Changes from report parliamentary committee draft to plenary report

Change 9

RemovedTo avoid “spamming” by large companies who can afford law firms to submit thousands of pages. The rule is similar to the rules of procedure before the CJEU, where submissions are regularly limited to 20 or 30 pages.

AddedRecital 14: (14) Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the draft decision within three months from the receipt of the complaint.

RemovedRecital 14: (14) Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within three months after the deadline for comments.

AddedRecital 15: (15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should raise the matter quickly with the Board. The Board should make the necessary procedural determinations. The Board and supervisory authorities should endeavour to complete ongoing proceedings as quickly as possible. The lead supervisory authority or one of the supervisory authorities concerned should also be able to request an urgent binding decision of the Board without a request under Articles 61 or 62 having been made.

RemovedLinked to Article 9(6).

RemovedRecital 15: (15) Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case, the supervisory authorities should be able to raise the matter quickly with the Board. The Board should be able to make the necessary procedural determinations.

Change 10

RemovedUrgent decisions under Article 66(3) GDPR are limited to inaction of a DPA. Instead, procedural determinations by the Board should be possible for all sorts of procedural disputes. Linked to Recital (15).

AddedRecital 17: (17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, handling of any complaint should always lead to a decision which may be challenged before a national court.

RemovedRecital 17: (17) To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the handling of any complaint should always lead to a decision which may be challenged before a national court.

RemovedTo ensure that cases are not “closed” or “deemed withdrawn” and alike without a clear decision which can be appealed.

Change 11

RemovedThere is a general right to be heard before a decision, which allows to remove the need for “draft” decisions. Article 11 is therefore also deleted. This should limit the need for paperwork through repeated “draft of the draft” procedures.

AddedRecital 19: (19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

RemovedRecital 19: (19) It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint, that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

AddedRecital 21: (21) In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case. Every party shall have the right to decline the right to be heard.

RemovedThe COM proposal would rewrite the GDPR, as the drafting is clearly with the LSA. We suggest to highlight that the CSA with which the complaint was filed must issue the final decision and therefore needs to be involved in the drafting, to ensure that it cannot be easily appealed before a national court.

AddedRecital 22: (22) The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the the right to be heard and opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to effectively comment on matters relevant to the investigation, by receiving access to the administrative joint case file.

Change 12

AddedRecital 25 a (new): (25a) Notwithstanding the fact that the parties under investigation and the complainant are not in the same procedural situation, there are circumstances in which complainants can be in a position to adduce arguments and evidence during an investigation which can help the progress of the investigation. This is particularly the case in circumstances in which a not-for-profit body, organisation or association has lodged a complaint on behalf of a data subject or on its own initiative under Article 80 of Regulation (EU) 2016/679. Supervisory authorities should facilitate the hearing of such complainants at all stages of the investigation, including ex officio investigations, while also maintaining their independence.

Change 13

ChangedRecital 27: (27) When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings,findings as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to unduly long procedures.

Change 14

RemovedUnduly limits the options for concerned supervisory authorities to raise objections. Could be used against CSAs by controllers e.g. filing injunctions against objections.

Change 15

ChangedRecital 30: (30) Access to the joint case file ismay be provided for asin athe partspirit of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties. Access of the parties to the joint case file may be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest. Such limitation must be proportionate in light of the respective recognised rights of others or the public interest pursued.

Change 16

ChangedRecital 31: (31) When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information.information and the protection of information in the public interest in accordance with applicable national law. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.information and provide a non-confidential version.

Change 17

ChangedRecital 33: (33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents,documents the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

Change 18

RemovedOne does not refer to Articles in Recitals, because the Recitals are supposed to lead to the Articles later.

Change 19

RemovedBoard decisions in dispute resolution are binding on the authorities.

Change 20

RemovedEDPB para 120.

AddedRecital 36 a (new): (36a) The Board should be able to request any further information from supervisory authorities necessary for it to take a binding decision.

RemovedRecital 36 a (new): (36a) Where, after its deliberations, the Board is unable to determine the matter, because the joint case file and other information provided by the lead supervisory authority are not complete, the Board should be able to request further information from the parties or supervisory authorities, or conduct further factual investigations.

AddedRecital 36 b (new): (36b) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

RemovedRecital 36 b (new): (36b) The Board should be able to delegate certain tasks to one or more select committees, which can consist of members of the Board or members of the secretariat referred to in Article 75 of Regulation (EU) 2016/679. It should be possible for this delegation to include any task under Article 70 of Regulation (EU) 2016/679, decisions under Article 65 and 66 of Regulation (EU) 2016/679 or functions of the Board under this Regulation, such as routine tasks or decisions that need to be taken without delay, including any procedural determinations.

RemovedLinked to Articles 26a (new), 26b (new).

Change 21

ChangedChapter I – Section 1 a (new): Section 11a / Subject matter, scopescope, and definitions

Change 22

ChangedArticle 1 – paragraph 1: This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities relatedwhenever tosupervisory theauthorities cross-borderof processingmore than one Member State are involved in the meaningcase, ofas Regulationwell (EU)as 2016/679.procedural rules on related judicial remedies.

Change 23

RemovedEDPB wording suggestion – “cross-border enforcement” is not defined in GDPR. EDPB, introduction, p.7.

AddedArticle 1 – paragraph 1 a (new): Article 26b of this Regulation also applies to cases before a supervisory authority of a single Member State, pursuant to Article 56(2) of Regulation (EU) 2016/679.

RemovedArticle 1 – paragraph 1 a (new): This Regulation applies to cases under Regulation (EU) 2016/679 related to such cross-border processing, whenever supervisory authorities of more than one Member State are taking part in the case, as well as related judicial remedies.

AddedArticle 2 – paragraph 2 – point 1: (1) ‘party under investigation’ means the controller(s) and/or processor(s) complained about, or investigated for alleged infringement of Regulation (EU) 2016/679, as well as their representative(s);

RemovedArticle 1 – paragraph 1 b (new): Article 26c of this Regulation also applies to cases before a supervisory authority of a single Member State.

AddedArticle 2 – paragraph 2 – point 1 a (new): (1a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the proceedings;

Change 24

ChangedArticle 2 – paragraph 2 – point 1 ad (new): (1a) ‘complainant’ means the data subject(1d) or‘complaints non-for-profitprocedure’ body,means organisationa orprocedure associationdetermining thatthe hasoutcome lodgedof a complaint under Article 77 of Regulation (EU) 2016/679;

Change 25

RemovedEDPB para 155.

AddedArticle 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1), point (a), of Regulation (EU) 2016/679;

RemovedArticle 2 – paragraph 2 – point 1 b (new): (1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party to the case where foreseen under Member State law;

AddedArticle 2 – paragraph 2 – point 1 f (new): (1f) ‘joint case file’ means a dedicated electronic file for any case falling under the scope of this Regulation, that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case, are stored and made remotely accessible to supervisory authorities concerned and parties to the case;

Change 26

ChangedArticle 2 – paragraph 2 – point 1 cg (new): (1c) ‘national(1g) procedural‘complaint-receiving law’authority’ means the laws orsupervisory otherauthority ruleswith ofwhich the Membercomplaint Statehas thatbeen regulatelodged theas procedurereferred beforeto ain supervisoryArticle authority;4(22), point (c), of Regulation (EU) 2016/679;

Change 27

RemovedArticle 2 – paragraph 2 – point 1 d (new): (1d) ‘complaints procedure’ means an adversarial procedure determining a complaint under Article 77 of Regulation (EU) 2016/679;

AddedArticle 2 – paragraph 2 – point 2: (2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned, identifying the main relevant factual and legal issues within the preliminary scope of the investigation and the lead supervisory authority’s factual and legal views on the case;

RemovedArticle 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1)(a) of Regulation (EU) 2016/279;

AddedArticle 2 – paragraph 2 – point 3: (3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

RemovedArticle 2 – paragraph 2 – point 1 f (new): (1f) ‘internal deliberations’ means any preliminary view, opinion, comment or exchange within or between the supervisory authorities or the Board, such as the summary of key issues, comments on the summary of key issues, draft decisions or relevant and reasoned objections under Article 60(3) to (5) of Regulation (EU) 2016/679;

AddedArticle 2 – paragraph 2 – point 4 a (new): (4a) ‘confidential version of a document’ means a document containing confidential or sensitive information which may be subject to legal privilege under the applicable Union or national law and data protection rules;

Change 28

ChangedArticle 2 c3 – paragraph 12 – point c (new): 1.(c) Thetake one of the following actions: / (i) transmit the complaint to the assumed lead supervisory authority shallunder structure,Article coordinate56(1) of Regulation (EU) 2016/679 and manageinform the casecomplainant inthereof. anThe efficientassessment andof expedientthe way,admissibility inof accordancethe complaint by the supervisory authority with Regulationwhich (EU)the 2016/679,complaint thishas Regulationbeen andlodged anyshall applicablebe nationalbinding proceduralon law,the ensuringlead thatsupervisory Regulationauthority; (EU)or 2016/679/ is(ii) fullyhandle enforced.the complaint under Article 56(2) of Regulation (EU) 2016/679.

Change 29

ChangedArticle 2 c3 – paragraph 2 a (new): 2.2a. The lead supervisory authority shall manage each caseimmediately inprovide fullthe cooperationcomplaint withto the supervisoryparty authoritiesunder concerned,investigation and shall complyrequest witha anyreply requestwithout ofundue adelay, supervisorybut authorityno underlater thisthan Regulationthree andweeks Articlesfrom 60the today 62the ofparty Regulationunder (EU)investigation 2016/679.was Anyinformed supervisoryby authoritythe maylead declaresupervisory thatauthority. itIn iscomplex concernedcases, and participate in thewhere caserequested fromand thatduly pointjustified onwards..by Thethe leadparty supervisoryunder authorityinvestigation, shallthe maintaintime afor listreplying ofcan supervisorybe authoritiesextended concernedby forthe eachlead casesupervisory inauthority theby jointanother casethree file.weeks.

Change 30

ChangedArticle 2 c3 – paragraph 32 b (new): 3.2b. AnyThe supervisoryparties authorityor whichthe receivesassumed relevantlead informationsupervisory forauthority ashall caseraise shallany provideobjection itin relation to the competence of the assumed lead supervisory authority withoutor delay,to butthe nohandling laterof thana onecomplaint weekunder Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the dayaction thattaken itpursuant receivedto suchArticle information.3(2), point (c).

Change 31

RemovedArticle 2 c – paragraph 4 (new): 4. The lead supervisory authority may join and separate cases in accordance with national procedural law, insofar as this does not undermine the rights of the parties.

AddedArticle 3 – paragraph 2 c (new): 2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were taken, or where differing assessments of the supervisory authorities involved cannot be resolved otherwise, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a. It shall provide the Board with a description of relevant processing activities, of the company's organisation and a description of where decisions are taken.

RemovedGenerally recognizing this option would ensures legal certainty, especially in Member States where there is no procedural law.

RemovedEDPB, para 50.

RemovedArticle 2 c – paragraph 5 (new): 5. The lead supervisory authority shall include all documents, submissions, memos and other information regarding the case in a joint case file without delay, but no later than one week from the day in which the lead supervisory authority received such information. Any other supervisory authority and the Board shall have instant remote access to the joint case file.

RemovedArticle 2 c – paragraph 6 (new): 6. When diverging views arise or are to be expected, for example when a case is considered as contentious under Article 9, the lead supervisory authority shall instantly initiate an exchange with all concerned supervisory authorities with an aim to reach an early consensus or narrow areas of disagreement. The lead supervisory authority shall investigate facts relevant for diverging views.

Change 32

RemovedMerged into paragraph 2.

Change 33

RemovedMerged into paragraph 2.

Change 34

RemovedCovered by new horizontal rule on confidentiality in Article 2b(3).

Change 35

RemovedMoved up to paragraph 1a, to follow the chronological order of events.

AddedChapter II – title: II Complaints and ex officio procedures

Change 36

ChangedArticle 4 – paragraph 1 – introductory part: 1. While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall endeavour to ensure the following:

Change 37

ChangedArticle 4 – paragraph 1 – point b: (b) the investigation of allrelevant factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7)60(7), to(8) and (9) of Regulation (EU) 2016/679;

Change 38

ChangedArticle 4 – paragraph 1 – point c: (c) the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemicsystemic, grave or repetitive infringements.

Change 39

ChangedArticle 4 – paragraph 1 a (new): 1a. The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Change 40

RemovedEach complaint must lead to an appealable decision. This will prevent situations where complaints are “closed” without an appealable decision. “Handling of complaints” is from Article 78(2) GDPR and ensures deadlines are met. EDPB, para 29.

AddedArticle 4 – paragraph 1 b (new): 1b. The lead supervisory authority shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, and no later than nine months from the receipt of the complaint. / This deadline may exceptionally be extended by: / (a) eight weeks when comments under Article 9(3) are submitted with regard to a summary of key issues or an updated summary of key issues; / (b) eight weeks where the lead supervisory authority intends to issue fines or other penalties; / (c) the period of time between a reference under Article 26a(1) or (2) and the decision by the Board; / (d) the period of any prolongation permitted by the Board under Article 26a(3). / Each extension under points (a) to (d) may only be done once.

Change 41

ChangedArticle 4 – paragraph 1 b – introductory partc (new): The lead1c. supervisoryParagraph authority1b shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay,not butapply notonce latera thancase nineis monthssubmitted fromto the receipt ofconsistency themechanism complaint.in /accordance Thiswith periodArticle may60(4) exceptionallyof beRegulation prolonged(EU) by:2016/679.

Change 42

RemovedArticle 4 – paragraph 1 b – point a (new): (a) eight weeks when comments under Article 9(3) are submitted against a summary of key issues or an updated summary of key issues;

AddedArticle 5 – paragraph 1: 1. A complaint may be resolved by amicable settlement between the complainant and the party under investigation at any stage of the proceedings. The complaint-receiving or the lead supervisory authority may encourage and facilitate that voluntary process.

RemovedArticle 4 – paragraph 1 b – point b (new): (b) the period of time between a reference under Article 26a and the decision by the Board;

AddedArticle 5 – paragraph 1 a (new): 1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. Where an amicable settlement to the complaint has been found, the parties shall within one month communicate the settlement to the lead supervisory authority and the supervisory authority where the complaint has been lodged.

RemovedLinked to Article 26a.

AddedArticle 5 – paragraph 1 b (new): 1b. Within one month after the communication of the amicable settlement under paragraph 1a, a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679 shall be submitted, indicating: / (a) whether the conditions of an amicable settlement under paragraph 1a are fulfilled, and / (b) whether to open an ex officio investigation under paragraph 1d.

Change 43

RemovedMoved to Article 2d, as the matter of translations does not only concern complaints procedures but any form of cooperation.

AddedChapter III – title: Cooperation under Article 60 of Regulation (EU) 2016/679 and with other relevant authorities

RemovedArticle 7 – title: Cooperation between supervisory authorities and between supervisory authorities and other relevant authorities

RemovedArticle 7 – paragraph 1 a (new): Supervisory authorities shall strive to communicate the information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in other areas, including competition, financial services, energy, telecommunications and consumer protection authorities, where the information is deemed relevant to the tasks and duties of those authorities.

RemovedRecognising that investigation on infringements in the area of data protection might provide evidence on infringements in other areas. This is a demand from many civil society organisations.

Change 44

RemovedIf the parties cannot bring a claim in national courts over the lack of cooperation, this would in many cases make Article 78 GDPR inefficient if the “problem” for a missing decision lies in the lack of cooperation and cannot be tackled by the parties. EDPB, para 29.

AddedArticle 8 – paragraph 1: 1. The lead supervisory authority shall provide the other supervisory authorities concerned with instant, unrestricted and continuous remote access to the full joint case file, and shall include in the joint case file all relevant information, in particular documents, submissions, memos and other information related to the case within one week from producing or receiving them.

Change 45

ChangedArticle 8 – paragraph 1:2 1.– introductory part: 2. The lead supervisory authority shall actively provide and notify the other supervisory authorities andconcerned theand, Boardwhere withnecessary instant,for unrestricteddispute andresolution continuousunder remoteArticle access65 toof theRegulation full(EU) joint2016/679, casethe file,Board, andwith shallrelevant includeinformation intowithin the jointmeaning caseof fileArticle any60(1) documents,and submissions,(3) communication,of protocols,that evidenceRegulation, within one week from producing or otherreceiving it. This information relatedshall tocover theinformation caseon withinmajor onesteps weekin ofthe producingprocedure, orincluding receivingwhere it.applicable:

Change 46

RemovedArticle 8 – paragraph 2 – introductory part: 2. The lead supervisory authority shall actively provide the other supervisory authorities and the Board with relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679, within one week from receiving or producing it. This information shall cover information on major steps in the procedure, including where applicable:

AddedArticle 8 – paragraph 2 – point a: (a) information on the opening of an ex officio investigation or of a complaints procedure;

RemovedArticle 8 – paragraph 2 – point a: (a) information on the opening of an ex officio investigation or a complaints procedure;

Change 47

ChangedArticle 8 – paragraph 2 – point e a (new): (e a)(ea) any comments to a summary of key issues in accordance with Article 9(3);

Change 48

RemovedArticle 8 – paragraph 2 – point h: deleted

AddedArticle 8 – paragraph 2 – point i: (i) the views of the complainant on the non-confidential version of the preliminary findings and, if applicable, other aspects of the investigation on which formal written submissions have been made by the complainant;

RemovedFollowing the deletion of Article 15.

AddedArticle 8 – paragraph 2 – point k a (new): (ka) any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;

RemovedArticle 8 – paragraph 2 – point i: deleted

AddedArticle 8 – paragraph 2 – point k b (new): (kb) any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;

Change 49

ChangedArticle 9 – paragraph 2 – point b: (b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringementinfringement, ,and, andwhere applicable, an indication ifof whether they seemappear to behave been infringed;

Change 50

ChangedArticle 9 – paragraph 2 – point c: (c) identificationpreliminary offactual or legal andassessments, technologicaldealing assessmentswith whichall arerelevant views as expressed by parties when the summary is drafted, and including relevant forEuropean preliminarycase orientationlaw, ofas theirwell assessment;as guidelines, recommendations and best practices issued by the Board;

Change 51

RemovedEDPB para 52.

AddedArticle 9 – paragraph 2 a (new): 2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any factual or legal changes that emerge during the course of the procedure.

RemovedArticle 9 – paragraph 2 – point c a (new): (c a) where applicable, European case law, as well as guidelines, recommendations and best practices issued by the Board, that would determine the matter, and an indication if the supervisory authority intends to follow them;

AddedArticle 9 – paragraph 3: 3. The supervisory authorities concerned may provide factual or legal comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update of it, in accordance with Article 60 of Regulation (EU) 2016/679.

RemovedArticle 9 – paragraph 2 a (new): 2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any material changes that emerge during the course of the procedure.

RemovedArticle 9 – paragraph 3: 3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update.

Change 52

RemovedMoved to a horizontal provision on all communications in Article 2c(8).

Change 53

RemovedEDPB para 54. (EDPB Rules of Procedure can specify this already anyway.)

AddedArticle 9 – paragraph 6: 6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article which challenge the summary of key issues or raise other important factual or legal questions shall be considered non-contentious cases. In such cases, the deadline to issue a draft decision referred to in Article 4(1b) shall be 3 months.

RemovedArticle 9 – paragraph 6: 6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article, and where the supervisory authority indicates that it intends to follow European case law, as well as guidelines, recommendations and best practices referred to in paragraph 2(ca), shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties within 3 months of the expiry of the deadline provided for in paragraph 3 of this Article.

AddedChapter III – Section 2 – title: Cooperation with other relevant authorities

Removed3 months: rapid decision-making in non-contentious cases requires shorter deadlines.

RemovedArticle 10 – paragraph 1: deleted / (deleted) / (deleted) / (deleted)

Change 54

ChangedArticle 10 – paragraph 2:1 – point c: deleted

Change 55

RemovedCovered by horizontal provisions in new Article 2c now.

AddedArticle 10 – paragraph 1 – point c a (new): (ca) preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

RemovedArticle 10 – paragraph 4: 4. Where there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matters referred to in Article 9(2), the lead supervisory authority or a concerned supervisory authority may request a procedural determination pursuant to Article 26a(1).

AddedArticle 10 – paragraph 3: 3. In cases not falling under Article 9(6) of this Regulation, the lead supervisory authority shall investigate facts relevant for diverging views and engage, making its best effort, with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings.

RemovedArticle 10 – paragraph 5 – introductory part: 5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the supervisory authority shall provide all of the following:

AddedArticle 10 – paragraph 4: 4. Where within four weeks after the expiry of the deadlines for comments, the procedure provided for in paragraph 3 of this Article fails to generate consensus between the lead supervisory authority and one or more supervisory authorities concerned on the matters referred to in Article 9(2), the lead supervisory authority or a supervisory authority concerned shall request a procedural determination of the Board under Article 26a of this Regulation.

Change 56

ChangedArticle 10 – paragraph 5 – point b: (b) the comments of the supervisory authority concerned that disagreesa: with(a) the leadrelevant supervisoryinformation authority’sreferred preliminaryto identificationin ofArticle the9(2), matterincluding referredany toupdates inwhen Articlethey 9(2).occur;

Change 57

RemovedArticle 10 – paragraph 6: 6. The Board shall adopt an urgent binding decision on the summary of key issues, in accordance with Article 66(3) of Regulation (EU) 2016/679, on the basis of all documents received.

AddedArticle 10 – paragraph 5 – point b: (b) the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation or the factual or legal assessment of the elements of the summary of key issues referred to in Article 9(2);

RemovedWording suggestion from EDPB.

AddedArticle 10 – paragraph 5 – point b a (new): (ba) access to the joint case file.

RemovedChapter III – Section 2: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

AddedArticle 10 – paragraph 5 a (new): 5a. The Board may request the supervisory authorities to provide other documents or information, as it deems appropriate in the particular case.

Change 58

RemovedMoved to Article 16(1)(f) to horizontally ensure that all parties are informed about judicial remedy options.

AddedChapter III – Section 3 – title: Decisions addressed to parties under investigation

RemovedSection 3 – title: Decisions addressed to parties under investigation

AddedArticle 14 – title: Preliminary findings and the right to be heard

RemovedWording suggestion from EDPB.

AddedArticle 14 – paragraph 1: 1. Following the consultations and procedures under Articles 9 and 10 of this Regulation, when the lead supervisory authority intends to submit a draft decision Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

Change 59

ChangedArticle 14 – paragraph 2 – subparagraph 1: 1.The Followingpreliminary thefindings consultationsshall present allegations raised in an exhaustive and proceduressufficiently clear way to enable the parties under Articlesinvestigation 9to andtake 10cognisance of thisthe Regulation,conduct wheninvestigated by the lead supervisory authorityauthority. intendsIn toparticular, submitthey ashall draftset decisionout withinclearly all the meaningfacts, ofincluding Articlelisting 60(3)all ofthe Regulationevidence (EU)relied 2016/679upon, toand the otherentire legal assessment raised against the parties under investigation, so that they are heard and can express their views on the facts and the legal conclusions the lead supervisory authoritiesauthority concernedintends findingto andraw infringementin the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, itand shalllist draftall preliminarythe findings.evidence it relies upon.

Change 60

RemovedWording suggestion from EDPB.

RemovedArticle 14 – paragraph 2 – subparagraph 1: The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that the parties can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

RemovedEDPB para 135

Change 61

RemovedEDPB para 135

AddedArticle 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

RemovedArticle 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements of facts and law, which are known to it, and on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account..

AddedArticle 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation that may be subject to the exercise of a corrective power, as well as to the supervisory authority with which the complaint was lodged and the supervisory authorities concerned. The supervisory authority with which the complaint was lodged shall notify preliminary findings to the complainant.

RemovedEDPB para 135

RemovedArticle 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties.

Change 62

RemovedReplaced by horizontal rule in Article 2b(4).

Change 63

RemovedReplaced by horizontal rule in Article 2b(1)(c).

AddedArticle 14 – paragraph 6: 6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

RemovedArticle 14 – paragraph 6: 6. The parties may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Change 64

RemovedNow covered by Article 14, which in amended form requires preliminary findings to be sent to all parties of a case, including complainants.

AddedArticle 16 – title: Submission of draft decisions, revised draft decisions and adoption of final decision

Change 65

ChangedArticle 16 – paragraph 1: After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation 2016/679, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Change 66

RemovedFour weeks from Article 60(4) and (5) GDPR

AddedArticle 16 – paragraph 1 a (new): 1a. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intends to follow that objection, the lead supervisory authority shall, within four weeks, submit a revised draft decision pursuant to Article 60(5) of that Regulation.

Change 67

ChangedArticle 16 – paragraph 1 ab (new): 1b. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intendsdoes tonot follow the relevant and reasoned objection or is of the opinion that objection,the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit athe revisedmatter draftto decisionthe pursuantconsistency mechanism referred to in Article 60(5)63, in accordance with Article 60(4) of that Regulation.

Change 68

RemovedArticle 16 – paragraph 1 b (new): Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit the matter to the consistency mechanism referred to in Article 63, in accordance with Article 60(4) of that Regulation.

AddedArticle 16 – paragraph 1 c (new): 1c. Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

RemovedArticle 16 – paragraph 1 c (new): Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing of the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

AddedArticle 16 – paragraph 1 d (new): 1d. In the event where the legally binding decision is to be issued by the supervisory authority with which the complaint has been lodged in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the lead supervisory authority shall ensure that the decision contains all elements necessary under the applicable national procedural law of the supervisory authority concerned. The supervisory authority concerned with which the complaint has been lodged shall assist the lead supervisory authority in drafting the decision in such a manner.

RemovedPoint (f) moved here from Article 13. This information should be available to all parties.

AddedArticle 16 – paragraph 1 e (new): 1e. Any draft decision or final decision shall only rely on factual findings made on the basis of documents or other evidence, on which the parties under investigation had the opportunity to make their views known.

Change 69

ChangedArticle 16 – paragraph 1 df (new): In a case where the legally1f. bindingThe decisioninformation isprovided to be issued by the supervisory authority with which the complaint has been lodged in accordanceparties withunder Article 60(8)60(7) orto (9) of Regulation (EU) 2016/679, the lead supervisory authority2016/679 shall ensure that the decision contains all elements necessary under the applicable nationalinclude procedurala lawcopy of the concerned supervisory authority. The concerned supervisory authority with which the complaintlegally hasbinding beendecision, lodgedand shallinformation assistabout thea leadjudicial supervisoryremedy authorityavailable in draftingaccordance thewith decisionArticle in78 suchof aRegulation manner.(EU) 2016/679.

Change 70

RemovedArticle 16 – paragraph 1 e (new): The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision.

AddedArticle 16 – paragraph 1 g (new): 1g. Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless the new decisions do not materially depart from previously published decisions. In accordance with applicable national law, supervisory authorities may redact party names, any other information that may allow the identification of parties, and other information that is protected under applicable law.

RemovedArticle 16 – paragraph 1 f (new): Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless they do not materially depart from previously published decisions. In accordance with applicable national procedural law,, supervisory authorities may redact information that may allow identifying parties and redact other information that is protected under applicable law.

RemovedEstablished practice in most Member States, see GDPRhub.eu:- Spain publishes everything. Most countries publish novel or relevant decisions only (which is the proposal here). Germany and Romania do not publish anything (other than some press release).

Change 71

RemovedThis Article is replaced by Article 2b(1)(b), which clarifies that the parties must be heard on novel issues that were not brought to their attention (“Überraschungsverbot”). There is no need to hear the parties on the entire draft decision.

AddedArticle 18 – paragraph 1 – point a: (a) be based on factual elements included in the draft decision, or on the evidence the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;

Change 72

ChangedArticle 18 – paragraph 1 – point a: (a) beb: based(b) onnot factualchange elementsthe includedscope inof the draftcase decision,as ordefined in the joint case file or on anylatest additionalversion evidenceof submittedthe togethersummary withof thekey relevantissues; and reasoned objection;

Change 73

RemovedThe limitation to only base this on what the LSA has put in the draft decision allows to manipulate the outcome by simply only focusing on certain elements. It should be at least the entire case file, ideally also evidence that the LSA may have been missing. EDPB paras 92-96

AddedArticle 18 – paragraph 1 – point b a (new): (ba) clearly identify the elements of the draft decision that should be changed, including, when possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

RemovedArticle 18 – paragraph 1 – point b: (b) not change the scope of the case as defined through the latest version of the summary of key issues; and

RemovedBased on EDPB wording suggestions.

RemovedArticle 18 – paragraph 1 – point b a (new): (b a) clearly identify the elements of the draft decision that should be changed, including, where possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

Change 74

RemovedThe duty to have concise documents is introduced as a general principle in Article 2c(8), which also applies to relevant and reasoned objections. Limiting it to 3 or maximum 6 pages is too narrow. EDPB para 97

AddedChapter IV: deleted

RemovedChapter IV – title: (deleted) / (deleted)

AddedArticle 22 – title: Referral to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679

RemovedThe entire Chapter is replaced by Article 2b.

AddedArticle 22 – paragraph 1: 1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections or from the lapse of the deadline pursuant to Article 60(4) of Regulation (EU) 2016/679. Relevant and reasoned objections that have been received after the deadline shall not be taken into consideration.

Change 75

ChangedArticle 22 – paragraph 2 – point a a (new): (a a)(aa) the summary of key issues;

Change 76

ChangedArticle 22 – paragraph 2 – point b: (b) a summary of the relevant facts, including the description of processing activities, the description of the company'scontroller’s organisation and where the descriptionrelevant decisions on the purposes and means of wherethe decisionsprocessing of personal data are taken;

Change 77

RemovedEDPB para 108

AddedArticle 22 – paragraph 2 – point d: (d) views made in writing by the parties, pursuant to Article 14;

RemovedArticle 22 – paragraph 2 – point d: (d) view made in writing by the parties, pursuant to Articles 15;;

RemovedAligned with amended and broader Article 15.

Change 78

RemovedAligned with amended and broader Article 15, see amended point (d).

AddedArticle 22 – paragraph 2 – point f: (f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as not relevant or reasoned;

Change 79

ChangedArticle 22 – paragraph 2 – point f:g: (f)(g) the relevant and reasoned objectionsreasons whichon werethe notbasis followedof bywhich the lead supervisory authority, and theauthority objectionsdid thatnot thefollow leadobjections supervisoryor authorityrejected hasthe rejectedobjections as being neithernot relevant noror reasoned;

Change 80

RemovedWording suggestion by EDPB.

AddedArticle 22 – paragraph 2 – point g a (new): (ga) access to the joint case file.

RemovedArticle 22 – paragraph 2 – point g: (g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned;

AddedArticle 22 – paragraph 3: 3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving all of the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to all supervisory authorities.

RemovedWording suggestion by EDPB, to align with (f).

AddedArticle 22 – paragraph 3 a (new): 3a. Once all information specified in paragraph 2 have been received, the Chair of the Board is empowered to request from the lead supervisory authority or the supervisory authorities concerned any additional information, documents or clarifications necessary for the Board to take a binding decision concerning all of the matters which are the subject of the relevant and reasoned objections. The authorities shall provide this additional information no later than one week after having received the request.

Change 81

ChangedArticle 22 – paragraph 3 ad (new): 3a.3d. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities concernedto may,adopt withina twodecision weekson afterthe havingsubject beenmatter providedsubmitted withto the submissionBoard pursuantduring tothe paragraphperiods 3,referred submitto anyin relevantArticle information65(2) thatand they(3) haveof onRegulation that(EU) case,2016/679 includingshall butalso notapply limitedduring to,the factsperiods andreferred documentationin thatparagraph underlie3 theirof objection.this Article.

Change 82

RemovedEDPB para 108.

RemovedArticle 22 – paragraph 3 b (new): 3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

RemovedEDPB para 101.

RemovedArticle 22 – paragraph 3 c (new): 3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation, shall also apply during the periods referred in paragraph 3 of this Article.

RemovedWording suggestion from EDPB.

Change 83

RemovedCovered by Article 22(2) and (3) now.

Change 84

RemovedEDPB paras 143-153. “Statement of Reasons” is not defined, and the whole procedure would require the EDPB to take three decisions in extremely limited time, see para 150. EDPB para 153 therefore recommends to delete Article 24.

RemovedArticle 24 a (new): Article 24a / Request for information by the Board / 1. In cases in which the Board is otherwise unable to determine the matter, it may request further information from the parties or supervisory authorities, or it may conduct further factual investigations. / 2. The deadlines in Article 65(2) of Regulation (EU) 2016/679 are extended for the duration of the procedure under paragraph 1, but no more than one month.

RemovedProposal from EDPS to replace the cumbersome procedure in Article 24.

Change 85

RemovedDuplication with Article 22(2).

AddedArticle 26 – paragraph 1 – point c: (c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an explanation of which points were not followed and a reference to the relevant part of the adopted decision.

RemovedArticle 26: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

AddedArticle 26 – paragraph 1 a (new): 1a. The Chair of the Board shall inform all supervisory authorities of the referral made to the Board under paragraph 1, so as to allow the supervisory authorities to make their views known.

RemovedDuplication with Article 22(2).

AddedArticle 26 – paragraph 3: 3. The Chair of the Board shall register the referral no later than one week after having received all of the documents referred to in paragraphs 1 and 2.

Change 86

ChangedArticle 26 a (new): Article 26aArticle26a / Procedural determinations by the Board / 1. Without prejudicePursuant to Articles 65 andArticle 66 of Regulation (EU) 2016/679, a supervisory authoritiesauthority may request from the Board to make a procedural determination on any dispute arising during a cooperation procedure,take includingan whetherurgent abinding casedecision meetsin the requirements of Article 56form of Regulation (EU) 2016/679. / 2. Parties to the procedure may request from the Board to make a determination when no supervisory authority considers itself competent to handle a complaint underprocedural Articledetermination 55on orany 56procedural ofdispute Regulationarising (EU)between 2016/679supervisory orauthorities in exceptional cases when a case can otherwise not progress, because a supervisory authority manifestly violates its duties under Regulation (EU) 2016/679foreseen orby this Regulation. / 3.2. Where the lead supervisory authority is of the view that it cannot possibly comply with thea deadline frompursuant to Article 4(1b),4(1b) or Article 5a(3), especially because of the need for exceptionally complex factual investigations, it shall request from the Board aan prolongationurgent ofbinding updecision pursuant to twelveparagraph months.1, Theregarding supervisoryan authorityextension shallof submitthe adeadline detailedof planup ofto thenine investigationmore thatmonths. demonstratesThe supervisory authority shall demonstrate that despite its compliance with Article 2c(1)2c(1), the prolongationextension sought is strictly necessary.inevitable. / 4.3. Requests under paragraph 21 and 32 shall beat broughtleast withincontain: two/ weeks(a) fromthe facts relied upon and any evidence available to the deliveryauthority ofor party; / (b) the procedurallegal grounds for the request; / (c) the determination pursuant to paragraph 1 or athe rejectiondeadline byextension apursuant supervisoryto paragraph 2 that the authority andor mustparty atrequests leastfrom contain:the Board; / (a)4. theWithin factstwo reliedweeks, uponthe andBoard anyshall evidencedetermine availablethe tomatter based on the authorityinformation before it or party;it /shall (b)reject the leg…application. Determinations are binding on the supervisory authorities.

Change 87

RemovedTo avoid “deadlocked” cases, e.g. where SAs can’t agree on who is lead authority, etc. EDPS paras 108-111.

AddedArticle 26 b (new): Article 26b / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80 of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) if it considers that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing. / 3. Where a court or tribunal exercising the review pursuant to paragraph 1 finds that a supervisory authority has not fulfilled its duties, it shall have the power to order that supervisory authority to take the necessary action.

RemovedArticle 26 b (new): Article 26b / Select Committees / 1. The Board may appoint one or more select committees of three or more members, who can be part of the supervisory authorities or of the secretariat under Article 75 of Regulation (EU) 2016/679. The mandate of each of the committees is determined by the Board. Select committee Members perform their tasks under the instructions of the Board and may only be discharged by the Board. / 2. In its rules of procedure, the Board may designate any tasks, such as determinations under Article 26a, or other tasks aimed at ensuring harmonised implementation of Regulation (EU) 2016/679 and this Regulation by the supervisory authorities, to the select committees and specify the procedures of the select committees further. Each of the committees shall present their findings to the Board.

AddedArticle 27 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

RemovedTo avoid overloading the whole Board with little cases, e.g. missing documents etc.

RemovedArticle 26 c (new): Article 26c / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80(1) of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) independently of an infringement of the rights of a data subject.

Change 88

RemovedAligned with Article 28, see EDPB para 118.

AddedArticle 27 – paragraph 1 – point c: (c) a justification of the urgent need for final measures, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

Change 89

ChangedArticle 27 – paragraph 1 – point c: (c)c a justification of the urgent need for final measures(new): to(ca) bewhere adopted,the includingrequesting anauthority explanationis ofnot the exceptional nature oflead circumstancessupervisory requiringauthority, the adoptionviews of the measureslead concerned.supervisory authority.

Change 90

RemovedIn cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.

AddedArticle 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the authorities to maintain or amend provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

RemovedArticle 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities.

RemovedIn cross-border matters, coherent measures have to be taken, not 27 different ones. EDPB para 113.“all supervisory authorities ” as in EDPB para 121, because EDPB opinions have general applicability. EDPB para 119.

Change 91

RemovedAligned with wording of Article 66(2) GDPR.

Change 92

Removed“binding” aligned with wording of Article 66(2) GDPR.

AddedArticle 28 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation EU 2016/679;

Change 93

RemovedAligned with Article 27, see EDPB para 118.

Change 94

RemovedEDPB para 122

AddedArticle 28 – paragraph 1 – point d: (d) a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to provide the information requested under Article 61(5) of Regulation (EU) 2016/679 or failed to respond to a request pursuant to Article 61(8) or 62(2) of Regulation (EU) 2016/679;

Change 95

ChangedArticle 28 – paragraph 1 – point d: (d)f: a(f) justificationwhere ofavailable, the urgent needviews forof finalthe measuresparties. toIn becase adoptedthe onrequesting theauthority territoryis ofnot the requestinglead supervisory authority, bearing in mind the exceptional nature of circumstances requiringrequesting theauthority adoptionshall ofgrant the final measure, or proof that aright supervisoryto authoritybe failedheard to provide the information requestedparties under Article 61(5) ofinvestigation Regulationagainst (EU)which 2016/679provisional ormeasures failedwere totaken respondpursuant to a request under Article 62(2)66(1) of Regulation (EU) 2016/679;2016/679.

Change 96

RemovedWording suggestion by EDPB.

AddedArticle 28 – paragraph 2: 2. The urgent binding decision referred to in paragraph 1 shall be addressed to the lead supervisory authority and all the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

RemovedArticle 28 – paragraph 1 – point f: (f) where applicable, the views of the parties.

AddedArticle 28 – paragraph 3: 3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority or authorities to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

RemovedWhere applicable, all parties, including complainants, should be heard. EDPB para 128.

AddedArticle 28 – paragraph 4: 4. A supervisory authority that is responsible to adopt final measures shall notify its decision on the final measures to the parties under investigation and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the parties under investigation against which the provisional measures were adopted about the Board’s decision and the final measures adopted by the lead supervisory authority. The complaint-receiving supervisory authority shall inform the complainant about the Board’s decision and the final measures adopted by the lead supervisory authority.

Change 97

RemovedEDPB para 191 - Regulation No. 1182/71 applies anyway.

Change 98

RemovedFollowing the introduction of new Articles in Chapters I and II.

Change 99

AddedArticle 30 – paragraph 2 a (new): Until ... [six months from the date of application of this Regulation], the lead supervisory authority shall, upon request, provide all documents in its own file to other supervisory authorities by other electronic means.

Change 100

RemovedWhile additional reports might be excessive, the reports on the GDPR must include an evaluation of the functioning of this Regulation. EDPB para 190.

Change 101

ChangedArticle 31 – paragraph 1 a (new): 1a. It shall apply from ...… [one year from the date of entry into force of this Regulation]. / However, Article 2b(1), point(c), Article 2b(3), last sentence, Article 2c(2), last sentence, and (5), Article 2d(3) and (6), Articles 8(1) and 18(1), point (a) shall apply from ... [six months from the date of application of this Regulation].

Change 102

RemovedEDPB para 192 – transition period for necessary adjustments in EDPB secretariat and tools (IMI), national DPAs, and possibly national laws.

AddedAnnex I – Part A – point 1: (deleted) / Where the complaint is submitted by a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, submit proof that the body, organisation or association has been properly constituted in accordance with the law of a Member State. / Where the complaint is submitted on the basis of Article 80(1) of Regulation 2016/679, proof that the body, organisation or association lodging the complaint is acting on the basis of the mandate of a data subject. / (deleted) / (deleted)

RemovedAnnex I: deleted / (deleted) / (deleted) / (deleted)

AddedAnnex I – Part A – point 2: The name, address and any other available contact details of the complainant, including, where the complaint is submitted electronically, email address. / (deleted) / (deleted) / -----------

RemovedInstead of a mandatory form, there should be minimum requirements to ensure that the complaint can be processed by the LSA.

AddedAnnex I – Part A – point 3: Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including the name, address and any other contact details of that entity.