The European Parliament adopted by 329 votes to 213, with 79 abstentions, amendments to the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679.
The matter was referred back to the committee responsible for inter-institutional negotiations.
Subject matter and scope
Complaints are an essential source of information for detecting infringements of data protection rules. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities should be created to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.
Members stated that the proposed Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities whenever supervisory authorities of more than one Member State are involved in the case, as well as procedural rules on related judicial remedies.
Applicable procedural law
In addition to this regulation, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority should govern all direct interactions between that supervisory authority and the parties before it. Member States may specify procedural issues not covered by the Regulation.
A complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.
Common procedural standards
The amended text stipulates that each party should have at least the following rights:
- to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure”);
- to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“right to be heard”);
- to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“procedural transparency”).
The lead supervisory authority should inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority.
Use of languages and translations
Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. Members proposed that an additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the accepted languages.
Cross-border complaints
A complaint subject to this Regulation should provide the information required in the template, as set out in the Annex. No additional information should be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.
The supervisory authority with which a complaint has been lodged should, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements, declare the complaint inadmissible and inform the complainant about the missing information.
Handling of complaints
The supervisory authority with which the complaint has been lodged should, within three weeks after acknowledging the admissibility of the complaint: (a) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant; (b) establish which supervisory authority is the assumed lead supervisory authority. The handling of a complaint should always lead to a legally binding decision that is subject to an effective legal remedy.
Amicable settlement
A claim may be settled amicably between the claimant and the party under investigation at any stage of the proceedings. Amicable settlements are limited to cases of data subject rights, requiring the explicit agreement of the complainant, while not preventing ex-officio investigations of a supervisory authority for larger scale infringements of the GDPR.
Cooperation with other relevant authorities
The lead supervisory authority should provide the other supervisory authorities concerned with instant, remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information, as well as a translation of all documents to the cooperation language. The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances.
Summary of key aspects
The supervisory authority with which a complaint has been lodged or which requests an ex-officio action may provide the lead supervisory authority with a summary of key issues setting out its preliminary view on the main issues in an investigation. The summary of key issues should be updated by the lead supervisory authority without undue delay to reflect any factual or legal changes that emerge during the course of the procedure.
Remedies against procedural determinations
A new article has been introduced stating that remedies against procedural determinations by a supervisory authority under national law should only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.