What changed between the draft committee report and the plenary report

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Changed:(COM(2023)348(COM(2023)0348 – C90231/2023 – 2023/0202(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

Changed:– having regard to the Commission proposal to Parliament and the Council (COM(2023)348),(COM(2023)0348),

– having regard to Article 294(2) and Article 16 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90231/2023),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

Added:– having regard to the reasoned opinion submitted, within the framework of Protocol No 2 on the application of the principles of subsidiarity and proportionality, by the Swedish Parliament, asserting that the draft legislative act does not comply with the principle of subsidiarity,

Added:– having regard to the opinion of the European Economic and Social Committee of 13 December 2023,

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the opinion of the Committee on Legal Affairs,

Changed:– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A90000/2023),(A9-0045/2024),

5 unchanged paragraphs

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Recital 2: (2) In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

Recital 2 a (new): (2a) This Regulation and Chapter VII of Regulation (EU) 2016/679 only govern certain elements of the cooperation procedure, when supervisory authorities of more than one Member State participate in the procedure. This Regulation does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State.

Change 1

Changed:Recital 2 b (new): (2b) The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. Some procedural elements, such as the horizontal burden of proof of the controller in Article 5(2) of Regulation (EU) 2016/679, are already governed by Union law. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law. Supervisory authorities shall make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video participation, interpreters or generally available means of communication.

Change 2

Removed:The Commission proposal is based on an idea of full harmonization, whereas matters like the use of languages, evidence, witnesses and alike are regulated in national procedures. The new Articles 1a and 2a to 2c shall clarify this matter.

Added:Recital 3: (3) Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities should be created used so as to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

Change 3

Changed:Recital 4: (4) In order to be admissible a complaint should contain certain minimum information about the alleged violation, whether ongoing or past. The cessation of a violation should not be sufficient grounds to reject a complaint. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint template should be provided. The information specified information.in the template should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the template may be used by supervisory authorities for cases that do not concern cross-border processing. The information may be submitted electronically or by post. No additional information should be required for a complaint to be deemed admissible. Where a complaint does not meet the minimum requirements, the supervisory authority should reject it and inform the complainant about the missing information. The complainant can then resubmit a complete complaint. While the complainant should not be required to contact the party under investigation before submitting a complaint, if the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she should submit the communication related to that contact. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

Change 4

Removed:The form should not be mandatory, as many complainants will not initially know if a case is cross-country or not. A mandatory form may unduly limit access to authorities. Instead, minimum information should be introduced.

Added:Recital 5: (5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. Article 6 of the European Convention on Human Rights (ECHR) and Articles 41 and 47 of the Charter require a reasonable overall duration of procedures. Given that this includes judicial remedies under Article 78 of Regulation (EU) 2016/679, procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations for delays or disruptions that are outside of the control of the lead supervisory authority. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

Removed:Recital 5: (5) Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. Article 6 of the European Convention on Human Rights (ECHR) and Articles 41 and 47 of the Charter require a reasonable overall duration of procedures. Given that this includes judicial remedies under Article 78 of Regulation (EU) 2016/679, procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations of time-limits for delays or disruptions that are outside the control of the lead supervisory authority.

Removed:The duration of nine months is based on existing laws (requiring usually 3-12 months) and also objectively necessary, when appeals under Article 78 (often 2-3 “levels” in the Member States) are accounted for. It is formulated as an average, normal duration to recognize that exceptional cases may take longer.

Recital 5 a (new): (5a) The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

Change 5

Removed:The Commission follows the idea of full harmonisation. This begs the question which procedural laws govern elements that are not fully harmonised. Linked to Article 2a (new)

Recital 5 b (new): (5b) To ensure that minimum requirements of fair and efficient procedures are met in all cross-border cases, including in Member States where there is no codified national procedural law, the Regulation sets directly applicable rules based on Article 41 of the Charter.

Change 6

Removed:The minimum standards should be largely compatible with existing national procedural laws. In Member States without a codified procedure, these minimum standards allow more legal certainty. When national laws are not compatible, this Regulation prevails. Linked to Article 2a (new)

Added:Recital 5 c (new): (5c) It should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a. This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why. / 1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj).

Removed:Recital 5 c (new): (5c) Article 6 of the ECHR and Article 47 of the Charter require that fair procedures are public. Article 42 of the Charter and the law of many Member States foresee the right of access to public documents and the transparency of actions of authorities. However, it should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/9431a . This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why. / 1a Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: https://eur-lex.europa.eu/eli/dir/2016/943/oj)

Added:Recital 5 d (new): (5d) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities in a spirit of common understanding and trust. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities. At the same time, the procedure should be in line with Regulation (EU) 2016/679, in particular the one-stop-shop dispute resolution architecture and the competences of the lead supervisory authority.

Removed:Reconcile the right to fair (=public) procedures and the right to access to information with the need to protect trade secrets and the inner decision-making of the authorities. Linked to Article 2b (new).

Added:Recital 5 e (new): (5e) Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should however, not lead to any interference with the rights of the parties.

Removed:Recital 5 d (new): (5d) The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities.

Added:Recital 5 f (new): (5f) Violations may concern the rights of multiple data subjects, therefore, evidence from procedures may need to be used in other procedures to facilitate an efficient procedure and consistent decision making. In order to objectively assess the amount of non-material damages based on the average data subject, civil courts may benefit from relying on established facts and evidence to determine a claim under Article 82 of Regulation (EU) 2016/679.

Removed:The LSA is in charge of managing the case, while the other SAs provide all information and must be involved. Linked to Article 2c (new).

Added:Recital 5 g (new): (5g) Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the accepted languages.

Removed:Recital 5 e (new): (5e) Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should, however, not lead to any interference with the rights of the parties. Complaints procedures should not be delayed and the right of parties to be heard should not be limited when a supervisory authority opens an ex officio procedure into the same matter.

Added:Recital 6: (6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be effective, proportionate and dissuasive in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective remedy to the complainant can be quickly delivered. Without prejudice to the necessity of providing a satisfactory resolution to the complainant within a short timeframe, supervisory authorities should investigate to a degree that allows them to satisfy themselves as to whether a complaint is indicative of more serious or systemic infringements. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a dec…

Removed:To avoid an “ex officio bypass” by some authorities, where the issue of a complaint is moved into an “ex officio” procedure, without the participation of the complainant.

Added:Recital 7: (7) The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information, as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one with which the complaint was lodged.

Removed:Recital 5 f (new): (5f) Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint “cooperation language” should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the relevant accepted languages.

Added:Recital 8: (8) The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances. Such access should allow the use of an effective judicial remedy in line with Article 47 of the EU Charter.

Removed:Currently the joint language is English, based on IMI rules. This is not defined in law, but seems accepted and sufficient in most cases. This should be codified. Linked to Article 2d.

Added:Recital 9: (9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should bind the authorities. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be used to defer decisions on complaints.

Removed:Recital 6: (6) Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate, necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective and quick remedy to the complainant can be quickly delivered. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint. To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision.

Added:Recital 10: (10) In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679. This should be in line with the ‘one-stop-shop’ mechanism of Regulation (EU) 2016/679 and guarantee, where applicable, non-discriminatory treatment of parties, legal certainty and independence of issuing of decisions by the supervisory authorities.

Removed:The recital so far hinted at limited enforcement and discretion of authorities not to act. This was amended to ensure that their duty to act is highlighted.

Removed:Recital 7: (7) The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention.

Removed:Linked to Articles 2c, 8

Removed:Recital 8: (8) The competent supervisory authority should provide the parties with remote access to the joint case file, except for redacted documents and internal deliberations.

Removed:Recital 9: (9) In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should not bind the authorities. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

Recital 11: (11) It is particularly important for supervisory authorities to reach consensus on key aspects of the case via the summary of key issues and comments on that summary as early as possible and prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

Change 7

Changed:Recital 12: (12) Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority. For this purpose, theThe supervisory authority with which a complaint has been lodged or which demandsrequests an ex-officio action shouldmay provide the lead supervisory authority with a summary of key issues setting out its preliminary view on the main issues in an investigation. In all other cases, theThe lead supervisory authority should draft the final summary of key issues. The summary of key issues should be part of the joint case file, and should be a living document that is updated by the lead supervisory authority during the course of the procedure. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned. Concerned supervisory authorities should have the opportunity to provide their comments on any update of the summary of key issues. The lead supervisory authority should comply with the comments as far as possible or reject them. In the case of a rejection, the supervisory authorities should be able to raise any dispute with the Board. Supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

Change 8

Changed:Recital 13: (13) In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, any documents submitted by concerned supervisory authorities and the parties should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. Supervisory authorities shouldmay therefore be able to limit the length of submissions by the parties. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. .

Change 9

Removed:To avoid “spamming” by large companies who can afford law firms to submit thousands of pages. The rule is similar to the rules of procedure before the CJEU, where submissions are regularly limited to 20 or 30 pages.

Added:Recital 14: (14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the draft decision within three months from the receipt of the complaint.

Removed:Recital 14: (14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within three months after the deadline for comments.