What changed between the draft committee report and the plenary report

Removed:Article 24 a (new): Article 24a / Request for information by the Board / 1. In cases in which the Board is otherwise unable to determine the matter, it may request further information from the parties or supervisory authorities, or it may conduct further factual investigations. / 2. The deadlines in Article 65(2) of Regulation (EU) 2016/679 are extended for the duration of the procedure under paragraph 1, but no more than one month.

Removed:Proposal from EDPS to replace the cumbersome procedure in Article 24.

Article 25: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Change 85

Removed:Duplication with Article 22(2).

Added:Article 26 – paragraph 1 – point c: (c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an explanation of which points were not followed and a reference to the relevant part of the adopted decision.

Removed:Article 26: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Added:Article 26 – paragraph 1 a (new): 1a. The Chair of the Board shall inform all supervisory authorities of the referral made to the Board under paragraph 1, so as to allow the supervisory authorities to make their views known.

Removed:Duplication with Article 22(2).

Added:Article 26 – paragraph 3: 3. The Chair of the Board shall register the referral no later than one week after having received all of the documents referred to in paragraphs 1 and 2.

Change 86

Changed:Article 26 a (new): Article 26aArticle26a / Procedural determinations by the Board / 1. Without prejudicePursuant to Articles 65 andArticle 66 of Regulation (EU) 2016/679, a supervisory authoritiesauthority may request from the Board to make a procedural determination on any dispute arising during a cooperation procedure,take includingan whetherurgent abinding casedecision meetsin the requirements of Article 56form of Regulation (EU) 2016/679. / 2. Parties to the procedure may request from the Board to make a determination when no supervisory authority considers itself competent to handle a complaint underprocedural Articledetermination 55on orany 56procedural ofdispute Regulationarising (EU)between 2016/679supervisory orauthorities in exceptional cases when a case can otherwise not progress, because a supervisory authority manifestly violates its duties under Regulation (EU) 2016/679foreseen orby this Regulation. / 3.2. Where the lead supervisory authority is of the view that it cannot possibly comply with thea deadline frompursuant to Article 4(1b),4(1b) or Article 5a(3), especially because of the need for exceptionally complex factual investigations, it shall request from the Board aan prolongationurgent ofbinding updecision pursuant to twelveparagraph months.1, Theregarding supervisoryan authorityextension shallof submitthe adeadline detailedof planup ofto thenine investigationmore thatmonths. demonstratesThe supervisory authority shall demonstrate that despite its compliance with Article 2c(1)2c(1), the prolongationextension sought is strictly necessary.inevitable. / 4.3. Requests under paragraph 21 and 32 shall beat broughtleast withincontain: two/ weeks(a) fromthe facts relied upon and any evidence available to the deliveryauthority ofor party; / (b) the procedurallegal grounds for the request; / (c) the determination pursuant to paragraph 1 or athe rejectiondeadline byextension apursuant supervisoryto paragraph 2 that the authority andor mustparty atrequests leastfrom contain:the Board; / (a)4. theWithin factstwo reliedweeks, uponthe andBoard anyshall evidencedetermine availablethe tomatter based on the authorityinformation before it or party;it /shall (b)reject the leg…application. Determinations are binding on the supervisory authorities.

Change 87

Removed:To avoid “deadlocked” cases, e.g. where SAs can’t agree on who is lead authority, etc. EDPS paras 108-111.

Added:Article 26 b (new): Article 26b / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80 of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) if it considers that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing. / 3. Where a court or tribunal exercising the review pursuant to paragraph 1 finds that a supervisory authority has not fulfilled its duties, it shall have the power to order that supervisory authority to take the necessary action.

Removed:Article 26 b (new): Article 26b / Select Committees / 1. The Board may appoint one or more select committees of three or more members, who can be part of the supervisory authorities or of the secretariat under Article 75 of Regulation (EU) 2016/679. The mandate of each of the committees is determined by the Board. Select committee Members perform their tasks under the instructions of the Board and may only be discharged by the Board. / 2. In its rules of procedure, the Board may designate any tasks, such as determinations under Article 26a, or other tasks aimed at ensuring harmonised implementation of Regulation (EU) 2016/679 and this Regulation by the supervisory authorities, to the select committees and specify the procedures of the select committees further. Each of the committees shall present their findings to the Board.

Added:Article 27 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Removed:To avoid overloading the whole Board with little cases, e.g. missing documents etc.

Removed:Article 26 c (new): Article 26c / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80(1) of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) independently of an infringement of the rights of a data subject.

Removed:To prevent cases from being dead-locked when a supervisory authority simply does not act.

Removed:Article 27 – paragraph 1 – introductory part: 1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679 and shall contain all of the following items:

Removed:To allow for more time for the EDPB, see EDPB paras 124-125

Article 27 – paragraph 1 – point b: (b) a description of the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the opinion, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

Change 88

Removed:Aligned with Article 28, see EDPB para 118.

Added:Article 27 – paragraph 1 – point c: (c) a justification of the urgent need for final measures, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

Change 89

Changed:Article 27 – paragraph 1 – point c: (c)c a justification of the urgent need for final measures(new): to(ca) bewhere adopted,the includingrequesting anauthority explanationis ofnot the exceptional nature oflead circumstancessupervisory requiringauthority, the adoptionviews of the measureslead concerned.supervisory authority.

Change 90

Removed:In cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.

Added:Article 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the authorities to maintain or amend provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

Removed:Article 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities.

Removed:In cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.“all supervisory authorities ” as in EDPB para 121, because EDPB opinions have general applicability. EDPB para 119.

Article 28 – title: Urgent binding decisions under Article 66(2) of Regulation (EU) 2016/679

Change 91

Removed:Aligned with wording of Article 66(2) GDPR.

Article 28 – paragraph 1 – introductory part: 1. A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

Change 92

Removed:“binding” aligned with wording of Article 66(2) GDPR.

Added:Article 28 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Article 28 – paragraph 1 – point b: (b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting it, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

Change 93

Removed:Aligned with Article 27, see EDPB para 118.

Article 28 – paragraph 1 – point c: (c) information on any investigatory measures taken on its own territory and replies received from the parties under investigation or any other information in the possession of the requesting supervisory authority;

Change 94

Removed:EDPB para 122

Added:Article 28 – paragraph 1 – point d: (d) a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to provide the information requested under Article 61(5) of Regulation (EU) 2016/679 or failed to respond to a request pursuant to Article 61(8) or 62(2) of Regulation (EU) 2016/679;

Change 95

Changed:Article 28 – paragraph 1 – point d: (d)f: a(f) justificationwhere ofavailable, the urgent needviews forof finalthe measuresparties. toIn becase adoptedthe onrequesting theauthority territoryis ofnot the requestinglead supervisory authority, bearing in mind the exceptional nature of circumstances requiringrequesting theauthority adoptionshall ofgrant the final measure, or proof that aright supervisoryto authoritybe failedheard to provide the information requestedparties under Article 61(5) ofinvestigation Regulationagainst (EU)which 2016/679provisional ormeasures failedwere totaken respondpursuant to a request under Article 62(2)66(1) of Regulation (EU) 2016/679;2016/679.

Change 96

Removed:Wording suggestion by EDPB.

Added:Article 28 – paragraph 2: 2. The urgent binding decision referred to in paragraph 1 shall be addressed to the lead supervisory authority and all the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

Removed:Article 28 – paragraph 1 – point f: (f) where applicable, the views of the parties.

Added:Article 28 – paragraph 3: 3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority or authorities to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

Removed:Where applicable, all parties, including complainants, should be heard. EDPB para 128.

Added:Article 28 – paragraph 4: 4. A supervisory authority that is responsible to adopt final measures shall notify its decision on the final measures to the parties under investigation and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the parties under investigation against which the provisional measures were adopted about the Board’s decision and the final measures adopted by the lead supervisory authority. The complaint-receiving supervisory authority shall inform the complainant about the Board’s decision and the final measures adopted by the lead supervisory authority.

Removed:Article 28 – paragraph 2: 2. The urgent binding decision referred to in paragraph 1 shall be addressed to the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

Added:Article 28 a (new): Article 28a / Remedies against procedural determinations / Remedies against procedural determinations by a supervisory authority under national law shall only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.

Removed:“all the supervisory authorities concerned” as in EDPB para 121, so it applies everywhere where the cross-border processing takes place.

Added:Article 28 b (new): Article28b / Enforcement Statistics / Supervisory authorities shall report the following numbers in their activity report under Article 59 of Regulation (EU) 2016/679: / (a) the number of ex officio investigations initiated by the supervisory authority; / (b) the number of ex officio investigations initiated by other supervisory authorities; / (c) the number of complaints received, including the number that were rejected, dismissed, withdrawn, partly upheld, fully upheld or otherwise closed; / (d) the number of legally binding decisions currently on appeal; / (e) the number and average duration of open and decided procedures under (a) to (d) to date; / (f) the number of each type of measure taken in accordance with Article 58(2) of Regulation (EU) 2016/679 or applicable national law; / (g) the number and the amount of fines issued and collected under Article 83 and 84 of Regulation (EU) 2016/679 or relevant national law; and / (h) the annual budget and the number of staff, by training, tasks and organizational units. / 2. Supervisory authorities shall publish the activity report for the past year without undue delay, but no later than by 30 June. / 3. The Board shall make the information of all supervisory authorities in paragraph 1 available to the public no later than 31 July of each year for the previous year.

Removed:Article 28 – paragraph 3: 3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the lead supervisory authority shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

Added:(Article 28 b in placed in Chapter VII “General and final provisions”)

Removed:Article 28 – paragraph 4: 4. The supervisory authority that submitted the request referred to in paragraph 1 shall notify its decision on the final measures to the controller or processor and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the lead supervisory authority of the final measure.

Removed:EDPB para 122

Article 29: deleted / (deleted) / (deleted) / (deleted) / (deleted)

Change 97

Removed:EDPB para 191 - Regulation No. 1182/71 applies anyway.

Article 30 – paragraph 1: Chapters I, II and III shall apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation.

Change 98

Removed:Following the introduction of new Articles in Chapters I and II.

Article 30 – paragraph 2: Chapters V and VI shall apply to all cases submitted to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after the entry into force of this Regulation.

Change 99

Added:Article 30 – paragraph 2 a (new): Until ... [six months from the date of application of this Regulation], the lead supervisory authority shall, upon request, provide all documents in its own file to other supervisory authorities by other electronic means.

Article 30 a (new): Article 30a / Evaluation and review / The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.

Change 100

Removed:While additional reports might be excessive, the reports on the GDPR must include an evaluation of the functioning of this Regulation. EDPB para 190.