(1)

The EDPS Rules of Procedure of 15 May 2020 (2) adopted in accordance with Article 57(1)(q) of the Regulation provide in Article 18 for a review procedure in complaint cases limited to new factual evidence and legal arguments.

(2)

However, the application of the review procedure has presented practical and legal difficulties for EU institutions, offices bodies and agencies as well as for complainants. The review procedure should therefore be abolished.

(3)

Article 58(5) of the Regulation requires that the exercise of the powers conferred on the EDPS pursuant to that article should be subject to appropriate safeguards, including effective judicial remedies and due process, set out in Union law. In the same vein, Article 66(5) and (6) of the Regulation provide that before taking decisions imposing an administrative fine, the EDPS should give the Union institution or body which is the subject of the proceedings conducted by the EDPS the opportunity of being heard on the matters to which the EDPS has taken objection. In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is therefore important to provide for clear rules in the EDPS Rules of Procedure on the exercise of these rights.

(4)

Controllers or processors should have the opportunity to express their views before a decision adversely affecting them is taken by the EDPS. Therefore, the EDPS Rules of Procedure should provide for the EDPS to draft a preliminary assessment and communicate it to the controller or processor which is the subject of the proceedings conducted by the EDPS before adopting a decision containing finding of an infringement of the Regulation or of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, or when exercising corrective powers pursuant to the Regulation, or imposing an administrative fine, or exercising powers against the European Union Agency for Law Enforcement Cooperation (Europol), the European Union Agency for Criminal Justice Cooperation (Eurojust), or the European Public Prosecutor’s Office (EPPO).

(5)

Controllers or processors should have the opportunity to express their views before a decision adversely affecting them is taken by the EDPS. Therefore, the EDPS Rules of Procedure should specify the situations in which the EDPS should draft a preliminary assessment and then communicate it to the controller or processor which is the subject of the proceedings conducted by the EDPS.

(6)

Likewise, complainants should have the opportunity to express their views before a decision adversely affecting them is taken by the EDPS. Therefore, the EDPS Rules of Procedure should specify the situations in which the EDPS should draft a preliminary assessment and then communicate it to the complainant.

(7)

The preliminary assessment constitutes an essential procedural safeguard which ensures that the right to be heard is observed. The EDPS Rules of Procedure should consequently lay down the elements to be contained in such a preliminary assessment. Given that these elements differ in cases where the EDPS intends to impose an administrative fine, the EDPS Rules of Procedure should also lay down the elements to be contained in a preliminary assessment in these cases.

(8)

A limitation of the information contained in the preliminary assessment may be necessary to protect interests referred to in Union or Member State law. These interests include the national security, public security or defence of the Member States; the prevention, investigation, detection and prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; other important objectives of general public interest of the Union or of a Member State, in particular the objectives of the common foreign and security policy of the Union or an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation matters, public health and social security; the internal security of Union institutions and bodies, including of their electronic communications networks; the protection of judicial independence and judicial proceedings; the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions; a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority; the protection of the data subject or the rights and freedoms of others; the enforcement of civil law claims; avoidance of obstructing official or legal inquiries, investigations or procedures; avoidance of prejudicing the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Other interests include legitimate interests of confidentiality or of professional and business secrecy. The EDPS Rules of Procedure should therefore include specific references to these interests and specify the information to the complaint.

(9)

After the communication of its preliminary assessment, the controller or processor and the complainant should be given the opportunity of submitting their observations. The EDPS should therefore lay down rules on when to give to the controller or processor, or the complainant, the opportunity of being heard, and within which time frame.

(10)

Access to the file forms part of the rights of defence and the right to good administration enshrined in the Charter. However, a limitation to access to the file of the EDPS may be necessary to protect interests referred to in Union or Member State law and should thus be reflected in the EDPS Rules of Procedure.

(11)

For maintaining a fair decision-making process, the EDPS Rule of Procedure should clarify that any EDPS decisions should only be based on findings and measures on which the controller or processor or the complainant have been able to comment, except in cases of application of limitations necessary for the protection of interests referred to in Union or Member State law.

(12)

In order to guarantee in a consistent manner that each legally binding measure of the EDPS refers to the right to an effective remedy, the EDPS Rule of Procedure should provide for the EDPS to inform, in the text of its decision, the controller or processor, and the complainant, of their right to challenge the decision before the Court of Justice of the European Union in accordance with Article 263 of the Treaty on the Functioning of the European Union,