The European Parliament adopted by 329 votes to 213, with 79 abstentions, amendments to the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679.

The matter was referred back to the committee responsible for inter-institutional negotiations.

Subject matter and scope

Complaints are an essential source of information for detecting infringements of data protection rules. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities should be created to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Members stated that the proposed Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities whenever supervisory authorities of more than one Member State are involved in the case, as well as procedural rules on related judicial remedies.

Applicable procedural law

In addition to this regulation, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority should govern all direct interactions between that supervisory authority and the parties before it. Member States may specify procedural issues not covered by the Regulation.

A complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

Common procedural standards

The amended text stipulates that each party should have at least the following rights:

- to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“ fair procedure ”);

- to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“ right to be heard ”);

- to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“ procedural transparency ”).

The lead supervisory authority should inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority.

Use of languages and translations

Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. Members proposed that an additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the accepted languages.

Cross-border complaints

A complaint subject to this Regulation should provide the information required in the template, as set out in the Annex. No additional information should be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.

The supervisory authority with which a complaint has been lodged should, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements, declare the complaint inadmissible and inform the complainant about the missing information.

Handling of complaints

The supervisory authority with which the complaint has been lodged should, within three weeks after acknowledging the admissibility of the complaint: (a) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant; (b) establish which supervisory authority is the assumed lead supervisory authority. The handling of a complaint should always lead to a legally binding decision that is subject to an effective legal remedy.

Amicable settlement

A claim may be settled amicably between the claimant and the party under investigation at any stage of the proceedings. Amicable settlements are limited to cases of data subject rights, requiring the explicit agreement of the complainant, while not preventing ex-officio investigations of a supervisory authority for larger scale infringements of the GDPR.

Cooperation with other relevant authorities

The lead supervisory authority should provide the other supervisory authorities concerned with instant, remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information, as well as a translation of all documents to the cooperation language. The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances.

Summary of key aspects

The supervisory authority with which a complaint has been lodged or which requests an ex-officio action may provide the lead supervisory authority with a summary of key issues setting out its preliminary view on the main issues in an investigation. The summary of key issues should be updated by the lead supervisory authority without undue delay to reflect any factual or legal changes that emerge during the course of the procedure.

Remedies against procedural determinations

A new article has been introduced stating that remedies against procedural determinations by a supervisory authority under national law should only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Sergey LAGODINSKY (Greens/EFA, DE) on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679.

Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities should be created to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Overall, this report consolidates and expands on the provisions on general procedural rules in order for the right to be heard, translations, confidentiality, and the sincere cooperation of authorities to always apply, not only in the case of complaints or for dispute resolution among authorities.

The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:

Subject matter and scope

The proposed Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities whenever supervisory authorities of more than one Member State are involved in the case, as well as procedural rules on related judicial remedies.

Applicable procedural law

In addition to this proposal, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority should govern all direct interactions between that supervisory authority and the parties before it.

Common procedural standards

The amended text stipulates that each party should have at least the following rights:

- to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure”);

- to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“right to be heard”);

- to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“procedural transparency”).

Use of languages and translations

Members added a new article concerning the cooperation language to be used. The Board should determine one language that should be accepted by all supervisory authorities during the cooperation between authorities.

The lead supervisory authority should provide submissions into the joint case file in the original language and should provide translations into the cooperation language.

Cross-border complaints

A complaint subject to this Regulation should provide the information required in the template , as set out in the Annex. No additional information should be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.

The supervisory authority with which a complaint has been lodged should, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements, declare the complaint inadmissible and inform the complainant about the missing information.

Handling of complaints

The handling of a complaint should always lead to a legally binding decision that is subject to an effective legal remedy.

Amicable settlement

Amicable settlements are limited to cases of data subject rights, requiring the explicit agreement of the complainant, while not preventing ex-officio investigations of a supervisory authority for larger scale infringements of the GDPR.

Cooperation with other relevant authorities

The lead supervisory authority should provide the other supervisory authorities concerned with instant, unrestricted and continuous remote access to the full joint case file, and should include in the joint case file all relevant information, in particular documents, submissions, memos and other information related to the case within one week from producing or receiving them.

Remedies against procedural determinations

A new article has been introduced stating that remedies against procedural determinations by a supervisory authority under national law should only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.

Entry into force and application

The amended text lays down a transitional period of one year to allow for the necessary changes to the Internal Market Information System used by the authorities, and the Rules of Procedure of the Board, as well as possible amendments of national laws.

PURPOSE: to lay down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR).

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: in its report following two years of the application of the GDPR, the Commission noted that further progress was needed to make the handling of cross-border cases more efficient and harmonised across the EU. The report noted important differences in national administrative procedures and interpretations of concepts in the GDPR cooperation mechanism.

Procedural differences applied by data protection authorities (DPAs) hinder the smooth and effective functioning of the GDPR’s cooperation and dispute resolution mechanisms in cross-border cases. These differences also have important consequences for the rights of the parties under investigation and complainants (as data subjects).

In its resolution on the Commission’s 2020 report on the GDPR, the European Parliament highlighted the need to clarify the position of complainants in the case of cross-border complaints.

The proposal aims to tackle problems in the following areas:

- Complaints : DPAs have varying interpretations on requirements for the form of a complaint, the involvement of complainants in the procedure, and the rejection of complaints. The differences mean that the treatment of complaints and the involvement of complainants varies depending on where the complaint is lodged, or which DPA is the lead DPA for a given case. As a result, they delay the conclusion of the investigation and the delivery of a remedy for the data subject in cross-border cases. In its resolution on the Commission’s 2020 report on the GDPR, the European Parliament highlighted the need to clarify the position of complainants in the case of cross-border complaints.

- Procedural rights of parties under investigation : the procedural rights of parties under investigation, such as the extent of the right to be heard and the right of access to the file, vary substantially across the Member States. The extent to which parties are heard, the timing of the hearing, and the documents that are provided to parties to enable them to exercise their right to be heard are elements on which Member States take varying approaches.

- Cooperation and dispute resolution : experience in the enforcement of the GDPR in cross-border cases shows that there is insufficient cooperation between DPAs prior to the submission of a draft decision by the lead DPA. Lack of sufficient cooperation and consensus-building on key issues in the investigation at this early stage has resulted in the submission of numerous cases to dispute resolution.

The proposal aims to address these issues by specifying procedural rules for certain stages of the investigation process in cross-border cases, thereby supporting the smooth functioning of the GDPR cooperation and dispute resolution mechanisms.

CONTENT: the proposed regulation aims to address the disparity in procedural approaches followed by DPAs, by harmonising certain aspects of the administrative procedure applied by DPAs when implementing the GDPR. It establishes procedural rules for the handling of complaints and the conduct of investigations , both complaint-based and ex officio, carried out by supervisory authorities in the cross-border application of the RGPD. Its main elements are as follows:

Form of complaints and position of complainants

The proposal:

- provides a form specifying the information required for all complaints under Article 77 GDPR concerning cross-border processing and specifies procedural rules for the involvement of complainants in the procedure, including their right to make their views known;

- specifies procedural rules for the rejection of complaints in cross-border cases and clarifies the roles of the lead DPA and the DPA with which the complaint was lodged in such cases. It recognises the importance and the legality of amicable settlement of complaint-based cases.

Targeted harmonisation of procedural rights in cross-border cases

The proposal provides the parties under investigation with the right to be heard at key stages in the procedure , including during dispute resolution by the Board, and clarifies the content of the administrative file and the parties’ rights of access to the file. The proposal thereby strengthens the parties’ rights of defence and ensures consistent observance of these rights regardless of which DPA is leading the investigation.

Cooperation and dispute resolution

The proposal:

- equips DPAs with the tools necessary to achieve consensus by giving added substance to the requirement for DPAs to cooperate and to share “relevant information”;

- establishes a framework for all DPAs to meaningfully impact a cross-border case by providing their views early in the investigation procedure and making use of all tools provided by the GDPR;

- entrusts the European Data Protection Board with the role of resolving disagreement by adopting an urgent binding decision in the event of disagreement between DPAs on the key issue of the scope of the investigation in complaint-based cases;

- lays down detailed requirements for the form and structure of relevant and reasoned objections raised by DPAs concerned, thereby facilitating the effective participation of all DPAs and the targeted and swift resolution of the case;

- facilitates the swift completion of the dispute resolution procedure for the parties under investigation and data subjects by laying down procedural deadlines for the dispute resolution procedure, specifies the information to be provided by the lead DPA when submitting the matter to dispute resolution, and clarifies the role of all actors involved in dispute resolution.