Sittings · Document

DRAFT OPINION (COM(2023)0348 – C90231/2023 – 2023/0202(COD)) 2023-11-29

On the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Committee on Legal Affairs · Rapporteur: Ibán García Del Blanco

PA_Legam

SHORT JUSTIFICATION

This proposal is amending the GDPR in view of the cross-border cooperation mechanism in the framework of the “one stop shop” approach. In that regard, the Commission proposed certain harmonisation measures on the cooperation between the lead supervisory authority and the concerned supervisory authorities, the harmonisation of certain procedural rights of the parties under the investigation and the complainant, the dispute resolution mechanism, and deadlines.

The Rapporteur for opinion agrees with the overall objective to achieve harmonisation of certain aspects of the mentioned issues based on the empirical experience with the current GDPR in that regard and based on the input of a whole variety of actors as listed in the Commission proposal. However, it notes, in line with the institutional principles of better law-making, that no impact assessment has been made by the Commission on such an important topic.

This opinion focuses on certain aspects where further improvement could be achieved, namely the issue of rights of parties to the proceedings in view of administrative proceedings, such as the right to be heard or to access to the case file. A clarification is equally necessary on the procedural role of the complainant throughout the EU. Moreover, certain improvements on the right to access to a file were introduced, taking into account the importance of such access to understand decisions by affected parties to the proceedings and to provide them the possibility for an effective judicial review. Several of the points raised by the EDPS and EDPB were also taken into account such as the assessment of the cross-border nature of cases or common rules in the admissibility phase of the proceedings. The rapporteur for opinion also introduced some deadlines lacking in the initial Commission proposal that are important for legal certainty across the EU.

AMENDMENT

The Committee on Legal Affairs calls on the Committee on Civil Liberties, Justice and Home Affairs, as the committee responsible, to take the following into account:

Amendment 1

Proposal for a regulation

Recital 2

Text proposed by the Commission

Amendment

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board.

(2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’).

Or. en

Amendment 2

Proposal for a regulation

Recital 2 a (new)

Text proposed by the Commission

Amendment

(2 a) In line with the principle on the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be affected due to differences in national procedural law.

Or. en

Justification

Certain matters are not harmonised and national procedural rules still apply.

Amendment 3

Proposal for a regulation

Recital 4

Text proposed by the Commission

Amendment

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post. The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679. No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities, as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible.

(4) In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a model complaint form should be provided. Where a complaint does not meet the minimum requirements, the supervisory authority should require the complainant to resubmit a complete complaint within a reasonable period of time. No additional information should be required for a complaint to be deemed admissible. The complaint may be submitted electronically or by post. In particular, complainants should not be required to use a national electronic ID or e-government system to submit the complaint. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

Or. en

Justification

The form should not be mandatory but only attached as a model, as many complainants will initially not know if a case is a cross-border one. Further, no burdensome transmission steps should be required, such as the use of a particular national e-government system.

Amendment 4

Proposal for a regulation

Recital 5

Text proposed by the Commission

Amendment

(5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

Or. en

Amendment 5

Proposal for a regulation

Recital 5 a (new)

Text proposed by the Commission

Amendment

(5 a) This Regulation foresees specific deadlines to provide for a foreseeable procedure in line with the requirement of legal certainty as a part of the right to good administration enshrined in Article 41 of the EU Charter.

Or. en

Amendment 6

Proposal for a regulation

Recital 6

Text proposed by the Commission

Amendment

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure an effective and quick remedy to the complainant. The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the reason for the complaint. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision that can be submitted to judicial review.

Or. en

Justification

There can be no unlimited discretion of supervisory authorities in view of possible action. Further, the use of a judicial remedy should not be an element of consideration as it is a fundamental right of the data subject.

Amendment 7

Proposal for a regulation

Recital 7

Text proposed by the Commission

Amendment

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant.

(7) The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with all the necessary information on the progress of the investigation without undue delay and for the purpose of providing updates to the complainant.

Or. en

Amendment 8

Proposal for a regulation

Recital 8

Text proposed by the Commission

Amendment

(8) The competent supervisory authority should provide the complainant with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint.

(8) The competent supervisory authority should provide the parties with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Or. en

Amendment 9

Proposal for a regulation

Recital 9

Text proposed by the Commission

Amendment

(9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Settlements should be of a voluntary nature. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be misused to defer decisions on complaints.

Or. en

Amendment 10

Proposal for a regulation

Recital 11

Text proposed by the Commission

Amendment

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the investigation as early as possible and prior to the communication of allegations to the parties under investigation and adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case as early as possible and at least prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

Or. en

Amendment 11

Proposal for a regulation

Recital 13

Text proposed by the Commission

Amendment

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

Or. en

Justification

Supervisory authorities have independence and autonomy. Therefore, it is not possible to beforehand prescribe in full detail how and in what length they shall communicate with each other.

Amendment 12

Proposal for a regulation

Recital 14

Text proposed by the Commission

Amendment

(14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

Or. en

Justification

A deadline of nine months in non-contentious cases does not seem appropriate and in line with the rights for decisions in reasonable time and good administration.

Amendment 13

Proposal for a regulation

Recital 16

Text proposed by the Commission

Amendment

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the lead supervisory authority should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. For this purpose, the requirement of urgency should be presumed. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings. The urgent binding decision of the Board cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the rights of the parties under investigation to be heard. In particular, the Board should not extend the scope of the investigation on its own initiative.

(16) If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the involved supervisory authorities should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings.

Or. en

Justification

In accordance with Article 66(3) GDPR any supervisory authority may request an urgent decision. Further, the Board should have wide powers in view of the decision on the investigation.

Amendment 14

Proposal for a regulation

Recital 17

Text proposed by the Commission

Amendment

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the handling of any complaint should always lead to a decision which may be challenged before a national court.

Or. en

Justification

To ensure that cases are not closed without a clear decision which can be appealed.

Amendment 15

Proposal for a regulation

Recital 18

Text proposed by the Commission

Amendment

(18) Complainants should have the opportunity to express their views before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the non-confidential version of the documents on which the decision fully or partially rejecting the complaint is based.

(18) Complainants as parties to the procedure should have the opportunity to express their views and the right to be heard before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known at least prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the documents on which the decision fully or partially rejecting the complaint is based, in a way to allow him or her the possibility of effective judicial review.

Or. en

Justification

It has to be clear that the complainant as a party has the right to be heard before decisions affecting his or her rights. Further, he should have also rights to documents necessary to understand the decision and allow him or her the possibility of effective judicial review.

Amendment 16

Proposal for a regulation

Recital 19

Text proposed by the Commission

Amendment

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed rejection of the complaint and should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also have the responsibility of preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

(19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

Or. en

Justification

Clarification in line with Article 60(3), (8) and (9) GDPR.

Amendment 17

Proposal for a regulation

Recital 21

Text proposed by the Commission

Amendment

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

(21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’),, including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case.

Or. en

Amendment 18

Proposal for a regulation

Recital 22

Text proposed by the Commission

Amendment

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them, by receiving access to the administrative file.

(22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the right to be heard and the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to make and defend their case effectively and to comment on the allegations made, by receiving access to the case file.

Or. en

Justification

It should be clarified that the recital is referring to the procedural right to be heard, as well as that the access is to the case file as such preventing any further artificial denominations or subcategories of parts of the file.

Amendment 19

Proposal for a regulation

Recital 23

Text proposed by the Commission

Amendment

(23) The preliminary findings define the scope of the investigation and therefore the scope of any future final decision (as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a) of Regulation (EU) 2016/679) which may be addressed to controllers or processors. The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties under investigation have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the Article 65(1), point (a), decision resolving the dispute between the supervisory authorities. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties under investigation in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of defence rights.

(23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Or. en

Amendment 20

Proposal for a regulation

Recital 24

Text proposed by the Commission

Amendment

(24) The parties under investigation should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

(24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Or. en

Amendment 21

Proposal for a regulation

Recital 25

Text proposed by the Commission

Amendment

(25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt the complaint does not bar the qualification of a data subject as complainant. However, an investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor does not constitute an adversarial procedure between the complainant and the parties under investigation. It is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are, therefore, not in the same procedural situation and the latter cannot invoke the right to a fair hearing when the decision does not adversely affect her or his legal position. The complainant’s involvement in the procedure against the parties under investigation cannot compromise the right of these parties to be heard.

Or. en

Amendment 22

Proposal for a regulation

Recital 26

Text proposed by the Commission

Amendment

(26) The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the administrative file.

Or. en

Justification

Judicial remedy of complainants should not be affected.

Amendment 23

Proposal for a regulation

Recital 28

Text proposed by the Commission

Amendment

(28) The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject. Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant and reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation.

Or. en

Justification

Unduly limits the options for concerned supervisory authorities to raise objections.

Amendment 24

Proposal for a regulation

Recital 29

Text proposed by the Commission

Amendment

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length, should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length taking into account the complexity of the cases and the relevancy of the contributions by other supervisory authorities; they should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

Or. en

Justification

It limits the length of written contributions that other supervisory authorities can make (to specific amount of pages), disregarding the different complexity of cases.

Amendment 25

Proposal for a regulation

Recital 30

Text proposed by the Commission

Amendment

(30) Access to the administrative file is provided for as a part of the rights of defence and the right to good administration enshrined in the Charter. Access to the administrative file should be provided to the parties under investigation when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

(30) Access to the case file is provided for as a part of the rights of defence, effective judicial remedy and the right to good administration enshrined in the Charter. Access to the case file should be provided to the parties under investigation at the latest when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set.

Or. en

Amendment 26

Proposal for a regulation

Recital 31

Text proposed by the Commission

Amendment

(31) When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(31) When granting access to the case file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

Or. en

Amendment 27

Proposal for a regulation

Recital 34

Text proposed by the Commission

Amendment

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in a way which allows the lead supervisory authority to adopt its final decision on the basis of the decision of the Board while maintaining its discretion.

(34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Or. en

Amendment 28

Proposal for a regulation

Recital 37 a (new)

Text proposed by the Commission

Amendment

(37 a) In order to enhance the provision for the smooth and effective functioning of the cooperation and dispute resolution mechanism in cross-border cases, the European Data Protection Board and the European Data Protection Supervisor should be increasingly provided with competences and a more prominent role in coordination to foster cooperation with the supervisory authorities.

Or. en

Amendment 29

Proposal for a regulation

Article 1 – paragraph 1

Text proposed by the Commission

Amendment

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities related to the cross-border cooperation and consistency within the meaning of Regulation (EU) 2016/679.

Or. en

Justification

It should reflect the title of Chapter VII of GDPR, namely “Cooperation and Consistency”

Amendment 30

Proposal for a regulation

Article 2 – paragraph 2 – point 1 a (new)

Text proposed by the Commission

Amendment

(1 a) ‘complainant’ means the subject that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the procedure;

Or. en

Justification

It should be clear that the complainant is any subject justified to lodge a complaint under Article 77 GDPR and that, hence, he or she is a party to the procedure with particular rights. See EDPB, Letter to Commission, 22 October 2022, Annex.

Amendment 31

Proposal for a regulation

Article 2 a (new)

Text proposed by the Commission

Amendment

Article 2a

Minimum procedural rights

(1) Without prejudice to rights under national law, each party to the procedure shall have at least the following rights:

(a) have their case handled impartially and fairly, and to be treated equally (“fair procedure and equality of arms”);

(b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (“right to be heard”);

(2) The rights in paragraph (1) shall be applied as provided in this Regulation and Regulation (EU) 2016/679, and, where applicable, national law.

Or. en

Justification

It is necessary to clarify the main rights of the parties to the procedure as requested by the EDPB. Such rights shall be applied in line with this Regulation and Regulation (EU) 2016/679, if harmonised, or in accordance with national law, if not harmonised.

Amendment 32

Proposal for a regulation

Article 3 – paragraph 1

Text proposed by the Commission

Amendment

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

1. A complaint that relates to cross-border cooperation and consistency in line with Article 60 of Regulation (EU) 2016/679 shall provide the following information:

(a) the name, address and any other available contact details of the complainant,

(b) if known, the name, address and any other contact details of the party under investigation,

(d) the measures that the complainant demands from the supervisory authority. No additional information shall be required in order for the complaint to be admissible.

The complaint may be submitted electronically or by post.

To facilitate the complaint procedure a model form is attached in the Annex.

Or. en

Justification

A common form is useful to harmonise right and procedures. However, it should not be obligatory as often the complainant cannot know if the case has a cross-border dimension, and, therefore, minimum requirements to ensure that the complaint is admissible should be defined by the legislature in the operative part. Also text on the forms of transmission should be in the operative part, not only in the recitals. See AM to Recital 4.

Amendment 33

Proposal for a regulation

Article 3 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

1 a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.

Or. en

Justification

To prevent the undue rejection of complaints as observed in the practice of some DPAs.

Amendment 34

Proposal for a regulation

Article 3 – paragraph 1 b (new)

Text proposed by the Commission

Amendment

1 b. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3

Or. en

Justification

Moved up from paragraph 6, to follow the sequence of events.

Amendment 35

Proposal for a regulation

Article 3 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.

In that regard at least the following shall be considered:

- relevant controller or processor for the processing in question;

- number of establishments of the controller or processor in the EU;

- place of the main establishment;

- activities of establishments in more than one Member State;

- substantial affect or likely substantial affect on data subjects in more than one Member State.

Or. en

Justification

Request from EDPS/EDPB joint opinion 1/2023.

Amendment 36

Proposal for a regulation

Article 3 – paragraph 3

Text proposed by the Commission

Amendment

3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.

3. The supervisory authority with which the complaint was lodged shall determine the admissibility of the complaint, including completeness of the information required, and transmit it to the lead supervisory authority within three weeks upon receipt of the complaint.

Or. en

Justification

Merger of paragraphs 3 and 4 to prevent a streamlined procedure without legal lacunae on the transmission deadline to the lead DPA in view of Articles 56 and 60 GDPR. Also a deadline of three weeks for this initial phase seems long enough in view of an efficient legal remedy and the right to good administration in accordance with Article 41 of the Charter. See also EDPB, Letter to Commission, 22 October 2022, Annex, as well as EDPS and EDPB joint opinion 1/2023.

Amendment 37

Proposal for a regulation

Article 3 – paragraph 4

Text proposed by the Commission

Amendment

4. Upon assessment of the completeness of the information required by the Form, the supervisory authority with which the complaint was lodged shall transmit the complaint to the lead supervisory authority.

deleted

Or. en

Justification

Merger with paragraph 3.

Amendment 38

Proposal for a regulation

Article 3 – paragraph 6

Text proposed by the Commission

Amendment

6. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

deleted

Or. en

Justification

Moved up to paragraph 1a, to follow the chronological order of events.

Amendment 39

Proposal for a regulation

Article 4 – paragraph 1 – introductory part

Text proposed by the Commission

Amendment

While assessing the extent appropriate to which a complaint should be investigated in each case the supervisory authority shall take into account all relevant circumstances, including all of the following:

While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall take into account all relevant circumstances, including all of the following:

Or. en

Justification

Request for clarification by EDPS and EDPB joint opinion 1/2023.

Amendment 40

Proposal for a regulation

Article 4 – paragraph 1 – point a

Text proposed by the Commission

Amendment

(a) the expediency of delivering an effective and timely remedy to the complainant;

(a) the delivery of an effective and timely remedy to the complainant, including taking into account what is at stake for the complainant;

Or. en

Amendment 41

Proposal for a regulation

Article 4 – paragraph 1 – point a a (new)

Text proposed by the Commission

Amendment

(a a) The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Or. en

Justification

Each complaint must concluded in a way to lead to an appealable decision in accordance with the right of an effective judicial remedy as stated in Article 78 GDPR and stated in Article 47 of the EU Charter.

Amendment 42

Proposal for a regulation

Article 5 – paragraph 1

Text proposed by the Commission

Amendment

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

1. A complaint may be resolved by amicable settlement between the complainant and the parties under investigation in cases concerning the data subjects’ rights and where with the resolution of the dispute, the object of the complaint will no longer present. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement.

2. The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it.

3. Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

4. If the amicable settlement was reached by the lead supervisory authority Article 60(3) and (4) of Regulation 2016/679 applies.

5. The supervisory authorities are not bound by the amicable settlement in view of a further ex officio investigation.

Or. en

Justification

The complainant has to be part of the amicable settlement and should agree with it. If the agreement was achieved by the LSA than specific intervention possibilities apply to CSA according to Article 60(3) and (4) GDPR. The settlement is without prejudice to ex officio powers of supervisory authorities. See .EDPB, Guidelines 06/2022 on the practical implementation of amicable settlements, 2022, and EDPS and EDPB joint opinion 1/2023.

Amendment 43

Proposal for a regulation

Article 8 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, without undue delay, and on the latest within one week, with all relevant information once available.

Or. en

Amendment 44

Proposal for a regulation

Article 8 – paragraph 2 a (new)

Text proposed by the Commission

Amendment

2 a. The information listed in the first subparagraph above shall be transmitted immediately and at the latest within one week from receiving or producing it.

Or. en

Justification

For the mentioned relevant information in subparagraph 1 of paragraph 2 there should be a stricter defined deadline. The concept should be in principle “immediate” and an additional fixed deadline is added.

Amendment 45

Proposal for a regulation

Article 9 – paragraph 1

Text proposed by the Commission

Amendment

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues as soon as possible and on the latest within 9 months for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

Or. en

Justification

Introduction of specific deadline for contentious cases as requested by EDPS and EDPB joint opinion 1/2023.

Amendment 46

Proposal for a regulation

Article 9 – paragraph 5

Text proposed by the Commission

Amendment

5. The Board may specify in its rules of procedure restrictions on the maximum length of comments submitted by supervisory authorities concerned on the summary of key issues.

deleted

Or. en

Justification

Such a provision unnecessarily puts formal burdens on the communication between LSA and other concerned supervisory authorities and goes against the letter and spirit of Articles 60, 61 and 62 GDPR. See also EDPS and EDBP joint opinion 1/2023 requesting deletion.

Amendment 47

Proposal for a regulation

Article 9 – paragraph 6

Text proposed by the Commission

Amendment

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

Or. en

Justification

A nine-month deadline in non-contentious cases seems excessive in view of proceedings in reasonable time and the right to good administration as specified in Article 41 of the Charter.

Amendment 48

Proposal for a regulation

Article 10 – paragraph 1 – point c a (new)

Text proposed by the Commission

Amendment

(c a) the potential corrective measures.

Or. en

Justification

Request by EDPS and EDPB joint opinion 1/2023.

Amendment 49

Proposal for a regulation

Article 10 – paragraph 4

Text proposed by the Commission

Amendment

4. Where, in a complaint-based investigation, there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matter referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority or the concerned supervisory authorities may request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679.

Or. en

Justification

The procedure foreseen in Article 66(3) GDPR refers to any supervisory authority. Further, the urgent procedure should be optional depending on the case and the EDPB should not be forced to take it. Therefore, the deletion of last sentence. See also EDPS and EDPB opinion 1/2023 sincere and effective cooperation between the lead supervisory authorities and other supervisory authorities concerned applies to both, complaint based procedures and others.

Amendment 50

Proposal for a regulation

Article 10 – paragraph 5 – point a

Text proposed by the Commission

Amendment

(a) the documents referred to in Article 9(2), points (a) and (b);

(a) the relevant information referred to in Article 9(2);

Or. en

Justification

Request by EDPS and EDPB joint opinon 1/2023.

Amendment 51

Proposal for a regulation

Article 10 – paragraph 5 – point b a (new)

Text proposed by the Commission

Amendment

(b a) other documents or information, as the European Data Protection Board deems appropriate in the particular case.

Or. en

Justification

Request by EDPS and EDPB joint opinion 1/2023.

Amendment 52

Proposal for a regulation

Article 11 – paragraph 4

Text proposed by the Commission

Amendment

4. The complainant may request access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.

4. The complainant may request access to the documents on which the proposed rejection of the complaint is based using mutatis mutandis Chapter IV of this Regulation.

Or. en

Justification

As the complainant should be considered as a party the same rules should apply to him or her per analogy as they apply to the party under investigation. Only by having access to the case file he or her can lodge an effective judicial remedy.

Amendment 53

Proposal for a regulation

Article 12 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements. The time limit set should not be less than two weeks.

Or. en

Justification

It should be clear that the consideration that a complainant should be re-heard is not an arbitrary power but should take place if there are essential changes to the draft. At the same time, there should be a minimum level of time for an answer like in Article 11(2) of the proposed regulation. The limit was set to two weeks per analogy with Article 60(5) GDPR. Para. 2 was merged with para.1.

Amendment 54

Proposal for a regulation

Article 12 – paragraph 2

Text proposed by the Commission

Amendment

2. The supervisory authority with which the complaint was lodged shall set a time-limit within which the complainant may make known her or his views.

deleted

Or. en

Amendment 55

Proposal for a regulation

Article 14 – title

Text proposed by the Commission

Amendment

Preliminary findings and reply

Preliminary finding and the right to be heard by parties under investigation

Or. en

Amendment 56

Proposal for a regulation

Article 14 – paragraph 2 – subparagraph 1

Text proposed by the Commission

Amendment

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they must set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties are heard and can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Or. en

Justification

Clarification of the right to be heard by parties under investigation.

Amendment 57

Proposal for a regulation

Article 14 – paragraph 4

Text proposed by the Commission

Amendment

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

Or. en

Justification

There should be a reasonable time limit for defence per analogy with Article 11(2) of the proposed Regulation.

Amendment 58

Proposal for a regulation

Article 14 – paragraph 5

Text proposed by the Commission

Amendment

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Article 20.

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the case file in accordance with Chapter IV.

Or. en

Justification

See comment above about the denomination of a case file. Not only Article 20 but also Articles 21 and 22 regulate access to the case file.

Amendment 59

Proposal for a regulation

Article 15 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings and set a time-limit within which the complainant may make known its views in writing.

Or. en

Amendment 60

Proposal for a regulation

Article 15 – paragraph 3

Text proposed by the Commission

Amendment

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the administrative file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1.

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the case file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1, without prejudice for the rights for an effective remedy.

Or. en

Amendment 61

Proposal for a regulation

Article 16 – paragraph 1

Text proposed by the Commission

Amendment

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

In such case, the supervisory authority shall also provide the controller or processor information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

Or. en

Justification

Clear time period as regards the application of Article 60(7) GDPR once all the procedures on reasoned opinions or consistency mechanism are finished. See also EDPS and EDPB joint opinion 1/2023.

Amendment 62

Proposal for a regulation

Article 17 – paragraph 1

Text proposed by the Commission

Amendment

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

1. Where the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements. The time limit set should not be less than two weeks.

Or. en

Justification

It should be clear that the consideration that a complainant should be re-heard is not an arbitrary power but should take place if there are essential changes to the draft. At the same time there should be a minimum level of time for an answer like in Article 11(2) of the proposed regulation. The limit was set to two weeks per analogy with Article 60(5) GDPR. Para. 2 was merged with para.1.

Amendment 63

Proposal for a regulation

Article 17 – paragraph 2

Text proposed by the Commission

Amendment

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.

deleted

Or. en

Amendment 64

Proposal for a regulation

Article 18 – paragraph 2 – point a

Text proposed by the Commission

Amendment

(a) the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

(a) the reasoned objection shall be concise, transparent, intelligible and provided in an easily accessible form, using clear and plain language;

Or. en

Justification

The provision is too formalistic, not taking into account the diversity of possible cases. The duty is to have concise documents but not in the form of specific number of pages.

Amendment 65

Proposal for a regulation

Chapter IV – title

Text proposed by the Commission

Amendment

Access to the administrative file and treatment of confidential information

Access to the case file and treatment of confidential information

Or. en

Justification

As stated above the use of the term “administrative file” gives the impression that there are files inside a file, with restriction of certain group of documents per se to the parties. Horizontal amendment.

Amendment 66

Proposal for a regulation

Article 19 – title

Text proposed by the Commission

Amendment

Content of the administrative file

Content of the case file

Or. en

Amendment 67

Proposal for a regulation

Article 19 – paragraph 1

Text proposed by the Commission

Amendment

1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

1. The case file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

Or. en

Amendment 68

Proposal for a regulation

Article 19 – paragraph 2

Text proposed by the Commission

Amendment

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority may return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the administrative file.

Or. en

Amendment 69

Proposal for a regulation

Article 19 – paragraph 3

Text proposed by the Commission

Amendment

3. The right of access to the administrative file shall not extend to correspondence and exchange of views between the lead supervisory authority and supervisory authorities concerned. The information exchanged between the supervisory authorities for the purpose of the investigation of an individual case are internal documents and shall not be accessible to the parties under investigation or the complainant.

deleted

Or. en

Justification

The paragraph excludes automatically from the case file a whole group of documents. Such an approach is not proportionate and may significantly affect the right to a judicial remedy as provided in Article 78 GDPR and Article 47 of the Charter. The mentioned paragraph could cause even situations where documents would be possibly given to any EU citizen under access to documents requests but rejected to the parties to the procedure.

Amendment 70

Proposal for a regulation

Article 20 – title

Text proposed by the Commission

Amendment

Access to the administrative file and use of documents

Access to the case file and use of documents

Or. en

Amendment 71

Proposal for a regulation

Article 20 – paragraph 1

Text proposed by the Commission

Amendment

1. The lead supervisory authority shall grant access to the administrative file to the parties under investigation, enabling them to exercise their right to be heard. Access to the administrative file shall be granted after the lead supervisory authority notifies the preliminary findings to the parties under investigation.

1. The lead supervisory authority shall grant access to the case file to the parties, enabling them to exercise their right to be heard and the right to an effective judicial remedy. Access to the case file shall be granted on the latest after the lead supervisory authority notifies the preliminary findings to the parties.

Or. en

Amendment 72

Proposal for a regulation

Article 20 – paragraph 2

Text proposed by the Commission

Amendment

2. The administrative file shall include all documents, inculpatory and exculpatory, including facts and documents which are known to the parties under investigation.

2. The case file shall include all documents, inculpatory and exculpatory, including facts and documents concerning the parties under investigation.

Or. en

Amendment 73

Proposal for a regulation

Article 20 – paragraph 3

Text proposed by the Commission

Amendment

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties under investigation had the opportunity to make their views known.

Or. en

Amendment 74

Proposal for a regulation

Article 20 – paragraph 4

Text proposed by the Commission

Amendment

4. Documents obtained through access to the administrative file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided.

4. Documents obtained through access to the case file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided to the parties.

Or. en

Justification

Access relates to parties to the proceedings that can be parties under investigation as well as the complainant. It should be clarified that the access and limitation issue refers to parties, not to authorities.

Amendment 75

Proposal for a regulation

Article 21 – paragraph 2

Text proposed by the Commission

Amendment

2. Any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, is excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing.

2. There is a rebuttable presumption in line with applicable national and EU law on access to documents that any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, is excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing.

Or. en

Justification

A general and absolute prohibition of public access to all documents during the investigation phase would not be proportionate and could contravene national and EU law in view of access to documents by the public. There can be a presumption that such documents are non-public. However, the citizen must have the possibility to prove that “there is an overriding public interest in disclosure”.

Amendment 76

Proposal for a regulation

Article 21 – paragraph 3

Text proposed by the Commission

Amendment

3. When communicating preliminary findings to parties under investigation and providing for access to the administrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties under investigation to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of defence of the parties under investigation with due regard for the confidentiality of the information.

3. When communicating preliminary findings to parties and providing for access to the administrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of the parties with due regard for the confidentiality of the information. The final assessment whether information is confidential lies within the lead supervisory authority.

Or. en

Justification

Wording adapted the notion of the parties to the proceeding including complainants and parties under investigation.

Amendment 77

Proposal for a regulation

Article 22 – title

Text proposed by the Commission

Amendment

Referral to dispute resolution under Article 65 of Regulation (EU) 2016/679

Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679

Or. en

Justification

Clarification of the text.

Amendment 78

Proposal for a regulation

Article 22 – paragraph 1

Text proposed by the Commission

Amendment

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679.

Or. en

Justification

Necessary addition of a strict deadline in view of practical application of GDPR (cases of very long periods before submission).

Amendment 79

Proposal for a regulation

Article 23 – paragraph 1 a (new)

Text proposed by the Commission

Amendment

The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Articles 22(2) and 23 are available and translated.

Or. en

Justification

Request by EDPB and EDPS opinion 1/2023.

Amendment 80

Proposal for a regulation

Article 29 – paragraph 2

Text proposed by the Commission

Amendment

2. Time periods shall begin on the working day following the event to which the relevant provision of Regulation (EU) 2016/679 or this Regulation refers.

deleted

Or. en

Justification

As Regulation No. 1182/71 fully applies such an additional text is not necessary.

Amendment 81

Proposal for a regulation

Annex - Part A - Point 1 - paragraph 1

Text proposed by the Commission

Amendment

Where the complainant is a natural person, submit a form of identification2.

deleted

__________________

2 For example, passport, driving licence, national ID.

Or. en

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 82

Proposal for a regulation

Annex - Part A - Point 2 - paragraph 3

Text proposed by the Commission

Amendment

Telephone number

deleted

Or. en

Justification

Deletion proposal from the EDPS/EDPB joint opinion 1/2023.

Amendment 83

Proposal for a regulation

Annex - Part B - paragraph 4 a (new)

Text proposed by the Commission

Amendment

Telephone number

Or. en

Justification

Addition proposal (under”Supplementary information”) from the EDPS/EDPB joint opinion 1/2023.

ANNEX: LIST OF ENTITIES OR PERSONS FROM WHOM THE RAPPORTEUR FOR THE OPINION HAS RECEIVED INPUT

The rapporteur declares under his exclusive responsibility that he did not receive input from any entity or person to be mentioned in this Annex pursuant to Article 8 of Annex I to the Rules of Procedure.