What changed between the draft committee report and the plenary report

Added:Recital 15: (15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should raise the matter quickly with the Board. The Board should make the necessary procedural determinations. The Board and supervisory authorities should endeavour to complete ongoing proceedings as quickly as possible. The lead supervisory authority or one of the supervisory authorities concerned should also be able to request an urgent binding decision of the Board without a request under Articles 61 or 62 having been made.

Removed:Linked to Article 9(6).

Removed:Recital 15: (15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should be able to raise the matter quickly with the Board. The Board should be able to make the necessary procedural determinations.

Removed:Linked to Article 26a (new).

Recital 16: deleted

Change 10

Removed:Urgent decisions under Article 66(3) GDPR are limited to inaction of a DPA. Instead, procedural determinations by the Board should be possible for all sorts of procedural disputes. Linked to Recital (15).

Added:Recital 17: (17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, handling of any complaint should always lead to a decision which may be challenged before a national court.

Removed:Recital 17: (17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the handling of any complaint should always lead to a decision which may be challenged before a national court.

Removed:To ensure that cases are not “closed” or “deemed withdrawn” and alike without a clear decision which can be appealed.

Recital 18: deleted

Change 11

Removed:There is a general right to be heard before a decision, which allows to remove the need for “draft” decisions. Article 11 is therefore also deleted. This should limit the need for paperwork through repeated “draft of the draft” procedures.

Added:Recital 19: (19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Removed:Recital 19: (19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Added:Recital 21: (21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shall have the right to decline the right to be heard.

Removed:The COM proposal would rewrite the GDPR, as the drafting is clearly with the LSA. We suggest to highlight that the CSA with which the complaint was filed must issue the final decision and therefore needs to be involved in the drafting, to ensure that it cannot be easily appealed before a national court.

Added:Recital 22: (22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the the right to be heard and opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to effectively comment on matters relevant to the investigation, by receiving access to the administrative joint case file.

Removed:Recital 21: (21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter, including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case.

Added:Recital 23: (23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary to enable them to be heard is satisfied if the final decision only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a), of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Removed:Recital 22: (22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with the documents required to make their case effectively and to comment on the allegations made, by receiving access to the joint case file.

Added:Recital 24: (24) The parties should be provided with a right to be heard at appropriate stages of the procedure, in particular prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Removed:Recital 23: (23) The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary for their right to be heard is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a) of that Regulation. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

Removed:Recital 24: (24) The parties should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

Recital 25: (25) Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt of the complaint does not bar the qualification of a data subject as complainant.

Change 12

Added:Recital 25 a (new): (25a) Notwithstanding the fact that the parties under investigation and the complainant are not in the same procedural situation, there are circumstances in which complainants can be in a position to adduce arguments and evidence during an investigation which can help the progress of the investigation. This is particularly the case in circumstances in which a not-for-profit body, organisation or association has lodged a complaint on behalf of a data subject or on its own initiative under Article 80 of Regulation (EU) 2016/679. Supervisory authorities should facilitate the hearing of such complainants at all stages of the investigation, including ex officio investigations, while also maintaining their independence.

Recital 26: deleted

Change 13

Changed:Recital 27: (27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings,findings as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to unduly long procedures.

Recital 28: deleted

Change 14

Removed:Unduly limits the options for concerned supervisory authorities to raise objections. Could be used against CSAs by controllers e.g. filing injunctions against objections.

Recital 29: (29) In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

Change 15

Changed:Recital 30: (30) Access to the joint case file ismay be provided for asin athe partspirit of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties. Access of the parties to the joint case file may be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest. Such limitation must be proportionate in light of the respective recognised rights of others or the public interest pursued.

Change 16

Changed:Recital 31: (31) When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information.information and the protection of information in the public interest in accordance with applicable national law. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.information and provide a non-confidential version.

Change 17

Changed:Recital 33: (33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents,documents the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

Change 18

Removed:One does not refer to Articles in Recitals, because the Recitals are supposed to lead to the Articles later.

Recital 34: (34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Change 19

Removed:Board decisions in dispute resolution are binding on the authorities.

Recital 36: (36) In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board. Provisional measures pursuant to Article 66(1) of Regulation (EU) 2016/679 should include all possible measures within the powers of supervisory authorities, pursuant to Article 58 of that Regulation.

Change 20

Removed:EDPB para 120.

Added:Recital 36 a (new): (36a) The Board should be able to request any further information from supervisory authorities necessary for it to take a binding decision.

Removed:Recital 36 a (new): (36a) Where, after its deliberations, the Board is unable to determine the matter, because the joint case file and other information provided by the lead supervisory authority are not complete, the Board should be able to request further information from the parties or supervisory authorities, or conduct further factual investigations.

Added:Recital 36 b (new): (36b) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

Removed:Recital 36 b (new): (36b) The Board should be able to delegate certain tasks to one or more select committees, which can consist of members of the Board or members of the secretariat referred to in Article 75 of Regulation (EU) 2016/679. It should be possible for this delegation to include any task under Article 70 of Regulation (EU) 2016/679, decisions under Article 65 and 66 of Regulation (EU) 2016/679 or functions of the Board under this Regulation, such as routine tasks or decisions that need to be taken without delay, including any procedural determinations.

Removed:Linked to Articles 26a (new), 26b (new).

Removed:Recital 36 c (new): (36c) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board.

Removed:Linked to Article 26c (new).

Recital 38: (38) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on 19 September 2023,

Change 21

Changed:Chapter I – Section 1 a (new): Section 11a / Subject matter, scopescope, and definitions

Article 1 – title: Subject matter and scope

Change 22

Changed:Article 1 – paragraph 1: This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities relatedwhenever tosupervisory theauthorities cross-borderof processingmore than one Member State are involved in the meaningcase, ofas Regulationwell (EU)as 2016/679.procedural rules on related judicial remedies.

Change 23

Removed:EDPB wording suggestion – “cross-border enforcement” is not defined in GDPR. EDPB, introduction, p.7.

Added:Article 1 – paragraph 1 a (new): Article 26b of this Regulation also applies to cases before a supervisory authority of a single Member State, pursuant to Article 56(2) of Regulation (EU) 2016/679.

Removed:Article 1 – paragraph 1 a (new): This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

Added:Article 2 – paragraph 2 – point 1: (1) ‘party under investigation’ means the controller(s) and/or processor(s) complained about, or investigated for alleged infringement of Regulation (EU) 2016/679, as well as their representative(s);

Removed:Article 1 – paragraph 1 b (new): Article 26c of this Regulation also applies to cases before a supervisory authority of a single Member State.

Added:Article 2 – paragraph 2 – point 1 a (new): (1a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the proceedings;

Removed:Article 1 – paragraph 1 c (new): This Regulation does not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679.

Added:Article 2 – paragraph 2 – point 1 b (new): (1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party involved in the proceedings as defined under national law;

Removed:Article 2 – paragraph 2 – point 1: (1) ‘party under investigation’ means the controller(s) and/or processor(s) accused of, or investigated for, alleged infringement of Regulation (EU) 2016/679;

Added:Article 2 – paragraph 2 – point 1 c (new): (1c) ‘national procedural law’ means laws, regulations and administrative provisions of the Member State that regulate the procedure before a supervisory authority;

Change 24

Changed:Article 2 – paragraph 2 – point 1 ad (new): (1a) ‘complainant’ means the data subject(1d) or‘complaints non-for-profitprocedure’ body,means organisationa orprocedure associationdetermining thatthe hasoutcome lodgedof a complaint under Article 77 of Regulation (EU) 2016/679;

Change 25

Removed:EDPB para 155.