What changed between the draft committee report and the plenary report

Removed:The Commission follows the idea of full harmonisation. This begs the question which procedural laws govern elements that are not fully harmonised. Linked to Article 2a (new)

Removed:The minimum standards should be largely compatible with existing national procedural laws. In Member States without a codified procedure, these minimum standards allow more legal certainty. When national laws are not compatible, this Regulation prevails. Linked to Article 2a (new)

Added:Recital 5 c (new): (5c) It should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why. / 1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj).

Removed:Recital 5 c (new): (5c) Article 6 of the ECHR and Article 47 of the Charter require that fair procedures are public. Article 42 of the Charter and the law of many Member States foresee the right of access to public documents and the transparency of actions of authorities. However, it should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a . This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why. / 1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj)

Added:Recital 5 d (new): (5d) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities in a spirit of common understanding and trust. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities. At the same time, the procedure should be in line with Regulation (EU) 2016/679, in particular the one-stop-shop dispute resolution architecture and the competences of the lead supervisory authority.

Removed:Reconcile the right to fair (=public) procedures and the right to access to information with the need to protect trade secrets and the inner decision-making of the authorities. Linked to Article 2b (new).

Added:Recital 5 e (new): (5e) Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should however, not lead to any interference with the rights of the parties.

Removed:Recital 5 d (new): (5d) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities.

Added:Recital 5 f (new): (5f) Violations may concern the rights of multiple data subjects, therefore, evidence from procedures may need to be used in other procedures to facilitate an efficient procedure and consistent decision making. In order to objectively assess the amount of non-material damages based on the average data subject, civil courts may benefit from relying on established facts and evidence to determine a claim under Article 82 of Regulation (EU) 2016/679.

Removed:The LSA is in charge of managing the case, while the other SAs provide all information and must be involved. Linked to Article 2c (new).

Added:Recital 5 g (new): (5g) Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the accepted languages.

Removed:Recital 5 e (new): (5e) Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should, however, not lead to any interference with the rights of the parties. Complaints procedures should not be delayed and the right of parties to be heard should not be limited when a supervisory authority opens an ex officio procedure into the same matter.

Added:Recital 6: (6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be effective, proportionate and dissuasive in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective remedy to the complainant can be quickly delivered. Without prejudice to the necessity of providing a satisfactory resolution to the complainant within a short timeframe, supervisory authorities should investigate to a degree that allows them to satisfy themselves as to whether a complaint is indicative of more serious or systemic infringements. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a dec…

Removed:To avoid an “ex officio bypass” by some authorities, where the issue of a complaint is moved into an “ex officio” procedure, without the participation of the complainant.

Added:Recital 7: (7) The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information, as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one with which the complaint was lodged.

Removed:Recital 5 f (new): (5f) Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the relevant accepted languages.

Added:Recital 8: (8) The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Removed:Currently the joint language is English, based on IMI rules. This is not defined in law, but seems accepted and sufficient in most cases. This should be codified. Linked to Article 2d.

Added:Recital 9: (9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should bind the authorities. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be used to defer decisions on complaints.

Removed:Recital 6: (6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective and quick remedy to the complainant can be quickly delivered. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision.

Added:Recital 10: (10) In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679. This should be in line with the ‘one-stop-shop’ mechanism of Regulation (EU) 2016/679 and guarantee, where applicable, non-discriminatory treatment of parties, legal certainty and independence of issuing of decisions by the supervisory authorities.

Removed:The recital so far hinted at limited enforcement and discretion of authorities not to act. This was amended to ensure that their duty to act is highlighted.

Removed:Recital 7: (7) The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention.

Removed:Linked to Articles 2c, 8

Removed:Recital 8: (8) The competent supervisory authority should provide the parties with remote access to the joint case file, except for redacted documents and internal deliberations.

Removed:Recital 9: (9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should not bind the authorities. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

Changed:Recital 12: (12) Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority. For this purpose, theThe supervisory authority with which a complaint has been lodged or which demandsrequests an ex-officio action shouldmay provide the lead supervisory authority with a summary of key issues setting out its preliminary view on the main issues in an investigation. In all other cases, theThe lead supervisory authority should draft the final summary of key issues. The summary of key issues should be part of the joint case file, and should be a living document that is updated by the lead supervisory authority during the course of the procedure. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned. Concerned supervisory authorities should have the opportunity to provide their comments on any update of the summary of key issues. The lead supervisory authority should comply with the comments as far as possible or reject them. In the case of a rejection, the supervisory authorities should be able to raise any dispute with the Board. Supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

Changed:Recital 13: (13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, any documents submitted by concerned supervisory authorities and the parties should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. Supervisory authorities shouldmay therefore be able to limit the length of submissions by the parties. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. .

Removed:To avoid “spamming” by large companies who can afford law firms to submit thousands of pages. The rule is similar to the rules of procedure before the CJEU, where submissions are regularly limited to 20 or 30 pages.

Added:Recital 14: (14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the draft decision within three months from the receipt of the complaint.

Removed:Recital 14: (14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within three months after the deadline for comments.

Added:Recital 15: (15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should raise the matter quickly with the Board. The Board should make the necessary procedural determinations. The Board and supervisory authorities should endeavour to complete ongoing proceedings as quickly as possible. The lead supervisory authority or one of the supervisory authorities concerned should also be able to request an urgent binding decision of the Board without a request under Articles 61 or 62 having been made.

Removed:Linked to Article 9(6).

Removed:Recital 15: (15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should be able to raise the matter quickly with the Board. The Board should be able to make the necessary procedural determinations.

Removed:Linked to Article 26a (new).

Removed:Urgent decisions under Article 66(3) GDPR are limited to inaction of a DPA. Instead, procedural determinations by the Board should be possible for all sorts of procedural disputes. Linked to Recital (15).

Added:Recital 17: (17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, handling of any complaint should always lead to a decision which may be challenged before a national court.

Removed:Recital 17: (17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the handling of any complaint should always lead to a decision which may be challenged before a national court.

Removed:To ensure that cases are not “closed” or “deemed withdrawn” and alike without a clear decision which can be appealed.

Removed:There is a general right to be heard before a decision, which allows to remove the need for “draft” decisions. Article 11 is therefore also deleted. This should limit the need for paperwork through repeated “draft of the draft” procedures.

Added:Recital 19: (19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Removed:Recital 19: (19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Added:Recital 21: (21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shall have the right to decline the right to be heard.

Removed:The COM proposal would rewrite the GDPR, as the drafting is clearly with the LSA. We suggest to highlight that the CSA with which the complaint was filed must issue the final decision and therefore needs to be involved in the drafting, to ensure that it cannot be easily appealed before a national court.

Added:Recital 22: (22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the the right to be heard and opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to effectively comment on matters relevant to the investigation, by receiving access to the administrative joint case file.

Removed:Recital 21: (21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter, including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case.

Added:Recital 23: (23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary to enable them to be heard is satisfied if the final decision only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a), of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Removed:Recital 22: (22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with the documents required to make their case effectively and to comment on the allegations made, by receiving access to the joint case file.

Added:Recital 24: (24) The parties should be provided with a right to be heard at appropriate stages of the procedure, in particular prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Removed:Recital 23: (23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Removed:Recital 24: (24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Added:Recital 25 a (new): (25a) Notwithstanding the fact that the parties under investigation and the complainant are not in the same procedural situation, there are circumstances in which complainants can be in a position to adduce arguments and evidence during an investigation which can help the progress of the investigation. This is particularly the case in circumstances in which a not-for-profit body, organisation or association has lodged a complaint on behalf of a data subject or on its own initiative under Article 80 of Regulation (EU) 2016/679. Supervisory authorities should facilitate the hearing of such complainants at all stages of the investigation, including ex officio investigations, while also maintaining their independence.

Changed:Recital 27: (27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings,findings as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to unduly long procedures.

Changed:Recital 30: (30) Access to the joint case file ismay be provided for asin athe partspirit of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties. Access of the parties to the joint case file may be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest. Such limitation must be proportionate in light of the respective recognised rights of others or the public interest pursued.

Changed:Recital 31: (31) When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information.information and the protection of information in the public interest in accordance with applicable national law. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.information and provide a non-confidential version.

Removed:EDPB para 120.

Added:Recital 36 a (new): (36a) The Board should be able to request any further information from supervisory authorities necessary for it to take a binding decision.

Removed:Recital 36 a (new): (36a) Where, after its deliberations, the Board is unable to determine the matter, because the joint case file and other information provided by the lead supervisory authority are not complete, the Board should be able to request further information from the parties or supervisory authorities, or conduct further factual investigations.

Added:Recital 36 b (new): (36b) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

Removed:Recital 36 b (new): (36b) The Board should be able to delegate certain tasks to one or more select committees, which can consist of members of the Board or members of the secretariat referred to in Article 75 of Regulation (EU) 2016/679. It should be possible for this delegation to include any task under Article 70 of Regulation (EU) 2016/679, decisions under Article 65 and 66 of Regulation (EU) 2016/679 or functions of the Board under this Regulation, such as routine tasks or decisions that need to be taken without delay, including any procedural determinations.

Removed:Linked to Articles 26a (new), 26b (new).

Removed:Recital 36 c (new): (36c) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board.

Removed:Linked to Article 26c (new).

Changed:Article 1 – paragraph 1: This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities relatedwhenever tosupervisory theauthorities cross-borderof processingmore than one Member State are involved in the meaningcase, ofas Regulationwell (EU)as 2016/679.procedural rules on related judicial remedies.

Removed:EDPB wording suggestion – “cross-border enforcement” is not defined in GDPR. EDPB, introduction, p.7.

Added:Article 1 – paragraph 1 a (new): Article 26b of this Regulation also applies to cases before a supervisory authority of a single Member State, pursuant to Article 56(2) of Regulation (EU) 2016/679.

Removed:Article 1 – paragraph 1 a (new): This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

Added:Article 2 – paragraph 2 – point 1: (1) ‘party under investigation’ means the controller(s) and/or processor(s) complained about, or investigated for alleged infringement of Regulation (EU) 2016/679, as well as their representative(s);

Removed:Article 1 – paragraph 1 b (new): Article 26c of this Regulation also applies to cases before a supervisory authority of a single Member State.

Added:Article 2 – paragraph 2 – point 1 a (new): (1a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the proceedings;

Removed:Article 1 – paragraph 1 c (new): This Regulation does not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.

Added:Article 2 – paragraph 2 – point 1 b (new): (1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party involved in the proceedings as defined under national law;

Removed:Article 2 – paragraph 2 – point 1: (1) ‘party under investigation’ means the controller(s) and/or processor(s) accused of, or investigated for, alleged infringement of Regulation (EU) 2016/679;

Added:Article 2 – paragraph 2 – point 1 c (new): (1c) ‘national procedural law’ means laws, regulations and administrative provisions of the Member State that regulate the procedure before a supervisory authority;

Changed:Article 2 – paragraph 2 – point 1 ad (new): (1a) ‘complainant’ means the data subject(1d) or‘complaints non-for-profitprocedure’ body,means organisationa orprocedure associationdetermining thatthe hasoutcome lodgedof a complaint under Article 77 of Regulation (EU) 2016/679;

Removed:EDPB para 155.

Added:Article 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1), point (a), of Regulation (EU) 2016/679;

Removed:Article 2 – paragraph 2 – point 1 b (new): (1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case where foreseen under Member State law;

Added:Article 2 – paragraph 2 – point 1 f (new): (1f) ‘joint case file’ means a dedicated electronic file for any case falling under the scope of this Regulation, that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case, are stored and made remotely accessible to supervisory authorities concerned and parties to the case;

Changed:Article 2 – paragraph 2 – point 1 cg (new): (1c) ‘national(1g) procedural‘complaint-receiving law’authority’ means the laws orsupervisory otherauthority ruleswith ofwhich the Membercomplaint Statehas thatbeen regulatelodged theas procedurereferred beforeto ain supervisoryArticle authority;4(22), point (c), of Regulation (EU) 2016/679;

Removed:Article 2 – paragraph 2 – point 1 d (new): (1d) ‘complaints procedure’ means an adversarial procedure determining a complaint under Article 77 of Regulation (EU) 2016/679;

Added:Article 2 – paragraph 2 – point 2: (2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned, identifying the main relevant factual and legal issues within the preliminary scope of the investigation and the lead supervisory authority’s factual and legal views on the case;

Removed:Article 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1)(a) of Regulation (EU) 2016/279;

Added:Article 2 – paragraph 2 – point 3: (3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

Removed:Article 2 – paragraph 2 – point 1 f (new): (1f) ‘internal deliberations’ means any preliminary view, opinion, comment or exchange within or between the supervisory authorities or the Board, such as the summary of key issues, comments on the summary of key issues, draft decisions or relevant and reasoned objections under Article 60(3) to (5) of Regulation (EU) 2016/679;

Added:Article 2 – paragraph 2 – point 4 a (new): (4a) ‘confidential version of a document’ means a document containing confidential or sensitive information which may be subject to legal privilege under the applicable Union or national law and data protection rules;

Removed:Article 2 – paragraph 2 – point 1 g (new): (1g) ‘joint case file’ means a dedicated electronic file for any given case, managed by the lead supervisory authority, in which all documents, submissions, memos and other information regarding a case are stored and made remotely accessible to supervisory authorities and parties to the case;

Added:Article 2 – paragraph 2 – point 4 b (new): (4b) ‘non-confidential version of a document’ means a version of a document from which confidential or sensitive information has been redacted and which can be provided to the complainant without breaching Union or national law or data protection rules.

Removed:Section 2 (new) – Article 2 a (new): Section 2 / Procedural Rules / Article 2a / Applicable Procedural Law / (1) In addition to, and where not conflicting with this Regulation, the applicable procedural law of a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. When applying national procedural law, supervisory authorities shall strive to facilitate the participation of all parties, including parties established or residing in other Member States. / (2) Regulation (EU) 2016/679 and this Regulation govern the interaction between supervisory authorities of different Member States within the scope of this Regulation. / (3) Any complainant has the right to communicate solely with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679. / (4) The interaction and sharing of information between supervisory authorities as well as between supervisory authorities and the Board shall be neither restricted nor prohibited under national law. Cooperation under this Regulation and Regulation (EU) 2016/679 and the consistent application of those regulations shall not be limited, delayed or denied based on differences in national procedural laws.

Added:Section 1 b (new) – title: Section 1b / Procedural rules

Removed:Article 2 b – title (new): Article 2b / Procedural Minimum Standards

Added:Article 2 a (new): Article 2a / Applicable Procedural Law / 1. In addition to this Regulation, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. This Regulation shall not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679. / 2. This Regulation and Regulation (EU) 2016/679 and govern the interaction between supervisory authorities of different Member States that falls within the scope of this Regulation. / 3. A complainant shall have the right to communicate exclusively with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679.

Removed:Following from Article 6 ECHR and Article 41 CFR, as confirmed by CJEU in Case C-277/11.

Added:Article 2 b (new): Article 2b / Common procedural standards / 1. Without prejudice to additional rights under national procedural law, each party shall have at least the following rights: / (a) to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure”); / (b) to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“right to be heard”); / (c) to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“procedural transparency”). / 2. The lead supervisory authority shall inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority. / 3. The joint case file shall include all evidence, inculpatory and exculpatory, including documents and other evidence provided by the parties under investigation. / 4. On the request of a party to protect their legally recognised rights or to protect the rights of others, or when it is in the public interest or in order to protect operational security and cybersecurity a supervisory authority may limit the rights referred to in paragraph 1, point (c). Any such limitation shall be carried out in acc…

Removed:Article 2 b – paragraph 1 (new): (1) Without prejudice to additional rights under relevant national procedural law, each party shall have at least the right to: / (a) have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure and equality of arms”); / (b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (“right to be heard”); / (c) have access to the joint case file, except to any internal deliberations (“procedural transparency”);

Added:Article 2 c (new): Article 2c / Cooperation between supervisory authorities / 1. The lead supervisory authority shall structure, coordinate and manage the case in an efficient and expedient way, in accordance with Regulation (EU) 2016/679, this Regulation and any applicable national procedural law. / 2. Any supervisory authority may declare that it is concerned, setting out the reasons why it meets the definition of a supervisory authority concerned under Article 4(22) of Regulation (EU) 2016/679. The lead supervisory authority shall maintain a list of supervisory authorities concerned for each case in the joint case file. / Where the lead supervisory authority considers that a supervisory authority which has made a declaration that it is concerned according to this paragraph does not meet the definition of a supervisory authority concerned, it shall inform that authority of its assessment. The supervisory authority which declared that it is concerned shall within one week of receiving that assessment either withdraw its declaration, or produce a reasoned opinion setting out the reasons why it considers the assessment of the lead supervisory authority to be incorrect. Where the diverging assessments of the lead supervisory authority and the supervisory authority which declared to be concerned cannot be resolved in a different manner, the lead supervisory authority shall request a determination of the Board under Article 26a. / 3. Any supervisory authority concerned which receives relevant infor…

Removed:Article 2 b – paragraph 2 (new): (2) The lead supervisory authority shall hear the parties when novel issues arise during the procedures under Article 60, 65 or 66 of Regulation (EU) 2016/679.

Added:Article 2 d (new): Article 2d / Use of Languages and Translations / 1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation between authorities (“cooperation language”). / 2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts. / 3. The lead supervisory authority shall provide submissions into the joint case file in the original language, and shall provide translations into the cooperation language. / 4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication. / 5. A supervisory authority may provide automated translations, if it finds that the automated translation is not substantially different from the original. / 6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State.

Removed:See Article 18(a)(a). This would ensure that if a CSA brings totally new issues up in a “reasoned objection” the parties are still heard – but only if that is the case, not as a default in all the “normal” cases.

Added:Article 3 – paragraph 1: 1. A complaint subject to this Regulation shall provide the information required in the template, as set out in the Annex. / No additional information shall be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.

Removed:EDPB, para 92

Added:Article 3 – paragraph 1 a (new): 1a. The complainant shall not be required to contact the party under investigation before submitting a complaint. Where the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she shall submit the communication related to that contact pursuant to the Annex.

Removed:Article 2 b – paragraph 3 (new): (3) On the request of a party or in the public interest, a supervisory authority may limit the rights referred to in paragraph 1 and 2 to protect legally recognized rights of others or to protect the public interest. Any such limitation shall be in accordance with the national procedural law applicable under Article 2a(1) to any direct interaction between a supervisory authority and the party receiving limited information. The party claiming confidentiality shall provide a non-confidential version of any information, applying only strictly proportionate measures, such as redacting specific parts of documents. Supervisory authorities involved in a case, as well as other relevant authorities under Article 7(1a), shall always have access to the confidential version of all information, and shall confirm that redactions are strictly proportionate and may otherwise release the information. Supervisory authorities shall immediately inform the parties about the fact that information is withheld. The lead supervisory authority shall keep records of each access to the joint case file and a list of authorised staff from each supervisory authority.

Added:Article 3 – paragraph 1 b (new): 1b. The supervisory authority with which a complaint has been lodged shall, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

Removed:“... national procedural law” In line with wording suggestion from EDPB. “always have access to the confidential version” from EDPB para 68.

Added:Article 3 – paragraph 1 c (new): 1c. The supervisory authority shall attribute a case number to the complaint and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c), point (i).

Removed:Article 2 b – paragraph 4 (new): (4) In the interest of efficient procedures, supervisory authorities shall limit the length of submissions and set reasonable deadlines not longer than four weeks, unless exceptional circumstances require a reasonable extension..

Added:Article 3 – paragraph 2: 2. The supervisory authority with which the complaint has been lodged shall, within three weeks after acknowledging the admissibility of the complaint pursuant to paragraph 1b:

Removed:Especially large law firms of big tech companies try to “bury” cases in endless submissions that neither SAs nor the other parties are able to process. The Regulation should follow the approach by the CJEU where page limitations and short deadlines lead to focused submissions.

Added:Article 3 – paragraph 2 – point a (new): (a) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant, considering at least the following: / (i) relevant controller or processor for the processing in question; / (ii) number of establishments of the controller or processor in the EU; / (iii) place of the main establishment; / (iv) activities of establishments in more than one Member State; / (v) substantial effect or likely substantial effect on data subjects in more than one Member State.

Removed:Article 2 c – title (new): Article 2c / Cooperation between supervisory authorities

Added:Article 3 – paragraph 2 – point b (new): (b) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

Changed:Article 2 c3 – paragraph 12 – point c (new): 1.(c) Thetake one of the following actions: / (i) transmit the complaint to the assumed lead supervisory authority shallunder structure,Article coordinate56(1) of Regulation (EU) 2016/679 and manageinform the casecomplainant inthereof. anThe efficientassessment andof expedientthe way,admissibility inof accordancethe complaint by the supervisory authority with Regulationwhich (EU)the 2016/679,complaint thishas Regulationbeen andlodged anyshall applicablebe nationalbinding proceduralon law,the ensuringlead thatsupervisory Regulationauthority; (EU)or 2016/679/ is(ii) fullyhandle enforced.the complaint under Article 56(2) of Regulation (EU) 2016/679.

Changed:Article 2 c3 – paragraph 2 a (new): 2.2a. The lead supervisory authority shall manage each caseimmediately inprovide fullthe cooperationcomplaint withto the supervisoryparty authoritiesunder concerned,investigation and shall complyrequest witha anyreply requestwithout ofundue adelay, supervisorybut authorityno underlater thisthan Regulationthree andweeks Articlesfrom 60the today 62the ofparty Regulationunder (EU)investigation 2016/679.was Anyinformed supervisoryby authoritythe maylead declaresupervisory thatauthority. itIn iscomplex concernedcases, and participate in thewhere caserequested fromand thatduly pointjustified onwards..by Thethe leadparty supervisoryunder authorityinvestigation, shallthe maintaintime afor listreplying ofcan supervisorybe authoritiesextended concernedby forthe eachlead casesupervisory inauthority theby jointanother casethree file.weeks.

Changed:Article 2 c3 – paragraph 32 b (new): 3.2b. AnyThe supervisoryparties authorityor whichthe receivesassumed relevantlead informationsupervisory forauthority ashall caseraise shallany provideobjection itin relation to the competence of the assumed lead supervisory authority withoutor delay,to butthe nohandling laterof thana onecomplaint weekunder Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the dayaction thattaken itpursuant receivedto suchArticle information.3(2), point (c).

Removed:Article 2 c – paragraph 4 (new): 4. The lead supervisory authority may join and separate cases in accordance with national procedural law, insofar as this does not undermine the rights of the parties.

Added:Article 3 – paragraph 2 c (new): 2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were taken, or where differing assessments of the supervisory authorities involved cannot be resolved otherwise, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a. It shall provide the Board with a description of relevant processing activities, of the company's organisation and a description of where decisions are taken.

Removed:Generally recognizing this option would ensures legal certainty, especially in Member States where there is no procedural law.

Removed:EDPB, para 50.

Removed:Article 2 c – paragraph 5 (new): 5. The lead supervisory authority shall include all documents, submissions, memos and other information regarding the case in a joint case file without delay, but no later than one week from the day in which the lead supervisory authority received such information. Any other supervisory authority and the Board shall have instant remote access to the joint case file.

Removed:Article 2 c – paragraph 6 (new): 6. When diverging views arise or are to be expected, for example when a case is considered as contentious under Article 9, the lead supervisory authority shall instantly initiate an exchange with all concerned supervisory authorities with an aim to reach an early consensus or narrow areas of disagreement. The lead supervisory authority shall investigate facts relevant for diverging views.

Removed:Article 2 c – paragraph 7 (new): 7. Supervisory authorities shall use their powers under this Regulation and under Chapter VII of Regulation (EU) 2016/679 if diverging views cannot be overcome or in the case of inactivity of another supervisory authority.

Removed:Active duty to take action under Articles 60 to 66 GDPR when another SA does not fulfill its duties for cooperation. Otherwise parties are left in limbo.

Removed:EDPB, para 120.

Removed:Article 2 c – paragraph 8 (new): 8. All written documents by the supervisory authorities shall be provided by electronic means and in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Removed:The principle to use short, concise, transparent (…) documents is taken from various duties for CSAs in the proposal and elevated to a general principle (also applicable to the LSA). Text is taken from Article 12 GDPR

Removed:Article 2 d – title (new): Article 2d / Use of Languages and Translations

Removed:Amended version of Article 6 moved here, to ensure that the rules on translations apply to any type of procedure, not only to complaints procedures.

Removed:Article 2 d – paragraph 1 (new): 1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation procedure (“cooperation language”) .

Removed:Article 2 d – paragraph 2 (new): 2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts.

Removed:The “any other language” ensures that information is shared as soon as it is available. The information would still have to be translated into the cooperation language, once it goes into the joint case file.

Removed:Article 2 d – paragraph 3 (new): 3. The lead supervisory authority shall provide entries into the joint case file in the original language, and shall provide translations into the cooperation language.

Removed:Article 2 d – paragraph 4 (new): 4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication.

Removed:See same rule in Article 12 of Regulation 2020/1784, Service of Documents Regulation.

Removed:Article 2 d – paragraph 5 (new): 5. A supervisory authority may provide automated translations, if they certify that the translation is not substantially different from the original.

Removed:The existing practice of automated translations should be regulated, by demanding a certification that the contents are (at the core) correct.

Removed:Article 2 d – paragraph 6 (new): 6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State of jurisdiction.

Removed:Chapter II – title: Complaints and ex officio procedures

Removed:Article 3 – paragraph 1: 1. A complaint that is potentially subject to Article 60 of Regulation (EU) 2016/679 shall comply with the requirements of national procedural law applicable to the supervisory authority with which the complaint has been lodged and shall provide the following minimum information: / (a) the name, address and any other available contact details of the complainant, / (b) if known, the name, address and any other contact details of the party under investigation, / (c) the facts of the case and any evidence available to the complainant, / (d) the measures that the complainant demands from the supervisory authority. / No additional information shall be required in order for the complaint to be admissible. In particular, complainants shall not be required to use a national electronic ID or e-government system to submit the complaint.

Removed:Instead of a mandatory form, there should be minimum requirements to ensure that the complaint can be processed by the LSA. We recognize possible additional requirements under national law and the fact that in some cases, a data subject may not know or understand all details of a case. EDPB, para 23. Complainants shall not be required to use a national electronic ID to prevent the undue restriction of the manner in which to submit a complaint in cases where the data subject may not be aware whether the case relates to cross-border processing, and to align the Reg. with recital 141 GDPR.

Removed:Article 3 – paragraph 1 a (new): 1a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.

Removed:To prevent the undue rejection of complaints as observed in the practice of various DPAs.

Removed:Article 3 – paragraph 1 b (new): 1b. The supervisory authority with which a complaint has been lodged shall, within one week, acknowledge receipt of the complaint, and where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

Removed:Moved up from paragraph 6, to follow the sequence of events.

Removed:Article 3 – paragraph 1 c (new): 1c. The supervisory authority shall attribute a case number to the complaint, designate a case handler and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c)(i).

Removed:To facilitate communication between the CSA with which the complaint is lodged and the complainant.

Removed:Article 3 – paragraph 2: 2. The supervisory authority with which the complaint has been lodged shall, within three weeks after receipt of the complaint:

Removed:Combining the steps in paragraphs 2 to 4 into one paragraph to ensure that all steps are under the three week deadline. The three weeks is parallel to Article 56(3) GDPR, and has been moved here from the end of the paragraph, to make clear everything shall be done within three weeks.. Additional wording from EDPB suggestions.

Removed:Article 3 – paragraph 2 – point a (new): (a) determine the admissibility of the complaint,

Removed:Article 3 – paragraph 2 – point b (new): (b) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing,

Removed:Article 3 – paragraph 2 – point c (new): (c) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

Removed:Article 3 – paragraph 2 – point d (new): (d) draft a summary of key issues, and

Removed:Article 3 – paragraph 2 – point e (new): (e) either

Removed:Article 3 – paragraph 2 – point e – point i (new): (i) transmit the complaint to the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679 and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority;

Removed:To provide clarification on the mutual recognition of complaints. EDPB, para 24.

Removed:Article 3 – paragraph 2 – point e – point ii (new): (ii) handle the complaint under Article 56(2) of Regulation (EU) 2016/679; or

Removed:Article 3 – paragraph 2 – point e – point iii (new): (iii) inform the complainant that he or she can resubmit the complaint, naming any missing information.

Removed:Article 3 – paragraph 2 a (new): 2a. The lead supervisory authority shall immediately provide the complaint to the party under investigation and demand a reply without undue delay, but no later than three weeks from the day it was informed by the supervisory authority concerned.

Removed:Article 3 – paragraph 2 b (new): 2b. The parties or the assumed lead supervisory authority shall raise any objection in relation to the competence of the assumed lead supervisory authority or to the handling of a complaint under Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the transmission of the complaint to the assumed lead supervisory authority or the lack of such a transmission.

Removed:Article 3 – paragraph 2 c (new): 2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were undertaken, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a.

Removed:Related to Article 26a

Changed:Article 4 – paragraph 1 – introductory part: 1. While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall endeavour to ensure the following:

Changed:Article 4 – paragraph 1 – point b: (b) the investigation of allrelevant factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7)60(7), to(8) and (9) of Regulation (EU) 2016/679;

Changed:Article 4 – paragraph 1 – point c: (c) the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemicsystemic, grave or repetitive infringements.

Removed:Each complaint must lead to an appealable decision. This will prevent situations where complaints are “closed” without an appealable decision. “Handling of complaints” is from Article 78(2) GDPR and ensures deadlines are met. EDPB, para 29.

Added:Article 4 – paragraph 1 b (new): 1b. The lead supervisory authority shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, and no later than nine months from the receipt of the complaint. / This deadline may exceptionally be extended by: / (a) eight weeks when comments under Article 9(3) are submitted with regard to a summary of key issues or an updated summary of key issues; / (b) eight weeks where the lead supervisory authority intends to issue fines or other penalties; / (c) the period of time between a reference under Article 26a(1) or (2) and the decision by the Board; / (d) the period of any prolongation permitted by the Board under Article 26a(3). / Each extension under points (a) to (d) may only be done once.

Changed:Article 4 – paragraph 1 b – introductory partc (new): The lead1c. supervisoryParagraph authority1b shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay,not butapply notonce latera thancase nineis monthssubmitted fromto the receipt ofconsistency themechanism complaint.in /accordance Thiswith periodArticle may60(4) exceptionallyof beRegulation prolonged(EU) by:2016/679.

Removed:Article 4 – paragraph 1 b – point a (new): (a) eight weeks when comments under Article 9(3) are submitted against a summary of key issues or an updated summary of key issues;

Added:Article 5 – paragraph 1: 1. A complaint may be resolved by amicable settlement between the complainant and the party under investigation at any stage of the proceedings. The complaint-receiving or the lead supervisory authority may encourage and facilitate that voluntary process.

Removed:Article 4 – paragraph 1 b – point b (new): (b) the period of time between a reference under Article 26a and the decision by the Board;

Added:Article 5 – paragraph 1 a (new): 1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. Where an amicable settlement to the complaint has been found, the parties shall within one month communicate the settlement to the lead supervisory authority and the supervisory authority where the complaint has been lodged.

Removed:Linked to Article 26a.

Added:Article 5 – paragraph 1 b (new): 1b. Within one month after the communication of the amicable settlement under paragraph 1a, a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679 shall be submitted, indicating: / (a) whether the conditions of an amicable settlement under paragraph 1a are fulfilled, and / (b) whether to open an ex officio investigation under paragraph 1d.

Removed:Article 4 – paragraph 1 b – point c (new): (c) the period of any prolongation permitted by the Board under Article 26a(3).

Added:Article 5 – paragraph 1 c (new): 1c. Where, within one month, none of the other supervisory authorities concerned have objected to the draft decision under paragraph 1b or the Board confirms the amicable settlement in the procedure under Article 65(1), point (a) of Regulation (EU) 2016/679, the complaint shall be deemed withdrawn and the settlement shall become valid.

Removed:Linked to Article 26a.

Added:Article 5 – paragraph 1 d (new): 1d. An amicable settlement does not prevent the lead supervisory authority from conducting an ex officio investigation in the same matter. It may open an ex officio investigation instead, in particular where: / (a) the party under investigation is a repeat offender; / (b) the party under investigation has been the subject of a large number of other amicable settlements; / (c) the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, is of long duration, or is of serious nature; or / (d) the exercise of powers is otherwise required to ensure effective, proportionate and dissuasive enforcement of Regulation (EU) 2016/679.

Removed:Article 4 – paragraph 1 c (new): Paragraph 1b shall not apply once a case is submitted to the consistency mechanism in accordance with Article 60(4) of Regulation (EU) 2016/679.

Added:Article 5 a (new): Article 5a / Request for an ex officio procedure / 1. Where it considers that Regulation (EU) 2016/679 may be violated and data subjects in the territory of its Member State are affected, any supervisory authority concerned may request an ex officio procedure by submitting a written request for a discretionary action pursuant to paragraph 2 to the lead supervisory authority. Such a request shall contain at least: / (a) a declaration to be a supervisory authority concerned, and / (b) a summary of key issues pursuant to Article 9. / 2. Within three weeks, the assumed lead supervisory authority shall: / (a) inform the supervisory authority concerned that it has opened an ex officio procedure; / (b) inform the supervisory authority concerned that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself; or / (c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no prima facie violation of Regulation (EU) 2016/679. / In the case referred to in point (a) of this paragraph, the supervisory authority concerned may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679. / In the cases referred to in point (b) and (c) of this paragraph, the supervisory authority concerned may resubmit an amended request for an ex officio procedure, or r…

Removed:Article 5 – paragraph 1: 1. A complaint may be resolved by amicable settlement only where it concerns the data subjects’ rights and where with the resolution of the dispute by an amicable settlement, the processing which the complaint related to is no longer taking place.

Removed:EDPB para 32. See also EDPB Guidelines 06/2022 on amicable settlements.

Removed:Article 5 – paragraph 1 a (new): 1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it. Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

Removed:EDPB para 33, clarification which SA is in charge when. Joint communication by the parties ensures it is the free will of the complainant.

Removed:Article 5 – paragraph 1 b (new): 1b. The supervisory authority is not bound by the amicable settlement. It shall in particular open an ex officio investigation instead, where / (a) the party under investigation is a repeat offender, / (b) the party under investigation has been the subject of a large number of other amicable settlements,, / (c) the broad subject matter of the complaint concerns a large number of data subjects other than the complainant; or / (d) the consequence of the processing which has been subject to the complaint is of long duration or serious nature.

Removed:A dispute settlement between two parties is usually seen as a contract between these parties, not an act between a party and an authority. EDPB, para 32.

Removed:Article 5 a (new): Article 5a / Request for an ex officio procedure / 1. The lead supervisory authority may open an ex officio procedure at any time. / 2. Where it considers that Regulation (EU) 2016/679 may be violated, any concerned supervisory authority may request an ex officio procedure by submitting a written request to the lead supervisory authority. Such a request shall contain at least: / (a) a declaration to be a concerned supervisory authority; / (b) any evidence of the violation; / (c) a summary of key issues pursuant to Article 9; / 3. Within three weeks, the assumed lead supervisory authority shall: / (a) inform the concerned supervisory authority that it has opened an ex officio procedure.; / (b) inform the concerned supervisory authority that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself in line ; or / (c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no violation of Regulation (EU) 2016/679. / In the case referred to in point (a) of this paragraph, the concerned supervisory authority may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679 / In the case referred to in point (c) of this paragraph, the concerned supervisory authority may resubmit an amended request for an ex officio procedure, or request a determi…

Removed:Deadline of three weeks in para 3 from Article 56 GDPR.

Removed:Moved to Article 2d, as the matter of translations does not only concern complaints procedures but any form of cooperation.

Added:Chapter III – title: Cooperation under Article 60 of Regulation (EU) 2016/679 and with other relevant authorities

Removed:Article 7 – title: Cooperation between supervisory authorities and between supervisory authorities and other relevant authorities

Removed:Article 7 – paragraph 1 a (new): Supervisory authorities shall strive to communicate the information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in other areas, including competition, financial services, energy, telecommunications and consumer protection authorities, where the information is deemed relevant to the tasks and duties of those authorities.

Removed:Recognising that investigation on infringements in the area of data protection might provide evidence on infringements in other areas. This is a demand from many civil society organisations.

Removed:If the parties cannot bring a claim in national courts over the lack of cooperation, this would in many cases make Article 78 GDPR inefficient if the “problem” for a missing decision lies in the lack of cooperation and cannot be tackled by the parties. EDPB, para 29.

Added:Article 8 – paragraph 1: 1. The lead supervisory authority shall provide the other supervisory authorities concerned with instant, unrestricted and continuous remote access to the full joint case file, and shall include in the joint case file all relevant information, in particular documents, submissions, memos and other information related to the case within one week from producing or receiving them.

Changed:Article 8 – paragraph 1:2 1.– introductory part: 2. The lead supervisory authority shall actively provide and notify the other supervisory authorities andconcerned theand, Boardwhere withnecessary instant,for unrestricteddispute andresolution continuousunder remoteArticle access65 toof theRegulation full(EU) joint2016/679, casethe file,Board, andwith shallrelevant includeinformation intowithin the jointmeaning caseof fileArticle any60(1) documents,and submissions,(3) communication,of protocols,that evidenceRegulation, within one week from producing or otherreceiving it. This information relatedshall tocover theinformation caseon withinmajor onesteps weekin ofthe producingprocedure, orincluding receivingwhere it.applicable:

Removed:Article 8 – paragraph 2 – point h: deleted

Added:Article 8 – paragraph 2 – point i: (i) the views of the complainant on the non-confidential version of the preliminary findings and, if applicable, other aspects of the investigation on which formal written submissions have been made by the complainant;

Removed:Following the deletion of Article 15.

Added:Article 8 – paragraph 2 – point k a (new): (ka) any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;

Removed:Article 8 – paragraph 2 – point i: deleted

Added:Article 8 – paragraph 2 – point k b (new): (kb) any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;

Removed:Following the deletion of Article 15.

Added:Article 8 – paragraph 2 – point k c (new): (kc) any judicial remedy brought during a procedure under Article 60 of Regulation (EU) 2016/679 or against a decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Removed:Article 8 – paragraph 2 – point j: deleted

Added:Article 9 – paragraph 1: 1. Within four weeks after having received a complaint, or a request to open an ex officio procedure, the lead supervisory authority shall draft a summary of key issues that presumably need to be determined in order to decide the case, for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679, and provide this summary to the supervisory authorities concerned. The summary shall be drafted in an impartial way, taking into account any diverging facts and arguments. When transferring a case to the lead supervisory authority pursuant to Article 3(2), point (c), point (i), the concerned supervisory authority may provide a draft of a summary of key issues, which is not binding on the lead supervisory authority.

Removed:Following the deletion of Article 15.

Removed:Article 8 – paragraph 2 – point k: deleted

Removed:Following the deletion of Article 15.

Removed:Article 8 – paragraph 2 – point k a (new): (k a) any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;

Removed:Article 8 – paragraph 2 – point k b (new): (k b) any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;

Removed:Article 8 – paragraph 2 – point k c (new): (k c) any judicial remedy brought during a procedure under Article 60 of Regulation (EU) 2016/679 or against a decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Removed:Article 9 – paragraph 1: 1. At the outset of any case, the lead supervisory authority, or where a case is transferred from another supervisory authority, that authority, shall draft a summary of key issues that presumably need to be determined to decide the case, for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679. The summary shall be drafted in an impartial way, taking into account any diverging facts and arguments.

Removed:Under Article 3(2), the summary of key issues should be drafted by the CSA that receives a complaint, as it will best understand the concern of the data subject and is under the jurisdiction for appeals in case a complaint is rejected. EDPB, para 50.

Changed:Article 9 – paragraph 2 – point b: (b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringementinfringement, ,and, andwhere applicable, an indication ifof whether they seemappear to behave been infringed;

Changed:Article 9 – paragraph 2 – point c: (c) identificationpreliminary offactual or legal andassessments, technologicaldealing assessmentswith whichall arerelevant views as expressed by parties when the summary is drafted, and including relevant forEuropean preliminarycase orientationlaw, ofas theirwell assessment;as guidelines, recommendations and best practices issued by the Board;

Removed:EDPB para 52.

Added:Article 9 – paragraph 2 a (new): 2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any factual or legal changes that emerge during the course of the procedure.

Removed:Article 9 – paragraph 2 – point c a (new): (c a) where applicable, European case law, as well as guidelines, recommendations and best practices issued by the Board, that would determine the matter, and an indication if the supervisory authority intends to follow them;

Added:Article 9 – paragraph 3: 3. The supervisory authorities concerned may provide factual or legal comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update of it, in accordance with Article 60 of Regulation (EU) 2016/679.

Removed:Article 9 – paragraph 2 a (new): 2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any material changes that emerge during the course of the procedure.

Removed:Article 9 – paragraph 3: 3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update.

Removed:EDPB para 54. (EDPB Rules of Procedure can specify this already anyway.)

Added:Article 9 – paragraph 6: 6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article which challenge the summary of key issues or raise other important factual or legal questions shall be considered non-contentious cases. In such cases, the deadline to issue a draft decision referred to in Article 4(1b) shall be 3 months.

Removed:Article 9 – paragraph 6: 6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article, and where the supervisory authority indicates that it intends to follow European case law, as well as guidelines, recommendations and best practices referred to in paragraph 2(ca), shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

Added:Chapter III – Section 2 – title: Cooperation with other relevant authorities

Removed:3 months: rapid decision-making in non-contentious cases requires shorter deadlines.

Removed:Article 10 – paragraph 1: deleted / (deleted) / (deleted) / (deleted)

Added:Article 10 – paragraph 1 – introductory part: 1. A supervisory authority concerned shall make a request to the lead supervisory authority under Article 61 or Article 62 of Regulation (EU) 2016/679, or both, where, following the comments of supervisory authorities concerned pursuant to Article 9(3), a supervisory authority concerned disagrees with the assessment of the lead supervisory authority on:

Removed:Covered by horizontal provisions in new Article 2c now.

Added:Article 10 – paragraph 1 – point b: (b) preliminary factual or legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

Removed:Covered by horizontal provisions in new Article 2c now.

Added:Article 10 – paragraph 1 – point c a (new): (ca) preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

Removed:Article 10 – paragraph 4: 4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), the lead supervisory authority or a concerned supervisory authority may request a procedural determination pursuant to Article 26a(1).

Added:Article 10 – paragraph 3: 3. In cases not falling under Article 9(6) of this Regulation, the lead supervisory authority shall investigate facts relevant for diverging views and engage, making its best effort, with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings.

Removed:Article 10 – paragraph 5 – introductory part: 5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the supervisory authority shall provide all of the following:

Added:Article 10 – paragraph 4: 4. Where within four weeks after the expiry of the deadlines for comments, the procedure provided for in paragraph 3 of this Article fails to generate consensus between the lead supervisory authority and one or more supervisory authorities concerned on the matters referred to in Article 9(2), the lead supervisory authority or a supervisory authority concerned shall request a procedural determination of the Board under Article 26a of this Regulation.

Removed:Article 10 – paragraph 5 – point a: (a) the relevant information referred to in Article 9(2);

Added:Article 10 – paragraph 5 – introductory part: 5. When requesting a procedural determination of the Board pursuant to paragraph 4 of this Article, the requesting supervisory authority shall provide all of the following:

Changed:Article 10 – paragraph 5 – point b: (b) the comments of the supervisory authority concerned that disagreesa: with(a) the leadrelevant supervisoryinformation authority’sreferred preliminaryto identificationin ofArticle the9(2), matterincluding referredany toupdates inwhen Articlethey 9(2).occur;

Removed:Article 10 – paragraph 6: 6. The Board shall adopt an urgent binding decision on the summary of key issues, in accordance with Article 66(3) of Regulation (EU) 2016/679, on the basis of all documents received.

Added:Article 10 – paragraph 5 – point b: (b) the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation or the factual or legal assessment of the elements of the summary of key issues referred to in Article 9(2);

Removed:Wording suggestion from EDPB.

Added:Article 10 – paragraph 5 – point b a (new): (ba) access to the joint case file.

Removed:Chapter III – Section 2: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added:Article 10 – paragraph 5 a (new): 5a. The Board may request the supervisory authorities to provide other documents or information, as it deems appropriate in the particular case.

Removed:Covered by Article 14 now.

Added:Article 10 – paragraph 6: 6. The Board shall adopt an urgent binding decision on the summary of key issues or on extending the period referred to in paragraph 4, in accordance with Article 26a, on the basis of all documents received.

Added:Article 10 a (new): Article 10a / Cooperation with other relevant authorities / Supervisory authorities shall strive to communicate non-personal information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in data protection and other areas, including competition, financial services, energy, telecommunications, consumer protection, digital services, or artificial intelligence supervisory authorities, where the information is deemed relevant to the tasks and duties of those authorities, in particular for opening administrative procedures and investigations into possible violations of legislation under their competences. Information can be only used for the purposes of which it was gathered. However, that does not preclude the supervisory authority to initiate other proceedings based on that information or to share it with other authorities for that purpose.

Added:Article 11: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added:Article 12: deleted / (deleted) / (deleted) / (deleted)

Changed:Article 14 – paragraph 2 – subparagraph 1: 1.The Followingpreliminary thefindings consultationsshall present allegations raised in an exhaustive and proceduressufficiently clear way to enable the parties under Articlesinvestigation 9to andtake 10cognisance of thisthe Regulation,conduct wheninvestigated by the lead supervisory authorityauthority. intendsIn toparticular, submitthey ashall draftset decisionout withinclearly all the meaningfacts, ofincluding Articlelisting 60(3)all ofthe Regulationevidence (EU)relied 2016/679upon, toand the otherentire legal assessment raised against the parties under investigation, so that they are heard and can express their views on the facts and the legal conclusions the lead supervisory authoritiesauthority concernedintends findingto andraw infringementin the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, itand shalllist draftall preliminarythe findings.evidence it relies upon.

Removed:Wording suggestion from EDPB.

Removed:Article 14 – paragraph 2 – subparagraph 1: The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Removed:EDPB para 135

Removed:EDPB para 135

Added:Article 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

Removed:Article 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements of facts and law, which are known to it, and on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account..

Added:Article 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation that may be subject to the exercise of a corrective power, as well as to the supervisory authority with which the complaint was lodged and the supervisory authorities concerned. The supervisory authority with which the complaint was lodged shall notify preliminary findings to the complainant.

Removed:EDPB para 135

Removed:Article 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties.

Removed:Replaced by horizontal rule in Article 2b(1)(c).

Added:Article 14 – paragraph 6: 6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Removed:Article 14 – paragraph 6: 6. The parties may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Changed:Article 16 – paragraph 1: After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation 2016/679, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Removed:Four weeks from Article 60(4) and (5) GDPR

Added:Article 16 – paragraph 1 a (new): 1a. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intends to follow that objection, the lead supervisory authority shall, within four weeks, submit a revised draft decision pursuant to Article 60(5) of that Regulation.

Changed:Article 16 – paragraph 1 ab (new): 1b. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intendsdoes tonot follow the relevant and reasoned objection or is of the opinion that objection,the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit athe revisedmatter draftto decisionthe pursuantconsistency mechanism referred to in Article 60(5)63, in accordance with Article 60(4) of that Regulation.

Removed:Article 16 – paragraph 1 b (new): Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit the matter to the consistency mechanism referred to in Article 63, in accordance with Article 60(4) of that Regulation.

Added:Article 16 – paragraph 1 c (new): 1c. Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

Removed:Article 16 – paragraph 1 c (new): Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing of the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

Added:Article 16 – paragraph 1 d (new): 1d. In the event where the legally binding decision is to be issued by the supervisory authority with which the complaint has been lodged in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the lead supervisory authority shall ensure that the decision contains all elements necessary under the applicable national procedural law of the supervisory authority concerned. The supervisory authority concerned with which the complaint has been lodged shall assist the lead supervisory authority in drafting the decision in such a manner.

Removed:Point (f) moved here from Article 13. This information should be available to all parties.

Added:Article 16 – paragraph 1 e (new): 1e. Any draft decision or final decision shall only rely on factual findings made on the basis of documents or other evidence, on which the parties under investigation had the opportunity to make their views known.

Changed:Article 16 – paragraph 1 df (new): In a case where the legally1f. bindingThe decisioninformation isprovided to be issued by the supervisory authority with which the complaint has been lodged in accordanceparties withunder Article 60(8)60(7) orto (9) of Regulation (EU) 2016/679, the lead supervisory authority2016/679 shall ensure that the decision contains all elements necessary under the applicable nationalinclude procedurala lawcopy of the concerned supervisory authority. The concerned supervisory authority with which the complaintlegally hasbinding beendecision, lodgedand shallinformation assistabout thea leadjudicial supervisoryremedy authorityavailable in draftingaccordance thewith decisionArticle in78 suchof aRegulation manner.(EU) 2016/679.

Removed:Article 16 – paragraph 1 e (new): The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision.

Added:Article 16 – paragraph 1 g (new): 1g. Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless the new decisions do not materially depart from previously published decisions. In accordance with applicable national law, supervisory authorities may redact party names, any other information that may allow the identification of parties, and other information that is protected under applicable law.

Removed:Article 16 – paragraph 1 f (new): Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless they do not materially depart from previously published decisions. In accordance with applicable national procedural law,, supervisory authorities may redact information that may allow identifying parties and redact other information that is protected under applicable law.

Removed:Established practice in most Member States, see GDPRhub.eu:- Spain publishes everything. Most countries publish novel or relevant decisions only (which is the proposal here). Germany and Romania do not publish anything (other than some press release).

Removed:This Article is replaced by Article 2b(1)(b), which clarifies that the parties must be heard on novel issues that were not brought to their attention (“Überraschungsverbot”). There is no need to hear the parties on the entire draft decision.

Added:Article 18 – paragraph 1 – point a: (a) be based on factual elements included in the draft decision, or on the evidence the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;

Changed:Article 18 – paragraph 1 – point a: (a) beb: based(b) onnot factualchange elementsthe includedscope inof the draftcase decision,as ordefined in the joint case file or on anylatest additionalversion evidenceof submittedthe togethersummary withof thekey relevantissues; and reasoned objection;

Removed:The limitation to only base this on what the LSA has put in the draft decision allows to manipulate the outcome by simply only focusing on certain elements. It should be at least the entire case file, ideally also evidence that the LSA may have been missing. EDPB paras 92-96

Added:Article 18 – paragraph 1 – point b a (new): (ba) clearly identify the elements of the draft decision that should be changed, including, when possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

Removed:Article 18 – paragraph 1 – point b: (b) not change the scope of the case as defined through the latest version of the summary of key issues; and

Removed:Based on EDPB wording suggestions.

Removed:Article 18 – paragraph 1 – point b a (new): (b a) clearly identify the elements of the draft decision that should be changed, including, where possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

Changed:Article 22 – paragraph 2 – point b: (b) a summary of the relevant facts, including the description of processing activities, the description of the company'scontroller’s organisation and where the descriptionrelevant decisions on the purposes and means of wherethe decisionsprocessing of personal data are taken;

Removed:Aligned with amended and broader Article 15, see amended point (d).

Added:Article 22 – paragraph 2 – point f: (f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as not relevant or reasoned;

Changed:Article 22 – paragraph 2 – point f:g: (f)(g) the relevant and reasoned objectionsreasons whichon werethe notbasis followedof bywhich the lead supervisory authority, and theauthority objectionsdid thatnot thefollow leadobjections supervisoryor authorityrejected hasthe rejectedobjections as being neithernot relevant noror reasoned;

Removed:Wording suggestion by EDPB.

Added:Article 22 – paragraph 2 – point g a (new): (ga) access to the joint case file.

Removed:Article 22 – paragraph 2 – point g: (g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned;

Added:Article 22 – paragraph 3: 3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving all of the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to all supervisory authorities.

Removed:Wording suggestion by EDPB, to align with (f).

Added:Article 22 – paragraph 3 a (new): 3a. Once all information specified in paragraph 2 have been received, the Chair of the Board is empowered to request from the lead supervisory authority or the supervisory authorities concerned any additional information, documents or clarifications necessary for the Board to take a binding decision concerning all of the matters which are the subject of the relevant and reasoned objections. The authorities shall provide this additional information no later than one week after having received the request.

Removed:Article 22 – paragraph 2 – point g a (new): (g a) access to the joint case file.

Added:Article 22 – paragraph 3 b (new): 3b. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit other relevant information that they have on that case which was not included in the objections, including but not limited to, facts and documentation related to their objection.

Removed:Article 22 – paragraph 3: 3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to the supervisory authorities.

Added:Article 22 – paragraph 3 c (new): 3c. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 22(2) are available and translated in accordance with Article 2d.

Changed:Article 22 – paragraph 3 ad (new): 3a.3d. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities concernedto may,adopt withina twodecision weekson afterthe havingsubject beenmatter providedsubmitted withto the submissionBoard pursuantduring tothe paragraphperiods 3,referred submitto anyin relevantArticle information65(2) thatand they(3) haveof onRegulation that(EU) case,2016/679 includingshall butalso notapply limitedduring to,the factsperiods andreferred documentationin thatparagraph underlie3 theirof objection.this Article.

Removed:EDPB paras 143-153. “Statement of Reasons” is not defined, and the whole procedure would require the EDPB to take three decisions in extremely limited time, see para 150. EDPB para 153 therefore recommends to delete Article 24.

Removed:Article 24 a (new): Article 24a / Request for information by the Board / 1. In cases in which the Board is otherwise unable to determine the matter, it may request further information from the parties or supervisory authorities, or it may conduct further factual investigations. / 2. The deadlines in Article 65(2) of Regulation (EU) 2016/679 are extended for the duration of the procedure under paragraph 1, but no more than one month.

Removed:Proposal from EDPS to replace the cumbersome procedure in Article 24.

Removed:Duplication with Article 22(2).

Added:Article 26 – paragraph 1 – point c: (c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an explanation of which points were not followed and a reference to the relevant part of the adopted decision.

Removed:Article 26: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added:Article 26 – paragraph 1 a (new): 1a. The Chair of the Board shall inform all supervisory authorities of the referral made to the Board under paragraph 1, so as to allow the supervisory authorities to make their views known.

Removed:Duplication with Article 22(2).

Added:Article 26 – paragraph 3: 3. The Chair of the Board shall register the referral no later than one week after having received all of the documents referred to in paragraphs 1 and 2.

Changed:Article 26 a (new): Article 26aArticle26a / Procedural determinations by the Board / 1. Without prejudicePursuant to Articles 65 andArticle 66 of Regulation (EU) 2016/679, a supervisory authoritiesauthority may request from the Board to make a procedural determination on any dispute arising during a cooperation procedure,take includingan whetherurgent abinding casedecision meetsin the requirements of Article 56form of Regulation (EU) 2016/679. / 2. Parties to the procedure may request from the Board to make a determination when no supervisory authority considers itself competent to handle a complaint underprocedural Articledetermination 55on orany 56procedural ofdispute Regulationarising (EU)between 2016/679supervisory orauthorities in exceptional cases when a case can otherwise not progress, because a supervisory authority manifestly violates its duties under Regulation (EU) 2016/679foreseen orby this Regulation. / 3.2. Where the lead supervisory authority is of the view that it cannot possibly comply with thea deadline frompursuant to Article 4(1b),4(1b) or Article 5a(3), especially because of the need for exceptionally complex factual investigations, it shall request from the Board aan prolongationurgent ofbinding updecision pursuant to twelveparagraph months.1, Theregarding supervisoryan authorityextension shallof submitthe adeadline detailedof planup ofto thenine investigationmore thatmonths. demonstratesThe supervisory authority shall demonstrate that despite its compliance with Article 2c(1)2c(1), the prolongationextension sought is strictly necessary.inevitable. / 4.3. Requests under paragraph 21 and 32 shall beat broughtleast withincontain: two/ weeks(a) fromthe facts relied upon and any evidence available to the deliveryauthority ofor party; / (b) the procedurallegal grounds for the request; / (c) the determination pursuant to paragraph 1 or athe rejectiondeadline byextension apursuant supervisoryto paragraph 2 that the authority andor mustparty atrequests leastfrom contain:the Board; / (a)4. theWithin factstwo reliedweeks, uponthe andBoard anyshall evidencedetermine availablethe tomatter based on the authorityinformation before it or party;it /shall (b)reject the leg…application. Determinations are binding on the supervisory authorities.

Removed:To avoid “deadlocked” cases, e.g. where SAs can’t agree on who is lead authority, etc. EDPS paras 108-111.

Added:Article 26 b (new): Article 26b / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80 of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) if it considers that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing. / 3. Where a court or tribunal exercising the review pursuant to paragraph 1 finds that a supervisory authority has not fulfilled its duties, it shall have the power to order that supervisory authority to take the necessary action.

Removed:Article 26 b (new): Article 26b / Select Committees / 1. The Board may appoint one or more select committees of three or more members, who can be part of the supervisory authorities or of the secretariat under Article 75 of Regulation (EU) 2016/679. The mandate of each of the committees is determined by the Board. Select committee Members perform their tasks under the instructions of the Board and may only be discharged by the Board. / 2. In its rules of procedure, the Board may designate any tasks, such as determinations under Article 26a, or other tasks aimed at ensuring harmonised implementation of Regulation (EU) 2016/679 and this Regulation by the supervisory authorities, to the select committees and specify the procedures of the select committees further. Each of the committees shall present their findings to the Board.

Added:Article 27 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Removed:To avoid overloading the whole Board with little cases, e.g. missing documents etc.

Removed:Article 26 c (new): Article 26c / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80(1) of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) independently of an infringement of the rights of a data subject.

Removed:To prevent cases from being dead-locked when a supervisory authority simply does not act.

Removed:Article 27 – paragraph 1 – introductory part: 1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679 and shall contain all of the following items:

Removed:To allow for more time for the EDPB, see EDPB paras 124-125

Removed:Aligned with Article 28, see EDPB para 118.

Added:Article 27 – paragraph 1 – point c: (c) a justification of the urgent need for final measures, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

Changed:Article 27 – paragraph 1 – point c: (c)c a justification of the urgent need for final measures(new): to(ca) bewhere adopted,the includingrequesting anauthority explanationis ofnot the exceptional nature oflead circumstancessupervisory requiringauthority, the adoptionviews of the measureslead concerned.supervisory authority.

Removed:In cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.

Added:Article 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the authorities to maintain or amend provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

Removed:Article 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities.

Removed:In cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.“all supervisory authorities ” as in EDPB para 121, because EDPB opinions have general applicability. EDPB para 119.

Removed:EDPB para 122

Added:Article 28 – paragraph 1 – point d: (d) a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to provide the information requested under Article 61(5) of Regulation (EU) 2016/679 or failed to respond to a request pursuant to Article 61(8) or 62(2) of Regulation (EU) 2016/679;

Changed:Article 28 – paragraph 1 – point d: (d)f: a(f) justificationwhere ofavailable, the urgent needviews forof finalthe measuresparties. toIn becase adoptedthe onrequesting theauthority territoryis ofnot the requestinglead supervisory authority, bearing in mind the exceptional nature of circumstances requiringrequesting theauthority adoptionshall ofgrant the final measure, or proof that aright supervisoryto authoritybe failedheard to provide the information requestedparties under Article 61(5) ofinvestigation Regulationagainst (EU)which 2016/679provisional ormeasures failedwere totaken respondpursuant to a request under Article 62(2)66(1) of Regulation (EU) 2016/679;2016/679.

Removed:Wording suggestion by EDPB.

Added:Article 28 – paragraph 2: 2. The urgent binding decision referred to in paragraph 1 shall be addressed to the lead supervisory authority and all the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

Removed:Article 28 – paragraph 1 – point f: (f) where applicable, the views of the parties.

Added:Article 28 – paragraph 3: 3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority or authorities to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

Removed:Where applicable, all parties, including complainants, should be heard. EDPB para 128.

Added:Article 28 – paragraph 4: 4. A supervisory authority that is responsible to adopt final measures shall notify its decision on the final measures to the parties under investigation and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the parties under investigation against which the provisional measures were adopted about the Board’s decision and the final measures adopted by the lead supervisory authority. The complaint-receiving supervisory authority shall inform the complainant about the Board’s decision and the final measures adopted by the lead supervisory authority.

Removed:Article 28 – paragraph 2: 2. The urgent binding decision referred to in paragraph 1 shall be addressed to the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

Added:Article 28 a (new): Article 28a / Remedies against procedural determinations / Remedies against procedural determinations by a supervisory authority under national law shall only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.

Removed:“all the supervisory authorities concerned” as in EDPB para 121, so it applies everywhere where the cross-border processing takes place.

Added:Article 28 b (new): Article28b / Enforcement Statistics / Supervisory authorities shall report the following numbers in their activity report under Article 59 of Regulation (EU) 2016/679: / (a) the number of ex officio investigations initiated by the supervisory authority; / (b) the number of ex officio investigations initiated by other supervisory authorities; / (c) the number of complaints received, including the number that were rejected, dismissed, withdrawn, partly upheld, fully upheld or otherwise closed; / (d) the number of legally binding decisions currently on appeal; / (e) the number and average duration of open and decided procedures under (a) to (d) to date; / (f) the number of each type of measure taken in accordance with Article 58(2) of Regulation (EU) 2016/679 or applicable national law; / (g) the number and the amount of fines issued and collected under Article 83 and 84 of Regulation (EU) 2016/679 or relevant national law; and / (h) the annual budget and the number of staff, by training, tasks and organizational units. / 2. Supervisory authorities shall publish the activity report for the past year without undue delay, but no later than by 30 June. / 3. The Board shall make the information of all supervisory authorities in paragraph 1 available to the public no later than 31 July of each year for the previous year.

Removed:Article 28 – paragraph 3: 3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the lead supervisory authority shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

Removed:Article 28 – paragraph 4: 4. The supervisory authority that submitted the request referred to in paragraph 1 shall notify its decision on the final measures to the controller or processor and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the lead supervisory authority of the final measure.

Removed:EDPB para 122

Added:Article 30 – paragraph 2 a (new): Until ... [six months from the date of application of this Regulation], the lead supervisory authority shall, upon request, provide all documents in its own file to other supervisory authorities by other electronic means.

Changed:Article 31 – paragraph 1 a (new): 1a. It shall apply from ...… [one year from the date of entry into force of this Regulation]. / However, Article 2b(1), point(c), Article 2b(3), last sentence, Article 2c(2), last sentence, and (5), Article 2d(3) and (6), Articles 8(1) and 18(1), point (a) shall apply from ... [six months from the date of application of this Regulation].

Removed:EDPB para 192 – transition period for necessary adjustments in EDPB secretariat and tools (IMI), national DPAs, and possibly national laws.

Added:Annex I – Part A – point 1: (deleted) / Where the complaint is submitted by a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, submit proof that the body, organisation or association has been properly constituted in accordance with the law of a Member State. / Where the complaint is submitted on the basis of Article 80(1) of Regulation 2016/679, proof that the body, organisation or association lodging the complaint is acting on the basis of the mandate of a data subject. / (deleted) / (deleted)

Removed:Annex I: deleted / (deleted) / (deleted) / (deleted)

Added:Annex I – Part A – point 2: The name, address and any other available contact details of the complainant, including, where the complaint is submitted electronically, email address. / (deleted) / (deleted) / -----------

Removed:Instead of a mandatory form, there should be minimum requirements to ensure that the complaint can be processed by the LSA.

Added:Annex I – Part A – point 3: Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including the name, address and any other contact details of that entity.

Removed:Unduly limits the options for concerned supervisory authorities to raise objections. Could be used against CSAs by controllers e.g. filing injunctions against objections.

Changed:Recital 33: (33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents,documents the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

Removed:One does not refer to Articles in Recitals, because the Recitals are supposed to lead to the Articles later.

Removed:Board decisions in dispute resolution are binding on the authorities.

Changed:Chapter I – Section 1 a (new): Section 11a / Subject matter, scopescope, and definitions

Removed:Merged into paragraph 2.

Removed:Merged into paragraph 2.

Removed:Covered by new horizontal rule on confidentiality in Article 2b(3).

Removed:Moved up to paragraph 1a, to follow the chronological order of events.

Added:Chapter II – title: II Complaints and ex officio procedures

Removed:Article 8 – paragraph 2 – introductory part: 2. The lead supervisory authority shall actively provide the other supervisory authorities and the Board with relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679, within one week from receiving or producing it. This information shall cover information on major steps in the procedure, including where applicable:

Added:Article 8 – paragraph 2 – point a: (a) information on the opening of an ex officio investigation or of a complaints procedure;

Removed:Article 8 – paragraph 2 – point a: (a) information on the opening of an ex officio investigation or a complaints procedure;

Changed:Article 8 – paragraph 2 – point e a (new): (e a)(ea) any comments to a summary of key issues in accordance with Article 9(3);

Removed:Moved to a horizontal provision on all communications in Article 2c(8).

Changed:Article 10 – paragraph 2:1 – point c: deleted

Removed:Moved to Article 16(1)(f) to horizontally ensure that all parties are informed about judicial remedy options.

Added:Chapter III – Section 3 – title: Decisions addressed to parties under investigation

Removed:Section 3 – title: Decisions addressed to parties under investigation

Added:Article 14 – title: Preliminary findings and the right to be heard

Removed:Wording suggestion from EDPB.

Added:Article 14 – paragraph 1: 1. Following the consultations and procedures under Articles 9 and 10 of this Regulation, when the lead supervisory authority intends to submit a draft decision Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

Removed:Replaced by horizontal rule in Article 2b(4).

Removed:Now covered by Article 14, which in amended form requires preliminary findings to be sent to all parties of a case, including complainants.

Added:Article 16 – title: Submission of draft decisions, revised draft decisions and adoption of final decision

Removed:The duty to have concise documents is introduced as a general principle in Article 2c(8), which also applies to relevant and reasoned objections. Limiting it to 3 or maximum 6 pages is too narrow. EDPB para 97

Added:Chapter IV: deleted

Removed:Chapter IV – title: (deleted) / (deleted)

Added:Article 22 – title: Referral to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679

Removed:The entire Chapter is replaced by Article 2b.

Added:Article 22 – paragraph 1: 1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections or from the lapse of the deadline pursuant to Article 60(4) of Regulation (EU) 2016/679. Relevant and reasoned objections that have been received after the deadline shall not be taken into consideration.

Removed:Article 19: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Replaced by Article 2b(3). Paragraph 3 is captured by the definition of “internal deliberations” in Article 2(1f).

Removed:Article 20: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:The entire Chapter is replaced by Article 2b.Paragraph 4 is particularly problematic, as supervisory authorities should not be prevented from using information obtained in one procedure to perform their functions in other procedures and ex officio inquiries. EDPB para 79.

Removed:Article 21: deleted

Removed:Replaced by Article 2b(3).

Removed:Article 22 – title: Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679

Removed:Wording suggestion from EDPB.

Removed:Article 22 – paragraph 1: 1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections.

Removed:In some cases, LSAs have taken a year to submit RROs to the Board.

Removed:EDPB para 108

Added:Article 22 – paragraph 2 – point d: (d) views made in writing by the parties, pursuant to Article 14;

Removed:Article 22 – paragraph 2 – point d: (d) view made in writing by the parties, pursuant to Articles 15;;

Removed:Aligned with amended and broader Article 15.

Removed:EDPB para 108.

Removed:Article 22 – paragraph 3 b (new): 3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

Removed:EDPB para 101.

Removed:Article 22 – paragraph 3 c (new): 3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation, shall also apply during the periods referred in paragraph 3 of this Article.

Removed:Wording suggestion from EDPB.

Removed:Covered by Article 22(2) and (3) now.

Removed:Aligned with wording of Article 66(2) GDPR.

Removed:“binding” aligned with wording of Article 66(2) GDPR.

Added:Article 28 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Removed:Aligned with Article 27, see EDPB para 118.

Removed:EDPB para 191 - Regulation No. 1182/71 applies anyway.

Removed:Following the introduction of new Articles in Chapters I and II.

Removed:While additional reports might be excessive, the reports on the GDPR must include an evaluation of the functioning of this Regulation. EDPB para 190.