What changed between the draft committee report and the plenary report

Change 54

Changed:Article 10 – paragraph 2:1 – point c: deleted

Change 55

Removed:Covered by horizontal provisions in new Article 2c now.

Added:Article 10 – paragraph 1 – point c a (new): (ca) preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

Removed:Article 10 – paragraph 4: 4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), the lead supervisory authority or a concerned supervisory authority may request a procedural determination pursuant to Article 26a(1).

Added:Article 10 – paragraph 3: 3. In cases not falling under Article 9(6) of this Regulation, the lead supervisory authority shall investigate facts relevant for diverging views and engage, making its best effort, with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings.

Removed:Article 10 – paragraph 5 – introductory part: 5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the supervisory authority shall provide all of the following:

Added:Article 10 – paragraph 4: 4. Where within four weeks after the expiry of the deadlines for comments, the procedure provided for in paragraph 3 of this Article fails to generate consensus between the lead supervisory authority and one or more supervisory authorities concerned on the matters referred to in Article 9(2), the lead supervisory authority or a supervisory authority concerned shall request a procedural determination of the Board under Article 26a of this Regulation.

Removed:Article 10 – paragraph 5 – point a: (a) the relevant information referred to in Article 9(2);

Added:Article 10 – paragraph 5 – introductory part: 5. When requesting a procedural determination of the Board pursuant to paragraph 4 of this Article, the requesting supervisory authority shall provide all of the following:

Change 56

Changed:Article 10 – paragraph 5 – point b: (b) the comments of the supervisory authority concerned that disagreesa: with(a) the leadrelevant supervisoryinformation authority’sreferred preliminaryto identificationin ofArticle the9(2), matterincluding referredany toupdates inwhen Articlethey 9(2).occur;

Change 57

Removed:Article 10 – paragraph 6: 6. The Board shall adopt an urgent binding decision on the summary of key issues, in accordance with Article 66(3) of Regulation (EU) 2016/679, on the basis of all documents received.

Added:Article 10 – paragraph 5 – point b: (b) the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation or the factual or legal assessment of the elements of the summary of key issues referred to in Article 9(2);

Removed:Wording suggestion from EDPB.

Added:Article 10 – paragraph 5 – point b a (new): (ba) access to the joint case file.

Removed:Chapter III – Section 2: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added:Article 10 – paragraph 5 a (new): 5a. The Board may request the supervisory authorities to provide other documents or information, as it deems appropriate in the particular case.

Removed:Covered by Article 14 now.

Added:Article 10 – paragraph 6: 6. The Board shall adopt an urgent binding decision on the summary of key issues or on extending the period referred to in paragraph 4, in accordance with Article 26a, on the basis of all documents received.

Added:Article 10 a (new): Article 10a / Cooperation with other relevant authorities / Supervisory authorities shall strive to communicate non-personal information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in data protection and other areas, including competition, financial services, energy, telecommunications, consumer protection, digital services, or artificial intelligence supervisory authorities, where the information is deemed relevant to the tasks and duties of those authorities, in particular for opening administrative procedures and investigations into possible violations of legislation under their competences. Information can be only used for the purposes of which it was gathered. However, that does not preclude the supervisory authority to initiate other proceedings based on that information or to share it with other authorities for that purpose.

Added:Article 11: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added:Article 12: deleted / (deleted) / (deleted) / (deleted)

Article 13: deleted / (deleted) / (deleted)

Change 58

Removed:Moved to Article 16(1)(f) to horizontally ensure that all parties are informed about judicial remedy options.

Added:Chapter III – Section 3 – title: Decisions addressed to parties under investigation

Removed:Section 3 – title: Decisions addressed to parties under investigation

Added:Article 14 – title: Preliminary findings and the right to be heard

Removed:Wording suggestion from EDPB.

Added:Article 14 – paragraph 1: 1. Following the consultations and procedures under Articles 9 and 10 of this Regulation, when the lead supervisory authority intends to submit a draft decision Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

Change 59

Changed:Article 14 – paragraph 2 – subparagraph 1: 1.The Followingpreliminary thefindings consultationsshall present allegations raised in an exhaustive and proceduressufficiently clear way to enable the parties under Articlesinvestigation 9to andtake 10cognisance of thisthe Regulation,conduct wheninvestigated by the lead supervisory authorityauthority. intendsIn toparticular, submitthey ashall draftset decisionout withinclearly all the meaningfacts, ofincluding Articlelisting 60(3)all ofthe Regulationevidence (EU)relied 2016/679upon, toand the otherentire legal assessment raised against the parties under investigation, so that they are heard and can express their views on the facts and the legal conclusions the lead supervisory authoritiesauthority concernedintends findingto andraw infringementin the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, itand shalllist draftall preliminarythe findings.evidence it relies upon.

Change 60

Removed:Wording suggestion from EDPB.

Removed:Article 14 – paragraph 2 – subparagraph 1: The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Removed:EDPB para 135

Article 14 – paragraph 2 – subparagraph 2: The preliminary findings shall indicate the corrective measures that are considered by the lead supervisory authority.

Change 61

Removed:EDPB para 135

Added:Article 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

Removed:Article 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements of facts and law, which are known to it, and on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account..

Added:Article 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation that may be subject to the exercise of a corrective power, as well as to the supervisory authority with which the complaint was lodged and the supervisory authorities concerned. The supervisory authority with which the complaint was lodged shall notify preliminary findings to the complainant.

Removed:EDPB para 135

Removed:Article 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties.

Article 14 – paragraph 4: deleted

Change 62

Removed:Replaced by horizontal rule in Article 2b(4).

Article 14 – paragraph 5: deleted

Change 63

Removed:Replaced by horizontal rule in Article 2b(1)(c).

Added:Article 14 – paragraph 6: 6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Removed:Article 14 – paragraph 6: 6. The parties may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Article 15: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Change 64

Removed:Now covered by Article 14, which in amended form requires preliminary findings to be sent to all parties of a case, including complainants.

Added:Article 16 – title: Submission of draft decisions, revised draft decisions and adoption of final decision

Change 65

Changed:Article 16 – paragraph 1: After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation 2016/679, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Change 66

Removed:Four weeks from Article 60(4) and (5) GDPR

Added:Article 16 – paragraph 1 a (new): 1a. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intends to follow that objection, the lead supervisory authority shall, within four weeks, submit a revised draft decision pursuant to Article 60(5) of that Regulation.

Change 67

Changed:Article 16 – paragraph 1 ab (new): 1b. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intendsdoes tonot follow the relevant and reasoned objection or is of the opinion that objection,the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit athe revisedmatter draftto decisionthe pursuantconsistency mechanism referred to in Article 60(5)63, in accordance with Article 60(4) of that Regulation.

Change 68

Removed:Article 16 – paragraph 1 b (new): Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit the matter to the consistency mechanism referred to in Article 63, in accordance with Article 60(4) of that Regulation.

Added:Article 16 – paragraph 1 c (new): 1c. Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

Removed:Article 16 – paragraph 1 c (new): Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing of the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

Added:Article 16 – paragraph 1 d (new): 1d. In the event where the legally binding decision is to be issued by the supervisory authority with which the complaint has been lodged in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the lead supervisory authority shall ensure that the decision contains all elements necessary under the applicable national procedural law of the supervisory authority concerned. The supervisory authority concerned with which the complaint has been lodged shall assist the lead supervisory authority in drafting the decision in such a manner.

Removed:Point (f) moved here from Article 13. This information should be available to all parties.

Added:Article 16 – paragraph 1 e (new): 1e. Any draft decision or final decision shall only rely on factual findings made on the basis of documents or other evidence, on which the parties under investigation had the opportunity to make their views known.

Change 69

Changed:Article 16 – paragraph 1 df (new): In a case where the legally1f. bindingThe decisioninformation isprovided to be issued by the supervisory authority with which the complaint has been lodged in accordanceparties withunder Article 60(8)60(7) orto (9) of Regulation (EU) 2016/679, the lead supervisory authority2016/679 shall ensure that the decision contains all elements necessary under the applicable nationalinclude procedurala lawcopy of the concerned supervisory authority. The concerned supervisory authority with which the complaintlegally hasbinding beendecision, lodgedand shallinformation assistabout thea leadjudicial supervisoryremedy authorityavailable in draftingaccordance thewith decisionArticle in78 suchof aRegulation manner.(EU) 2016/679.

Change 70

Removed:Article 16 – paragraph 1 e (new): The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision.