What changed between the draft committee report and the plenary report

Added:Article 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1), point (a), of Regulation (EU) 2016/679;

Removed:Article 2 – paragraph 2 – point 1 b (new): (1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case where foreseen under Member State law;

Added:Article 2 – paragraph 2 – point 1 f (new): (1f) ‘joint case file’ means a dedicated electronic file for any case falling under the scope of this Regulation, that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case, are stored and made remotely accessible to supervisory authorities concerned and parties to the case;

Change 26

Changed:Article 2 – paragraph 2 – point 1 cg (new): (1c) ‘national(1g) procedural‘complaint-receiving law’authority’ means the laws orsupervisory otherauthority ruleswith ofwhich the Membercomplaint Statehas thatbeen regulatelodged theas procedurereferred beforeto ain supervisoryArticle authority;4(22), point (c), of Regulation (EU) 2016/679;

Change 27

Removed:Article 2 – paragraph 2 – point 1 d (new): (1d) ‘complaints procedure’ means an adversarial procedure determining a complaint under Article 77 of Regulation (EU) 2016/679;

Added:Article 2 – paragraph 2 – point 2: (2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned, identifying the main relevant factual and legal issues within the preliminary scope of the investigation and the lead supervisory authority’s factual and legal views on the case;

Removed:Article 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1)(a) of Regulation (EU) 2016/279;

Added:Article 2 – paragraph 2 – point 3: (3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

Removed:Article 2 – paragraph 2 – point 1 f (new): (1f) ‘internal deliberations’ means any preliminary view, opinion, comment or exchange within or between the supervisory authorities or the Board, such as the summary of key issues, comments on the summary of key issues, draft decisions or relevant and reasoned objections under Article 60(3) to (5) of Regulation (EU) 2016/679;

Added:Article 2 – paragraph 2 – point 4 a (new): (4a) ‘confidential version of a document’ means a document containing confidential or sensitive information which may be subject to legal privilege under the applicable Union or national law and data protection rules;

Removed:Article 2 – paragraph 2 – point 1 g (new): (1g) ‘joint case file’ means a dedicated electronic file for any given case, managed by the lead supervisory authority, in which all documents, submissions, memos and other information regarding a case are stored and made remotely accessible to supervisory authorities and parties to the case;

Added:Article 2 – paragraph 2 – point 4 b (new): (4b) ‘non-confidential version of a document’ means a version of a document from which confidential or sensitive information has been redacted and which can be provided to the complainant without breaching Union or national law or data protection rules.

Removed:Section 2 (new) – Article 2 a (new): Section 2 / Procedural Rules / Article 2a / Applicable Procedural Law / (1) In addition to, and where not conflicting with this Regulation, the applicable procedural law of a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. When applying national procedural law, supervisory authorities shall strive to facilitate the participation of all parties, including parties established or residing in other Member States. / (2) Regulation (EU) 2016/679 and this Regulation govern the interaction between supervisory authorities of different Member States within the scope of this Regulation. / (3) Any complainant has the right to communicate solely with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679. / (4) The interaction and sharing of information between supervisory authorities as well as between supervisory authorities and the Board shall be neither restricted nor prohibited under national law. Cooperation under this Regulation and Regulation (EU) 2016/679 and the consistent application of those regulations shall not be limited, delayed or denied based on differences in national procedural laws.

Added:Section 1 b (new) – title: Section 1b / Procedural rules

Removed:Article 2 b – title (new): Article 2b / Procedural Minimum Standards

Added:Article 2 a (new): Article 2a / Applicable Procedural Law / 1. In addition to this Regulation, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. This Regulation shall not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679. / 2. This Regulation and Regulation (EU) 2016/679 and govern the interaction between supervisory authorities of different Member States that falls within the scope of this Regulation. / 3. A complainant shall have the right to communicate exclusively with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679.

Removed:Following from Article 6 ECHR and Article 41 CFR, as confirmed by CJEU in Case C-277/11.

Added:Article 2 b (new): Article 2b / Common procedural standards / 1. Without prejudice to additional rights under national procedural law, each party shall have at least the following rights: / (a) to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure”); / (b) to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“right to be heard”); / (c) to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“procedural transparency”). / 2. The lead supervisory authority shall inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority. / 3. The joint case file shall include all evidence, inculpatory and exculpatory, including documents and other evidence provided by the parties under investigation. / 4. On the request of a party to protect their legally recognised rights or to protect the rights of others, or when it is in the public interest or in order to protect operational security and cybersecurity a supervisory authority may limit the rights referred to in paragraph 1, point (c). Any such limitation shall be carried out in acc…

Removed:Article 2 b – paragraph 1 (new): (1) Without prejudice to additional rights under relevant national procedural law, each party shall have at least the right to: / (a) have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure and equality of arms”); / (b) be heard before any measure is taken that would adversely affect the party, including before the decision to fully or partially dismiss or reject a complaint is adopted (“right to be heard”); / (c) have access to the joint case file, except to any internal deliberations (“procedural transparency”);

Added:Article 2 c (new): Article 2c / Cooperation between supervisory authorities / 1. The lead supervisory authority shall structure, coordinate and manage the case in an efficient and expedient way, in accordance with Regulation (EU) 2016/679, this Regulation and any applicable national procedural law. / 2. Any supervisory authority may declare that it is concerned, setting out the reasons why it meets the definition of a supervisory authority concerned under Article 4(22) of Regulation (EU) 2016/679. The lead supervisory authority shall maintain a list of supervisory authorities concerned for each case in the joint case file. / Where the lead supervisory authority considers that a supervisory authority which has made a declaration that it is concerned according to this paragraph does not meet the definition of a supervisory authority concerned, it shall inform that authority of its assessment. The supervisory authority which declared that it is concerned shall within one week of receiving that assessment either withdraw its declaration, or produce a reasoned opinion setting out the reasons why it considers the assessment of the lead supervisory authority to be incorrect. Where the diverging assessments of the lead supervisory authority and the supervisory authority which declared to be concerned cannot be resolved in a different manner, the lead supervisory authority shall request a determination of the Board under Article 26a. / 3. Any supervisory authority concerned which receives relevant infor…

Removed:Article 2 b – paragraph 2 (new): (2) The lead supervisory authority shall hear the parties when novel issues arise during the procedures under Article 60, 65 or 66 of Regulation (EU) 2016/679.

Added:Article 2 d (new): Article 2d / Use of Languages and Translations / 1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation between authorities (“cooperation language”). / 2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts. / 3. The lead supervisory authority shall provide submissions into the joint case file in the original language, and shall provide translations into the cooperation language. / 4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication. / 5. A supervisory authority may provide automated translations, if it finds that the automated translation is not substantially different from the original. / 6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State.

Removed:See Article 18(a)(a). This would ensure that if a CSA brings totally new issues up in a “reasoned objection” the parties are still heard – but only if that is the case, not as a default in all the “normal” cases.

Added:Article 3 – paragraph 1: 1. A complaint subject to this Regulation shall provide the information required in the template, as set out in the Annex. / No additional information shall be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.

Removed:EDPB, para 92

Added:Article 3 – paragraph 1 a (new): 1a. The complainant shall not be required to contact the party under investigation before submitting a complaint. Where the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she shall submit the communication related to that contact pursuant to the Annex.

Removed:Article 2 b – paragraph 3 (new): (3) On the request of a party or in the public interest, a supervisory authority may limit the rights referred to in paragraph 1 and 2 to protect legally recognized rights of others or to protect the public interest. Any such limitation shall be in accordance with the national procedural law applicable under Article 2a(1) to any direct interaction between a supervisory authority and the party receiving limited information. The party claiming confidentiality shall provide a non-confidential version of any information, applying only strictly proportionate measures, such as redacting specific parts of documents. Supervisory authorities involved in a case, as well as other relevant authorities under Article 7(1a), shall always have access to the confidential version of all information, and shall confirm that redactions are strictly proportionate and may otherwise release the information. Supervisory authorities shall immediately inform the parties about the fact that information is withheld. The lead supervisory authority shall keep records of each access to the joint case file and a list of authorised staff from each supervisory authority.

Added:Article 3 – paragraph 1 b (new): 1b. The supervisory authority with which a complaint has been lodged shall, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

Removed:“... national procedural law” In line with wording suggestion from EDPB. “always have access to the confidential version” from EDPB para 68.

Added:Article 3 – paragraph 1 c (new): 1c. The supervisory authority shall attribute a case number to the complaint and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c), point (i).

Removed:Article 2 b – paragraph 4 (new): (4) In the interest of efficient procedures, supervisory authorities shall limit the length of submissions and set reasonable deadlines not longer than four weeks, unless exceptional circumstances require a reasonable extension..

Added:Article 3 – paragraph 2: 2. The supervisory authority with which the complaint has been lodged shall, within three weeks after acknowledging the admissibility of the complaint pursuant to paragraph 1b:

Removed:Especially large law firms of big tech companies try to “bury” cases in endless submissions that neither SAs nor the other parties are able to process. The Regulation should follow the approach by the CJEU where page limitations and short deadlines lead to focused submissions.

Added:Article 3 – paragraph 2 – point a (new): (a) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant, considering at least the following: / (i) relevant controller or processor for the processing in question; / (ii) number of establishments of the controller or processor in the EU; / (iii) place of the main establishment; / (iv) activities of establishments in more than one Member State; / (v) substantial effect or likely substantial effect on data subjects in more than one Member State.

Removed:Article 2 c – title (new): Article 2c / Cooperation between supervisory authorities

Added:Article 3 – paragraph 2 – point b (new): (b) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

Change 28

Changed:Article 2 c3 – paragraph 12 – point c (new): 1.(c) Thetake one of the following actions: / (i) transmit the complaint to the assumed lead supervisory authority shallunder structure,Article coordinate56(1) of Regulation (EU) 2016/679 and manageinform the casecomplainant inthereof. anThe efficientassessment andof expedientthe way,admissibility inof accordancethe complaint by the supervisory authority with Regulationwhich (EU)the 2016/679,complaint thishas Regulationbeen andlodged anyshall applicablebe nationalbinding proceduralon law,the ensuringlead thatsupervisory Regulationauthority; (EU)or 2016/679/ is(ii) fullyhandle enforced.the complaint under Article 56(2) of Regulation (EU) 2016/679.

Change 29

Changed:Article 2 c3 – paragraph 2 a (new): 2.2a. The lead supervisory authority shall manage each caseimmediately inprovide fullthe cooperationcomplaint withto the supervisoryparty authoritiesunder concerned,investigation and shall complyrequest witha anyreply requestwithout ofundue adelay, supervisorybut authorityno underlater thisthan Regulationthree andweeks Articlesfrom 60the today 62the ofparty Regulationunder (EU)investigation 2016/679.was Anyinformed supervisoryby authoritythe maylead declaresupervisory thatauthority. itIn iscomplex concernedcases, and participate in thewhere caserequested fromand thatduly pointjustified onwards..by Thethe leadparty supervisoryunder authorityinvestigation, shallthe maintaintime afor listreplying ofcan supervisorybe authoritiesextended concernedby forthe eachlead casesupervisory inauthority theby jointanother casethree file.weeks.

Change 30

Changed:Article 2 c3 – paragraph 32 b (new): 3.2b. AnyThe supervisoryparties authorityor whichthe receivesassumed relevantlead informationsupervisory forauthority ashall caseraise shallany provideobjection itin relation to the competence of the assumed lead supervisory authority withoutor delay,to butthe nohandling laterof thana onecomplaint weekunder Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the dayaction thattaken itpursuant receivedto suchArticle information.3(2), point (c).

Change 31

Removed:Article 2 c – paragraph 4 (new): 4. The lead supervisory authority may join and separate cases in accordance with national procedural law, insofar as this does not undermine the rights of the parties.

Added:Article 3 – paragraph 2 c (new): 2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were taken, or where differing assessments of the supervisory authorities involved cannot be resolved otherwise, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a. It shall provide the Board with a description of relevant processing activities, of the company's organisation and a description of where decisions are taken.

Removed:Generally recognizing this option would ensures legal certainty, especially in Member States where there is no procedural law.

Removed:EDPB, para 50.

Removed:Article 2 c – paragraph 5 (new): 5. The lead supervisory authority shall include all documents, submissions, memos and other information regarding the case in a joint case file without delay, but no later than one week from the day in which the lead supervisory authority received such information. Any other supervisory authority and the Board shall have instant remote access to the joint case file.

Removed:Article 2 c – paragraph 6 (new): 6. When diverging views arise or are to be expected, for example when a case is considered as contentious under Article 9, the lead supervisory authority shall instantly initiate an exchange with all concerned supervisory authorities with an aim to reach an early consensus or narrow areas of disagreement. The lead supervisory authority shall investigate facts relevant for diverging views.

Removed:Article 2 c – paragraph 7 (new): 7. Supervisory authorities shall use their powers under this Regulation and under Chapter VII of Regulation (EU) 2016/679 if diverging views cannot be overcome or in the case of inactivity of another supervisory authority.

Removed:Active duty to take action under Articles 60 to 66 GDPR when another SA does not fulfill its duties for cooperation. Otherwise parties are left in limbo.

Removed:EDPB, para 120.

Removed:Article 2 c – paragraph 8 (new): 8. All written documents by the supervisory authorities shall be provided by electronic means and in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Removed:The principle to use short, concise, transparent (…) documents is taken from various duties for CSAs in the proposal and elevated to a general principle (also applicable to the LSA). Text is taken from Article 12 GDPR

Removed:Article 2 d – title (new): Article 2d / Use of Languages and Translations

Removed:Amended version of Article 6 moved here, to ensure that the rules on translations apply to any type of procedure, not only to complaints procedures.

Removed:Article 2 d – paragraph 1 (new): 1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation procedure (“cooperation language”) .

Removed:Article 2 d – paragraph 2 (new): 2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts.

Removed:The “any other language” ensures that information is shared as soon as it is available. The information would still have to be translated into the cooperation language, once it goes into the joint case file.

Removed:Article 2 d – paragraph 3 (new): 3. The lead supervisory authority shall provide entries into the joint case file in the original language, and shall provide translations into the cooperation language.

Removed:Article 2 d – paragraph 4 (new): 4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication.

Removed:See same rule in Article 12 of Regulation 2020/1784, Service of Documents Regulation.

Removed:Article 2 d – paragraph 5 (new): 5. A supervisory authority may provide automated translations, if they certify that the translation is not substantially different from the original.

Removed:The existing practice of automated translations should be regulated, by demanding a certification that the contents are (at the core) correct.