On the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
LIBE-PR-755005
Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Sergey Lagodinsky
Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.
This draft report proposes amendments to the Commission's proposed regulation on procedural rules for enforcing the GDPR in cross-border cases. It sets out rules on complaints, investigations, cooperation between authorities, and dispute resolution.¶¶¶ The amended text introduces minimum procedural standards, a joint case file, and a cooperation language. It also sets deadlines for decisions and allows for judicial remedies against supervisory authorities that fail to act.¶¶¶
Committee position. The rapporteur proposes to amend the Commission proposal extensively, introducing minimum procedural standards, a joint case file, and clearer deadlines, while maintaining national procedural law where not conflicting.¶¶¶
Key points
- The regulation applies to cases involving cross-border processing where supervisory authorities of more than one member state participate, and to related judicial remedies.¶
- National procedural law applies to direct interactions between a supervisory authority and parties, unless it conflicts with this regulation or the GDPR.¶
- Each party has the right to a fair procedure, to be heard before adverse measures, and to access the joint case file, excluding internal deliberations.¶
- The lead supervisory authority must manage the case efficiently, cooperate with other authorities, and maintain a joint case file with remote access for all authorities and the Board.¶¶
- The Board determines a cooperation language accepted by all authorities; translations into that language are required for entries in the joint case file.¶¶
- Complaints must contain minimum information (name, contact details, facts, evidence, and demanded measures) to be admissible; no additional information or electronic ID is required.¶¶
- The lead supervisory authority must deliver a draft decision within nine months of receiving the complaint, with possible extensions for comments, Board determinations, or other delays.¶¶¶
- Amicable settlements require explicit agreement and are limited to data subjects' rights; authorities may open ex officio investigations in cases of repeat offenders or large-scale impact.¶¶
- Preliminary findings must be sent to all parties, including complainants, and must clearly state facts, legal assessments, and evidence.¶¶¶
- Supervisory authorities may request procedural determinations from the Board on disputes, and parties may request determinations when no authority acts.¶¶
- Parties have a right to judicial remedy against a supervisory authority that fails to progress a case, misses deadlines, or does not comply with a Board decision.¶
- The regulation applies one year after entry into force, allowing time for adjustments to systems and national laws.¶
Who is affected
- Supervisory authorities in EU member states, which must follow new procedural rules and deadlines.¶¶
- Complainants (data subjects and their representatives), who gain clearer rights and access to the joint case file.¶¶
- Controllers and processors under investigation, who have rights to be heard and access to the case file.
- The European Data Protection Board, which handles procedural determinations and dispute resolution.¶¶
Figures and deadlines
- three weeks for acknowledging a complaint and determining admissibility and cross-border nature¶
- nine months from receipt of complaint for delivering a draft decision¶
- four weeks for comments on the summary of key issues¶
- three months for communicating preliminary findings in non-contentious cases¶
- four weeks for adopting and notifying a decision after no objections¶
- one year from entry into force for application¶
Legal basis: Article 16 and Article 294 of the Treaty on the Functioning of the European Union¶