Skip to content
DRAFT OPINION (COM(2023)0348 – C90231/2023 – 2023/0202(COD))

On the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

JURI-PA-756348

Committee on Legal Affairs · Rapporteur: Ibán García Del Blanco

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This draft opinion proposes amendments to the Commission's regulation on GDPR enforcement procedures, focusing on procedural rights, deadlines, and access to files. It calls for minimum procedural rights for parties, including the right to be heard and access to the case file, and clarifies the complainant's role. It introduces specific deadlines for various procedural steps, such as acknowledging complaints within one week and transmitting them within three weeks. It also addresses amicable settlements, requiring explicit agreement from the complainant, and ensures that complaints lead to appealable decisions.

Committee position. The Committee on Legal Affairs proposes amendments to the Commission proposal, focusing on procedural rights, deadlines, and access to files, and calls on the responsible committee to take them into account.

Key points

  1. The opinion supports harmonisation but criticises the lack of an impact assessment by the Commission.
  2. It introduces a definition of 'complainant' as a party to the procedure with specific rights.
  3. It establishes minimum procedural rights for all parties, including fair procedure, right to be heard, and access to the case file.
  4. It sets that complaints must contain specified information but no additional requirements, and a model form is provided in the annex.
  5. It requires supervisory authorities to acknowledge receipt of complaints within one week and determine admissibility within three weeks.
  6. It mandates that the handling of a complaint always leads to a legally binding decision subject to judicial remedy.
  7. It allows amicable settlements only with explicit agreement from the complainant, and the complaint is deemed withdrawn upon settlement.
  8. It sets deadlines for the lead supervisory authority to share information with other authorities, within one week.
  9. It requires the lead supervisory authority to draft a summary of key issues within 9 months and communicate preliminary findings within 3 months in non-contentious cases.
  10. It allows any involved supervisory authority to request an urgent binding decision from the Board under Article 66(3) GDPR.
  11. It ensures parties have access to the case file, not just an 'administrative file', and deletes the automatic exclusion of internal communications.
  12. It introduces a rebuttable presumption that documents in cross-border cases are excluded from public access during proceedings.

Who is affected

  • Complainants: gain rights to be heard, access to case file, and a guaranteed appealable decision.
  • Parties under investigation: have the right to be heard and access to the case file, with deadlines for responses.
  • Supervisory authorities: must adhere to new deadlines and procedures, and cannot require additional information from complainants.
  • European Data Protection Board: may receive urgent requests from any involved authority and has broader discretion in dispute resolution.

Figures and deadlines

  • one week: time for acknowledging receipt of a complaint.
  • three weeks: time for determining admissibility and transmitting to lead authority.
  • 9 months: deadline for drafting summary of key issues.
  • 3 months: deadline for communicating preliminary findings in non-contentious cases.
  • one week: deadline for sharing information with other authorities.
  • two weeks: minimum time for parties to respond to revised draft decisions.
  • three weeks: minimum time for parties under investigation to respond to preliminary findings.
  • four weeks: time for adopting final decision after no objections.