What changed between the plenary report and the adopted text

Changed:Recital 5 c (new): (5c) It should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why. / 1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj).1.)

Changed:Article 16 – paragraph 1: After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Changed:Article 27 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU(EU) 2016/679;

Changed:Article 28 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU(EU) 2016/679;

Changed:Annex I – Part A – point 1: (deleted) / Where the complaint is submitted by a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, submit proof that the body, organisation or association has been properly constituted in accordance with the law of a Member State. / Where the complaint is submitted on the basis of Article 80(1) of Regulation (EU) 2016/679, proof that the body, organisation or association lodging the complaint is acting on the basis of the mandate of a data subject. / (deleted) / (deleted)

Changed:Recital 2 b (new): (2b) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. Some procedural elements, such as the horizontal burden of proof of the controller in Article 5(2) of Regulation (EU) 2016/679, are already governed by Union law. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law. Supervisory authorities shallshould make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video participation, interpreters or generally available means of communication.

Changed:Recital 8: (8) The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Changed:Recital 21: (21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shallshould have the right to decline the right to be heard.

Changed:Recital 22: (22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the the right to be heard and opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to effectively comment on matters relevant to the investigation, by receiving access to the administrative joint case file.