Changes from report parliamentary committee draft to plenary report

AddedArticle 16 – paragraph 1 g (new): 1g. Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless the new decisions do not materially depart from previously published decisions. In accordance with applicable national law, supervisory authorities may redact party names, any other information that may allow the identification of parties, and other information that is protected under applicable law.

RemovedArticle 16 – paragraph 1 f (new): Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless they do not materially depart from previously published decisions. In accordance with applicable national procedural law,, supervisory authorities may redact information that may allow identifying parties and redact other information that is protected under applicable law.

RemovedEstablished practice in most Member States, see GDPRhub.eu:- Spain publishes everything. Most countries publish novel or relevant decisions only (which is the proposal here). Germany and Romania do not publish anything (other than some press release).

Article 17: deleted / (deleted) / (deleted) / (deleted)

Change 71

RemovedThis Article is replaced by Article 2b(1)(b), which clarifies that the parties must be heard on novel issues that were not brought to their attention (“Überraschungsverbot”). There is no need to hear the parties on the entire draft decision.

AddedArticle 18 – paragraph 1 – point a: (a) be based on factual elements included in the draft decision, or on the evidence the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;

Change 72

ChangedArticle 18 – paragraph 1 – point a: (a) beb: based(b) onnot factualchange elementsthe includedscope inof the draftcase decision,as ordefined in the joint case file or on anylatest additionalversion evidenceof submittedthe togethersummary withof thekey relevantissues; and reasoned objection;

Change 73

RemovedThe limitation to only base this on what the LSA has put in the draft decision allows to manipulate the outcome by simply only focusing on certain elements. It should be at least the entire case file, ideally also evidence that the LSA may have been missing. EDPB paras 92-96

AddedArticle 18 – paragraph 1 – point b a (new): (ba) clearly identify the elements of the draft decision that should be changed, including, when possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

RemovedArticle 18 – paragraph 1 – point b: (b) not change the scope of the case as defined through the latest version of the summary of key issues; and

RemovedBased on EDPB wording suggestions.

RemovedArticle 18 – paragraph 1 – point b a (new): (b a) clearly identify the elements of the draft decision that should be changed, including, where possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

Article 18 – paragraph 2 – point a: deleted

Change 74

RemovedThe duty to have concise documents is introduced as a general principle in Article 2c(8), which also applies to relevant and reasoned objections. Limiting it to 3 or maximum 6 pages is too narrow. EDPB para 97

AddedChapter IV: deleted

RemovedChapter IV – title: (deleted) / (deleted)

AddedArticle 22 – title: Referral to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679

RemovedThe entire Chapter is replaced by Article 2b.

AddedArticle 22 – paragraph 1: 1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections or from the lapse of the deadline pursuant to Article 60(4) of Regulation (EU) 2016/679. Relevant and reasoned objections that have been received after the deadline shall not be taken into consideration.

RemovedArticle 19: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

RemovedReplaced by Article 2b(3). Paragraph 3 is captured by the definition of “internal deliberations” in Article 2(1f).

RemovedArticle 20: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

RemovedThe entire Chapter is replaced by Article 2b.Paragraph 4 is particularly problematic, as supervisory authorities should not be prevented from using information obtained in one procedure to perform their functions in other procedures and ex officio inquiries. EDPB para 79.

RemovedArticle 21: deleted

RemovedReplaced by Article 2b(3).

RemovedArticle 22 – title: Referral to dispute resolution under Article 65(1)(a) of Regulation (EU) 2016/679

RemovedWording suggestion from EDPB.

RemovedArticle 22 – paragraph 1: 1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections.

RemovedIn some cases, LSAs have taken a year to submit RROs to the Board.

Article 22 – paragraph 2 – introductory part: 2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following:

Change 75

ChangedArticle 22 – paragraph 2 – point a a (new): (a a)(aa) the summary of key issues;

Change 76

ChangedArticle 22 – paragraph 2 – point b: (b) a summary of the relevant facts, including the description of processing activities, the description of the company'scontroller’s organisation and where the descriptionrelevant decisions on the purposes and means of wherethe decisionsprocessing of personal data are taken;

Change 77

RemovedEDPB para 108

AddedArticle 22 – paragraph 2 – point d: (d) views made in writing by the parties, pursuant to Article 14;

RemovedArticle 22 – paragraph 2 – point d: (d) view made in writing by the parties, pursuant to Articles 15;;

RemovedAligned with amended and broader Article 15.

Article 22 – paragraph 2 – point e: deleted

Change 78

RemovedAligned with amended and broader Article 15, see amended point (d).

AddedArticle 22 – paragraph 2 – point f: (f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as not relevant or reasoned;

Change 79

ChangedArticle 22 – paragraph 2 – point f:g: (f)(g) the relevant and reasoned objectionsreasons whichon werethe notbasis followedof bywhich the lead supervisory authority, and theauthority objectionsdid thatnot thefollow leadobjections supervisoryor authorityrejected hasthe rejectedobjections as being neithernot relevant noror reasoned;

Change 80

RemovedWording suggestion by EDPB.

AddedArticle 22 – paragraph 2 – point g a (new): (ga) access to the joint case file.

RemovedArticle 22 – paragraph 2 – point g: (g) the reasons on the basis of which the lead supervisory authority did not follow the objections or considered the objections not to be relevant or reasoned;

AddedArticle 22 – paragraph 3: 3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving all of the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to all supervisory authorities.

RemovedWording suggestion by EDPB, to align with (f).

AddedArticle 22 – paragraph 3 a (new): 3a. Once all information specified in paragraph 2 have been received, the Chair of the Board is empowered to request from the lead supervisory authority or the supervisory authorities concerned any additional information, documents or clarifications necessary for the Board to take a binding decision concerning all of the matters which are the subject of the relevant and reasoned objections. The authorities shall provide this additional information no later than one week after having received the request.

RemovedArticle 22 – paragraph 2 – point g a (new): (g a) access to the joint case file.

AddedArticle 22 – paragraph 3 b (new): 3b. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit other relevant information that they have on that case which was not included in the objections, including but not limited to, facts and documentation related to their objection.

RemovedArticle 22 – paragraph 3: 3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to the supervisory authorities.

AddedArticle 22 – paragraph 3 c (new): 3c. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 22(2) are available and translated in accordance with Article 2d.

Change 81

ChangedArticle 22 – paragraph 3 ad (new): 3a.3d. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities concernedto may,adopt withina twodecision weekson afterthe havingsubject beenmatter providedsubmitted withto the submissionBoard pursuantduring tothe paragraphperiods 3,referred submitto anyin relevantArticle information65(2) thatand they(3) haveof onRegulation that(EU) case,2016/679 includingshall butalso notapply limitedduring to,the factsperiods andreferred documentationin thatparagraph underlie3 theirof objection.this Article.

Change 82

RemovedEDPB para 108.

RemovedArticle 22 – paragraph 3 b (new): 3 b. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 2(2) are available and translated.

RemovedEDPB para 101.

RemovedArticle 22 – paragraph 3 c (new): 3 c. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) of Regulation (EU) 2016/679 and Article 65(3) of that Regulation, shall also apply during the periods referred in paragraph 3 of this Article.

RemovedWording suggestion from EDPB.

Article 23: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Change 83

RemovedCovered by Article 22(2) and (3) now.

Article 24: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Change 84

RemovedEDPB paras 143-153. “Statement of Reasons” is not defined, and the whole procedure would require the EDPB to take three decisions in extremely limited time, see para 150. EDPB para 153 therefore recommends to delete Article 24.