What changed between the draft committee report and the plenary report

Removed:Article 2 d – paragraph 6 (new): 6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State of jurisdiction.

Removed:Chapter II – title: Complaints and ex officio procedures

Removed:Article 3 – paragraph 1: 1. A complaint that is potentially subject to Article 60 of Regulation (EU) 2016/679 shall comply with the requirements of national procedural law applicable to the supervisory authority with which the complaint has been lodged and shall provide the following minimum information: / (a) the name, address and any other available contact details of the complainant, / (b) if known, the name, address and any other contact details of the party under investigation, / (c) the facts of the case and any evidence available to the complainant, / (d) the measures that the complainant demands from the supervisory authority. / No additional information shall be required in order for the complaint to be admissible. In particular, complainants shall not be required to use a national electronic ID or e-government system to submit the complaint.

Removed:Instead of a mandatory form, there should be minimum requirements to ensure that the complaint can be processed by the LSA. We recognize possible additional requirements under national law and the fact that in some cases, a data subject may not know or understand all details of a case. EDPB, para 23. Complainants shall not be required to use a national electronic ID to prevent the undue restriction of the manner in which to submit a complaint in cases where the data subject may not be aware whether the case relates to cross-border processing, and to align the Reg. with recital 141 GDPR.

Removed:Article 3 – paragraph 1 a (new): 1a. The complainant shall not be required to contact the party under investigation before submitting a complaint for the complaint to be admissible.

Removed:To prevent the undue rejection of complaints as observed in the practice of various DPAs.

Removed:Article 3 – paragraph 1 b (new): 1b. The supervisory authority with which a complaint has been lodged shall, within one week, acknowledge receipt of the complaint, and where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

Removed:Moved up from paragraph 6, to follow the sequence of events.

Removed:Article 3 – paragraph 1 c (new): 1c. The supervisory authority shall attribute a case number to the complaint, designate a case handler and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c)(i).

Removed:To facilitate communication between the CSA with which the complaint is lodged and the complainant.

Removed:Article 3 – paragraph 2: 2. The supervisory authority with which the complaint has been lodged shall, within three weeks after receipt of the complaint:

Removed:Combining the steps in paragraphs 2 to 4 into one paragraph to ensure that all steps are under the three week deadline. The three weeks is parallel to Article 56(3) GDPR, and has been moved here from the end of the paragraph, to make clear everything shall be done within three weeks.. Additional wording from EDPB suggestions.

Removed:Article 3 – paragraph 2 – point a (new): (a) determine the admissibility of the complaint,

Removed:Article 3 – paragraph 2 – point b (new): (b) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing,

Removed:Article 3 – paragraph 2 – point c (new): (c) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

Removed:Article 3 – paragraph 2 – point d (new): (d) draft a summary of key issues, and

Removed:Article 3 – paragraph 2 – point e (new): (e) either

Removed:Article 3 – paragraph 2 – point e – point i (new): (i) transmit the complaint to the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679 and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority;

Removed:To provide clarification on the mutual recognition of complaints. EDPB, para 24.

Removed:Article 3 – paragraph 2 – point e – point ii (new): (ii) handle the complaint under Article 56(2) of Regulation (EU) 2016/679; or

Removed:Article 3 – paragraph 2 – point e – point iii (new): (iii) inform the complainant that he or she can resubmit the complaint, naming any missing information.

Removed:Article 3 – paragraph 2 a (new): 2a. The lead supervisory authority shall immediately provide the complaint to the party under investigation and demand a reply without undue delay, but no later than three weeks from the day it was informed by the supervisory authority concerned.

Removed:Article 3 – paragraph 2 b (new): 2b. The parties or the assumed lead supervisory authority shall raise any objection in relation to the competence of the assumed lead supervisory authority or to the handling of a complaint under Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the transmission of the complaint to the assumed lead supervisory authority or the lack of such a transmission.

Removed:Article 3 – paragraph 2 c (new): 2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were undertaken, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a.

Removed:Related to Article 26a

Article 3 – paragraph 3: deleted

Change 32

Removed:Merged into paragraph 2.

Article 3 – paragraph 4: deleted

Change 33

Removed:Merged into paragraph 2.

Article 3 – paragraph 5: deleted

Change 34

Removed:Covered by new horizontal rule on confidentiality in Article 2b(3).

Article 3 – paragraph 6: deleted

Change 35

Removed:Moved up to paragraph 1a, to follow the chronological order of events.

Added:Chapter II – title: II Complaints and ex officio procedures

Added:(Heading “Chapter II” is placed after article 3 and its title is changed)

Article 4 – title: Handling of complaints

Change 36

Changed:Article 4 – paragraph 1 – introductory part: 1. While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall endeavour to ensure the following:

Article 4 – paragraph 1 – point a: (a) the delivery of an effective and timely remedy to the complainant;

Change 37

Changed:Article 4 – paragraph 1 – point b: (b) the investigation of allrelevant factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7)60(7), to(8) and (9) of Regulation (EU) 2016/679;

Change 38

Changed:Article 4 – paragraph 1 – point c: (c) the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemicsystemic, grave or repetitive infringements.

Change 39

Changed:Article 4 – paragraph 1 a (new): 1a. The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Change 40

Removed:Each complaint must lead to an appealable decision. This will prevent situations where complaints are “closed” without an appealable decision. “Handling of complaints” is from Article 78(2) GDPR and ensures deadlines are met. EDPB, para 29.

Added:Article 4 – paragraph 1 b (new): 1b. The lead supervisory authority shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, and no later than nine months from the receipt of the complaint. / This deadline may exceptionally be extended by: / (a) eight weeks when comments under Article 9(3) are submitted with regard to a summary of key issues or an updated summary of key issues; / (b) eight weeks where the lead supervisory authority intends to issue fines or other penalties; / (c) the period of time between a reference under Article 26a(1) or (2) and the decision by the Board; / (d) the period of any prolongation permitted by the Board under Article 26a(3). / Each extension under points (a) to (d) may only be done once.

Change 41

Changed:Article 4 – paragraph 1 b – introductory partc (new): The lead1c. supervisoryParagraph authority1b shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay,not butapply notonce latera thancase nineis monthssubmitted fromto the receipt ofconsistency themechanism complaint.in /accordance Thiswith periodArticle may60(4) exceptionallyof beRegulation prolonged(EU) by:2016/679.

Change 42

Removed:Article 4 – paragraph 1 b – point a (new): (a) eight weeks when comments under Article 9(3) are submitted against a summary of key issues or an updated summary of key issues;

Added:Article 5 – paragraph 1: 1. A complaint may be resolved by amicable settlement between the complainant and the party under investigation at any stage of the proceedings. The complaint-receiving or the lead supervisory authority may encourage and facilitate that voluntary process.

Removed:Article 4 – paragraph 1 b – point b (new): (b) the period of time between a reference under Article 26a and the decision by the Board;

Added:Article 5 – paragraph 1 a (new): 1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. Where an amicable settlement to the complaint has been found, the parties shall within one month communicate the settlement to the lead supervisory authority and the supervisory authority where the complaint has been lodged.

Removed:Linked to Article 26a.

Added:Article 5 – paragraph 1 b (new): 1b. Within one month after the communication of the amicable settlement under paragraph 1a, a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679 shall be submitted, indicating: / (a) whether the conditions of an amicable settlement under paragraph 1a are fulfilled, and / (b) whether to open an ex officio investigation under paragraph 1d.

Removed:Article 4 – paragraph 1 b – point c (new): (c) the period of any prolongation permitted by the Board under Article 26a(3).

Added:Article 5 – paragraph 1 c (new): 1c. Where, within one month, none of the other supervisory authorities concerned have objected to the draft decision under paragraph 1b or the Board confirms the amicable settlement in the procedure under Article 65(1), point (a) of Regulation (EU) 2016/679, the complaint shall be deemed withdrawn and the settlement shall become valid.

Removed:Linked to Article 26a.

Added:Article 5 – paragraph 1 d (new): 1d. An amicable settlement does not prevent the lead supervisory authority from conducting an ex officio investigation in the same matter. It may open an ex officio investigation instead, in particular where: / (a) the party under investigation is a repeat offender; / (b) the party under investigation has been the subject of a large number of other amicable settlements; / (c) the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, is of long duration, or is of serious nature; or / (d) the exercise of powers is otherwise required to ensure effective, proportionate and dissuasive enforcement of Regulation (EU) 2016/679.

Removed:Article 4 – paragraph 1 c (new): Paragraph 1b shall not apply once a case is submitted to the consistency mechanism in accordance with Article 60(4) of Regulation (EU) 2016/679.

Added:Article 5 a (new): Article 5a / Request for an ex officio procedure / 1. Where it considers that Regulation (EU) 2016/679 may be violated and data subjects in the territory of its Member State are affected, any supervisory authority concerned may request an ex officio procedure by submitting a written request for a discretionary action pursuant to paragraph 2 to the lead supervisory authority. Such a request shall contain at least: / (a) a declaration to be a supervisory authority concerned, and / (b) a summary of key issues pursuant to Article 9. / 2. Within three weeks, the assumed lead supervisory authority shall: / (a) inform the supervisory authority concerned that it has opened an ex officio procedure; / (b) inform the supervisory authority concerned that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself; or / (c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no prima facie violation of Regulation (EU) 2016/679. / In the case referred to in point (a) of this paragraph, the supervisory authority concerned may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679. / In the cases referred to in point (b) and (c) of this paragraph, the supervisory authority concerned may resubmit an amended request for an ex officio procedure, or r…

Removed:Article 5 – paragraph 1: 1. A complaint may be resolved by amicable settlement only where it concerns the data subjects’ rights and where with the resolution of the dispute by an amicable settlement, the processing which the complaint related to is no longer taking place.

Removed:EDPB para 32. See also EDPB Guidelines 06/2022 on amicable settlements.

Removed:Article 5 – paragraph 1 a (new): 1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. The supervisory authority with which the complaint has been lodged may facilitate such an amicable settlement in the preparatory phase; the lead supervisory authority may facilitate it once a complaint has been transmitted to it. Where an amicable settlement to the complaint has been found, the parties shall communicate the settlement to the supervisory authority, and the complaint shall be deemed withdrawn.

Removed:EDPB para 33, clarification which SA is in charge when. Joint communication by the parties ensures it is the free will of the complainant.