On 10 April 2024, the European Parliament adopted its negotiating position on the proposed GDPR procedural regulation. While, for the time being, the file will not move much further until after the EP elections in June, the position now taken at first reading on the LIBE committee report constitutes an important impetus, poised to transform the Commission's timid and unbalanced proposal into something useful. By coming up with a negotiating position before the elections, the outgoing Parliament has prevented the file from potential oblivion in case a possibly less data protection friendly new assembly should pursue other priorities.
After having been severely criticised by data protection activists and thoroughly reviewed by the EDPB/EDPS, the Commission proposal received a major shake-up in MEP Lagodinsky's draft committee report, now in essence approved by the EP plenary. In a nutshell, the EP seeks to spur effective enforcement through greater transparency and expediency of the procedures, equal procedural rights, a possible EDPB involvement and the availability of judicial remedies at all stages. The EP also seeks to further clarify the interaction of common and national procedural rules and suggests promoting ex officio procedures while better framing the use of amicable settlements. These very laudable suggestions are certainly not flawless. Conceptually, it appears regrettable that the EP has not further contained the place of national procedural laws where the issues at stake could well be solved uniformly in the proposed Regulation itself. The EP also shuns uniformity by seeking to make the Commission's stellar proposal of a single complaint form an optional 'template'. Nevertheless, the EP has sent a very strong signal in favor of a badly needed effective GDPR enforcement.
Subject matter and scope: it's a hybrid
First things first – what exactly would the Regulation apply to? As highlighted by EDPB and EDPS, the concept of 'cross-border enforcement' underlying the Commission proposal lacked a definition. Instead of replacing it, as they suggest, with the term 'cross-border processing' as defined in Article 4(23) GDPR, the EP wants the Regulation to apply in toto whenever supervisory authorities of more than one Member State are indeed involved, while Article 26(b), a newly proposed provision on judicial remedies, would also apply to cases before a supervisory authority of a single Member State [corresponding to the single State affectation under Article 56(2) GDPR]. Accordingly, Recital 2(a) of the procedural Regulation would specify that it does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State. This reflects a defendable, yet by no means compulsory, interpretation of the outer limits of the harmonisation competence under Article 16 TFEU to be used for adopting the procedural regulation. As the Commission states in the proposal's explanatory memorandum, the scope of the harmonised procedural rules is rather a question of proportionality.
On the same token, one may disagree with the EP's embrace of the Commission's choice to lay down only some 'additional' procedural rules governing 'certain elements of the cooperation procedure' – others depending on national procedural laws subject to minimum common standards. While such overt procedural hybridisation produces – and maintains – unnecessary complication, it is not excluded that the proposed right for parties 'to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions ("fair procedure")' will eventually lead, by means of judicial interpretation, to a more or less harmonised procedural standard.
What's wrong with the complaint form?
The EP unfortunately does not like the Commission's idea to introduce an exclusive complaint form. As explained in the draft committee report, the form should not be mandatory, as many complainants will not initially know if a case is cross-country or not. A mandatory form may unduly limit access to authorities. Instead, minimum information should be introduced. In the EP negotiating position one now reads that a complaint subject to the Regulation shall provide the information required in the template, as set out in the Annex. The information can be provided by any means the authority accepts, including by not using the template [Article 3(1)].
Transparency and equal procedural rights
The EP correctly insists on the right of all parties to equal and procedural treatment regardless of where their complaint was lodged; their right to be heard before any measure is taken that would adversely affect them; and their right to procedural transparency, including access to a joint case file. The latter would constitute a major improvement in terms of transparency and ease of procedure: a dedicated electronic file that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case (including all evidence, both inculpatory and exculpatory) are stored and made remotely accessible to supervisory authorities concerned and parties to the case. Their access may only be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest.
The EP also suggests fixing the Commission's unequal implementation of the right to be heard. All parties are thus to be heard before any measure is taken that would adversely affect them. The lead supervisory authority shall inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority.
Clear deadlines to speed up procedures
The EP wants to tighten the deadlines already included in the proposal and to introduce a number of new ones (See Articles 3, 5, 8, 9, 10, 16 and 22). There would be a time limit of two weeks for a supervisory authority to acknowledge that it has received a complaint and declare it admissible or inadmissible. Then, the authority would have three weeks to determine if the case is a cross-border one, and which authority should be the lead authority. Draft decisions would be delivered within nine months of receiving the complaint, outside of certain exceptional situations.
Amicable settlements framed, ex-officio procedures promoted
Since the Commission proposal could indeed be read as allowing for presumed amicable settlements, the EP insists that they require the explicit consent of the parties. Also, an amicable settlement should not prevent a supervisory authority from starting an own-initiative investigation into the matter [Article 5 (1)(d)] and other supervisory authorities can even request the lead authority to start such an investigation [Article 5(a)].
'Procedural determinations' - Will the EDPB take the lead?
To avoid procedural break-downs, the EP wants to enable the EDPB to stir the ship out of troubled waters. As spelled out in the re-worded Recital 15, this means that when there is a divergence in opinion regarding the scope or procedural issues of a case, the supervisory authorities should raise the matter quickly with the Board, which should make the necessary 'procedural determinations'. While the EP seeks to ground this power in Article 66 GDPR, the term itself is new and could allow for a greater and more decisive involvement of the EDPB before it is too late. According to the EP, the lead supervisory authority or one of the supervisory authorities concerned should also be able to request an urgent binding decision of the Board without a request under Articles 61 or 62 GDPR having been made. As could be predicted, the enhanced implication of the EDPB in the course of cross-border enforcement is already being flagged by some as eroding the OSS mechanism. Considering, however, that the powers suggested by the EP would merely prepone the board's intervention for the purpose of settling disputes, they appear well justified.
Judicial remedies
The EP negotiating mandate finally addresses a major shortcoming of the Commission proposal by insisting on judicial remedies whenever a supervisory authority does not use its powers or does not otherwise take necessary action required by the GDPR. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. Article 4(1)(a) would provide that the handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 GDPR. Moreover, to ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) GDPR should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under the GDPR have been infringed as a result of the processing.
What's next?
The four months granted under Rule 60 of the EP's rules of procedure for trilogue negotiations obviously lay the file's fate with the hands of the newly elected assembly. Given the trade associations' strong opposition to the EP amendments, it may have to deal with a major pushback from the Council. Data protection politics at its best.
This article was first published by EU Law Live.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.