article 20 – paragraph 2

Text proposed by the Commission

Amendment

2. The administrative file shall include all documents, inculpatory and exculpatory, including facts and documents which are known to the parties under investigation.

2. The case file shall include all documents, inculpatory and exculpatory, including facts and documents concerning the parties under investigation.

Amendment 98

Proposal for a regulation

Article 20 – paragraph 3

Text proposed by the Commission

Amendment

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties under investigation had the opportunity to make their views known.

Amendment 99

Proposal for a regulation

Article 20 – paragraph 4

Text proposed by the Commission

Amendment

4. Documents obtained through access to the administrative file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided.

4. Documents obtained through access to the case file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided to the parties.

Amendment 100

Proposal for a regulation

Article 21 – paragraph 2

Text proposed by the Commission

Amendment

2. Any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, is excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing.

2. In line with applicable national and EU law on access to documents any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, may be excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing. The same exclusion applies to business secrets and other confidential information.

Amendment 101

Proposal for a regulation

Article 21 – paragraph 3

Text proposed by the Commission

Amendment

3. When communicating preliminary findings to parties under investigation and providing for access to the administrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties under investigation to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of defence of the parties under investigation with due regard for the confidentiality of the information.

3. When communicating preliminary findings to parties and providing for access to the case file on the basis of Article 20, the lead supervisory authority shall ensure that the parties to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of the parties with due regard for the confidentiality of the information. The final assessment whether information is confidential lies within the lead supervisory authority.

Amendment 102

Proposal for a regulation

Article 21 – paragraph 6 – introductory part

Text proposed by the Commission

Amendment

6. The lead supervisory authority may set a time-limit for parties under investigation and any other party raising a confidentiality claim to:

6. The lead supervisory authority may set a proportionate and reasonable time-limit for parties under investigation and any other party raising a confidentiality claim to:

Amendment 103

Proposal for a regulation

Article 22 – title

Text proposed by the Commission

Amendment

Referral to dispute resolution under Article 65 of Regulation (EU) 2016/679

Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679

Amendment 104

Proposal for a regulation

Article 22 – paragraph 1

Text proposed by the Commission

Amendment

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679.

Amendment 105

Proposal for a regulation

Article 22 – paragraph 2 – point a a (new)

Text proposed by the Commission

Amendment

(a a) (aa) the summary of key issues;

Amendment 106

Proposal for a regulation

Article 22 – paragraph 2 – point b

Text proposed by the Commission

Amendment

(b) a summary of the relevant facts;

(b) a summary of the relevant facts, including the description of processing activities, the description of the company's organisation and the description of where decisions are taken;

Amendment 107

Proposal for a regulation

Article 22 – paragraph 2 – point f

Text proposed by the Commission

Amendment

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority;

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as being neither relevant nor reasoned;

Amendment 108

Proposal for a regulation

Article 22 – paragraph 2 – point g

Text proposed by the Commission

Amendment

(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.

(g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned.

Amendment 109

Proposal for a regulation

Article 22 – paragraph 2 – point g a (new)

Text proposed by the Commission

Amendment

(g a) access to the joint case file.

Amendment 110

Proposal for a regulation

Article 22 – paragraph 3

Text proposed by the Commission

Amendment

3. The Board shall within four weeks of receiving the documents listed in paragraph 2 identify retained relevant and reasoned objections.

3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to the supervisory authorities.

Amendment 111

Proposal for a regulation

Article 22 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3 a. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit any relevant information that they have on that case, including but not limited to, facts and documentation that underlie their objection.

Amendment 112

Proposal for a regulation

Article 22 – paragraph 3 b (new)

Text proposed by the Commission

Amendment

3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

Amendment 113

Proposal for a regulation

Article 22 – paragraph 3 c (new)

Text proposed by the Commission

Amendment

3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation shall also apply during the periods referred in paragraph 3 of this Article.

Amendment 114

Proposal for a regulation

Article 23 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Articles 22(2) and 23 are available and translated.

Justification

Request by EDPB and EDPS opinion 1/2023.

Amendment 115

Proposal for a regulation

Article 26 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(aa) views made in writing by the parties under investigation as well as by complainants;

Amendment 116

Proposal for a regulation

Article 28 – paragraph 1 – point f

Text proposed by the Commission

Amendment

(f) where applicable, the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

(f) the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

Amendment 117

Proposal for a regulation

Article 28 – paragraph 3 a (new)

Text proposed by the Commission

Amendment

3a. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the Board shall request a joint assessment carried out by at least five experts from the 'Support Pool of Experts' of the EDPB. This joint assessment shall be published together with the urgent binding decision.

Amendment 118

Proposal for a regulation

Article 29 – paragraph 2

Text proposed by the Commission

Amendment

2. Time periods shall begin on the working day following the event to which the relevant provision of Regulation (EU) 2016/679 or this Regulation refers.

deleted

Justification

As Regulation No. 1182/71 fully applies such an additional text is not necessary.

Amendment 119

Proposal for a regulation

Article 30 a (new)

Text proposed by the Commission

Amendment

Article 30a

Evaluation and review

The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.

Amendment 120

Proposal for a regulation

Article 31 – title

Text proposed by the Commission

Amendment

Entry into force

Entry into force and application

Amendment 121

Proposal for a regulation

Article 31 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

It shall apply from … [one year from the date of entry into force of this Regulation].

Justification

EDPB para 192 – transition period for necessary adjustments in EDPB secretariat and tools (IMI), national DPAs, and possibly national laws.

Amendment 122

Proposal for a regulation

Annex I – title

Text proposed by the Commission

Amendment

Part A - 3. Entity whose processing of your personal data infringes Regulation (EU) 2016/679. Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including whether you have contacted the entity prior to your complaint and outline the result of any such actions. If possible, please attach any relevant correspondence between you and the entity. In return, delete the second paragraph of Section B.

Amendment 123

Proposal for a regulation

Annex - Part A - Point 1 - paragraph 1

Text proposed by the Commission

Amendment

Where the complainant is a natural person, submit a form of identification2.

deleted

__________________

2 For example, passport, driving licence, national ID.

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 124

Proposal for a regulation

Annex - Part A - Point 2 - paragraph 3

Text proposed by the Commission

Amendment

Telephone number

deleted

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 125

Proposal for a regulation

Annex - Part B - paragraph 4 a (new)

Text proposed by the Commission

Amendment

Telephone number

Justification

Addition proposal (under”Supplementary information”) from the EDPS/EDPB joint opinion 1/2023.

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR FOR THE OPINION HAS RECEIVED INPUT

The rapporteur declares under his exclusive responsibility that he did not receive input from any entity or person to be mentioned in this Annex pursuant to Article 8 of Annex I to the Rules of Procedure.

PROCEDURE – COMMITTEE ASKED FOR OPINION

Title

Laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

References

COM(2023)0348 – C9-0231/2023 – 2023/0202(COD)

Committee responsible

Date announced in plenary

LIBE

13.7.2023

Opinion by

Date announced in plenary

JURI

13.7.2023

Rapporteur for the opinion

Date appointed

Ibán García Del Blanco

16.11.2023

Discussed in committee

11.12.2023

Date adopted

24.1.2024

Result of final vote

–:

Members present for the final vote

Pascal Arimont, Gunnar Beck, Jorge Buxadé Villalba, Ilana Cicurel, Ibán García Del Blanco, Virginie Joron, Sergey Lagodinsky, Gilles Lebreton, Sabrina Pignedoli, Jiří Pospíšil, Franco Roberti, Raffaele Stancanelli, Adrián Vázquez Lázara, Axel Voss, Marion Walsmann, Tiemo Wölken

Substitutes present for the final vote

Pascal Durand, Angelika Niebler, Nacho Sánchez Amor, Jana Toom

Substitutes under Rule 209(7) present for the final vote

Benoît Biteau, Christian Ehler, Witold Pahl

FINAL VOTE BY ROLL CALL IN COMMITTEE ASKED FOR OPINION

Key to symbols: