In its work programme 2023, the European Commission announced that it would propose to harmonise some national procedural aspects to improve the cooperation between national data protection authorities in enforcing the General Data Protection Regulation (GDPR).

On 4 July 2023, the Commission adopted a proposal for a regulation on GDPR procedural aspects. It held two public consultations, a call for evidence from 24 February 2023 to 24 March 2023 and a call for feedback from 07 July 2023 to 04 September 2023. Commissioner Reynders indicated that the proposal aims to 'better protect Europeans' right to privacy, provide legal certainty to businesses, and streamline cooperation between data protection authorities'. Specifically, the Commission proposes

• streamlining the filing and handling of complaints (chapter II); 
• introducing a scoping exercise at an early stage in the cooperation procedure (chapter III, section 1);
• narrowly defining what qualifies as 'relevant and reasoned objections' and thereby limiting the range of disagreements warranting dispute resolutions, to exclude points raised in the early scoping exercise (chapter III, section 4)
• explicitly affording parties the right to be heard before authorities take decisions that would directly or indirectly adversely affect them or otherwise concern them;
• explicitly granting the parties a right of access to documents and safeguarding confidentiality where appropriate (chapter IV);
• (arguably) restricting the territorial and personal scope of urgent opinions and urgent binding decisions under Article 66(2) GDPR (chapter VI).

In the European Parliament (EP), the file was assigned to the Civil Liberties, Justice and Home Affairs (LIBE) and MEP Sergey Lagodinsky (Germany, Greens/EFA) was appointed as rapporteur on 18 July 2023 for the 9th parliamentary term. On 16 November 2023, the Committee on Legal Affairs (JURI) published its opinion. Parliament adopted its position at first reading on 10 April 2024 and the matter was was referred back to LIBE for interinstitutional negotiations. On 30 September 2024, Markéta Gregorová (Czech Republic, Greens/EFA) was appointed as rapporteur. Trilogues are ongoing.

In its position Parliament insisted on strengthening the role of complainants, CSAs and the EDPB:

• The changes proposed by the Parliament substantially modify the general part (Chapter 1). The scope of the regulation would be extended to cover administrative procedures involving SAs of more than one Member State. Several new provisions would be incorporated into the general part, on: a) the application of national procedural law; b) minimum procedural guarantees for parties; c) the procedure for determining which SAs qualify as supervisory authorities concerned (CSAs); d) language and translation requirements for information exchanged; and e) the initial handling and transmission of complaints. The provisions on the procedural minimum standards would guarantee parties to the proceedings a 'fair procedure' (including a right to equal treatment), the 'right to be heard', and 'procedural transparency'. 
• Chapter 2 on complaints and ex-officio procedures would set out (new) rules for: a) deciding the extent appropriate to investigate a case; b) settling complaints amicably; and c) requesting the LSA to carry out an ex-officio procedure (the request would be lodged by the CSA). 
• In Chapter 3 relating to certain cooperation activities, Parliament generally maintains but also modifies the rules on 'summary of key issues' and 'preliminary findings'. Where the LSA and CSAs do not agree on matters contained in the 'summary of key issues', they could request a 'procedural determination' from the EDPB. The LSA would have to update the summary continuously and the CSAs could submit their comments and thereby raise the potential for procedural determinations. Additionally, Parliament recommends retaining certain restrictions on the definition of 'relevant and reasoned objections', yet would give CSAs additional option to request 'procedural determinations' by the EDPB in earlier stages and the option of launching a formal request to initiate procedures (as mentioned above). 
• Parliament proposed deleting Chapter 4 on access to the administrative file. Parties would have access to the joint case. In Chapter 5, as regards dispute resolutions, Parliament would delete the provision explicitly mandating that the EDPB must hear the parties prior to taking binding decisions under Article 65(1)(a)°GDPR. The general rules would ensure that parties are heard 'at appropriate stages of the procedure'. Parties would be able to seek judicial redress against a complaint-receiving SA that does not use its powers to ensure that another SA is applying the procedure; an LSA that does not comply with deadlines; or an SA that does not comply with a binding decision issued by the EDPB. As regards urgency procedures in Chapter 6, Parliament would extend the territorial and personal effect of urgent opinions and urgent binding decisions.

On 13 June 2024, the Council agreed its General Approach. Like Parliament, Council favours adopting additional deadlines. It would introduce an early resolution mechanism which allows CSAs to resolve a case prior to initiating the standard procedures for handling cross-border complaints. Contrary to the Parliament, it would not expand the scope of the early scoping exercise or adopt a formal mechanism to request the initiation of procedures, but would instead expand the grounds for raising relevant and reasoned objections. Since objections must be based on factual and legal elements included in the draft decision, it is not entirely clear, whether interventions concerning legal interpretations or factual elements requiring further investigations would qualify as objections. Council would not enhance the complainant's position to the extent recommended by Parliament.

References: 

• EP Legislative Observatory, General Data Protection Regulation: additional procedural rules relating to the enforcement of the Regulation, 2023/0202(COD)
• European Parliament, Amendments to the proposal for a regulation laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679, P9_TA(2024)0187, 10 April 2024 
• European Parliament, Report on the proposal for a regulation laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679, A9-0045/2024, 20 February 2024
• Council, General approach, 11214/24, 18 June 2024
• Council, Data protection: Council agrees position on GDPR enforcement rules, Press release, 13 June 2024
• European Commission, Proposal for a regulation on laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679, Proposal for GDPR procedural regulation, COM(2023) 348 final, 4 July 2022
• European Commission, Work Programme 2023, COM(2022) 548 final, 18 October 2022
• European Commission, Call for evidence, 24 February 2023 - 24 March 2023
• European Data Protection Board, Letter to Commissioner Reynders, OUT2022-0069, 10 October 2022
• European Parliament, Resolution on the Commission evaluation report on the implementation of the General Data Protection Regulation two years after its application, P9_TA(2021)0111, 25 March 2021 

Further reading:

• European Parliament, EPRS, Newly proposed GDPR procedural rules: Improving efficiency and consistency, Briefing, June 2024
• European Parliament, EPRS, An analysis of the newly proposed rules to strengthen GDPR enforcement in cross-border cases, Briefing, April 2024
• European Parliament, EPRS, A visual presentation of the newly proposed rules to strengthen GDPR enforcement in cross-border cases, Briefing, April 2024
• European Parliament, EPRS, New procedural rules to strengthen GDPR enforcement in cross-border cases, At a Glance, April 2024

Author: Hendrik Mildebrath, Members' Research Service, legislative-train@europarl.europa.eu