(2)

In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties under investigation prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board.

(2)

In order to provide for the smooth and effective functioning of the cooperation and dispute resolution mechanism provided for in Articles 60 and 65 of Regulation (EU) 2016/679, it is necessary to lay down rules concerning the conduct of proceedings by the supervisory authorities in cross-border cases, and by the Board during dispute resolution, including the handling of cross-border complaints. It is also necessary for this reason to lay down rules concerning the exercise of the right to be heard by the parties prior to the adoption of decisions by supervisory authorities and, as the case may be, by the Board. This Regulation thereby aims at protecting the right to good administration as enshrined in Article 41 of the Charter of Fundamental Rights of the European Union (the ‘Charter’). To achieve this objective, when applying provisions of this Regulation, all data protection authorities should act in an impartial and independent manner and in accordance with the rule of law, as enshrined in Article 2 of the Treaty on European Union.

(2a)

This Regulation and Chapter VII of Regulation (EU) 2016/679 only govern certain elements of the cooperation procedure, when supervisory authorities of more than one Member State participate in the procedure. This Regulation does not apply when a party lodges a complaint directly with a lead supervisory authority in another Member State.

(2b)

The procedural law of each Member State should apply to the supervisory authorities insofar as this Regulation does not harmonise a matter. Some procedural elements, such as the horizontal burden of proof of the controller in Article 5(2) of Regulation (EU) 2016/679, are already governed by Union law. In line with the primacy of Union law, supervisory authorities should not apply national procedural law where it is in conflict with this Regulation and Regulation (EU) 2016/679. Cooperation among supervisory authorities should not be limited because of differences in national procedural law. Supervisory authorities should make use of all options under applicable national law to allow parties in another Member State to participate in procedures. This may include remote video participation, interpreters or generally available means of communication.

(3)

Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged.

(3)

Complaints are an essential source of information for detecting infringements of data protection rules. Defining clear and efficient procedures for the handling of complaints in cross-border cases is necessary since the complaint may be dealt with by a supervisory authority other than the one to which the complaint was lodged. To this end, it is recommended that an efficient mechanism for communication between supervisory authorities should be created used so as to facilitate rapid and secure sharing of information necessary to resolve complaints in accordance with data protection rules.

(4)

In order to be admissible a complaint should contain certain specified information. Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint form should be provided. The information specified in the form should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the form may be used by supervisory authorities for cases that do not concern cross-border processing. The form may be submitted electronically or by post . The submission of the information listed in that form should be a condition for a complaint relating to cross-border processing to be treated as a complaint as referred to in Article 77 of Regulation (EU) 2016/679 . No additional information should be required for a complaint to be deemed admissible. It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities , as long as the information required from the complainant corresponds to the information required by the form and no additional information is required in order to find the complaint admissible .

(4)

In order to be admissible a complaint should contain certain minimum information about the alleged violation, whether ongoing or past. The cessation of a violation should not be sufficient grounds to reject a complaint . Therefore, in order to assist complainants in submitting the necessary facts to the supervisory authorities, a complaint template should be provided. The information specified in the template should be required only in cases of cross-border processing in the sense of Regulation (EU) 2016/679, though the template may be used by supervisory authorities for cases that do not concern cross-border processing. The information may be submitted electronically or by post. No additional information should be required for a complaint to be deemed admissible . Where a complaint does not meet the minimum requirements, the supervisory authority should reject it and inform the complainant about the missing information. The complainant can then resubmit a complete complaint. While the complainant should not be required to contact the party under investigation before submitting a complaint, if the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she should submit the communication related to that contact . It should be possible for supervisory authorities to facilitate the submission of complaints in a user-friendly electronic format and bearing in mind the needs of persons with disabilities.

(5)

Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case.

(5)

Supervisory authorities are obliged to decide on complaints within a reasonable timeframe. What is a reasonable timeframe depends on the circumstances of each case and, in particular, its context, the various procedural steps followed by the lead supervisory authority, the conduct of the parties in the course of the procedure and the complexity of the case. Article 6 of the European Convention on Human Rights (ECHR) and Articles 41 and 47 of the Charter require a reasonable overall duration of procedures. Given that this includes judicial remedies under Article 78 of Regulation (EU) 2016/679, procedures before supervisory authorities should typically not take more than nine months, unless exceptional circumstances arise. This Regulation foresees prolongations for delays or disruptions that are outside of the control of the lead supervisory authority. To that end, sufficient funding and staffing should be ensured in order to guarantee a timely and efficient handling of cases that does not affect the right to a good administration.

(5a)

The direct interaction between Member States’ supervisory authorities and the parties is governed by national procedural law, insofar as Regulation (EU) 2016/679, this Regulation or Union law do not take primacy. In the case of indirect interaction of a lead supervisory authority with a party via another supervisory authority, the latter authority’s procedural law should apply to any direct interaction with the party. In line with Article 56(6) of Regulation (EU) 2016/679, a complainant has the right to solely communicate with the supervisory authority with which the complaint has been lodged. This does not prevent the complainant to directly communicate with another supervisory authority, including the lead supervisory authority, which may be more efficient.

(5b)

To ensure that minimum requirements of fair and efficient procedures are met in all cross-border cases, including in Member States where there is no codified national procedural law, the Regulation sets directly applicable rules based on Article 41 of the Charter.

(5c)

It should be possible to apply, in accordance with national procedural law applicable to the supervisory authority that the party directly interacts with, strictly necessary and proportionate limitations in relation to the disclosure or the further use of legally protected information, such as personal data or trade secrets protected under Directive (EU) 2016/943  (1a). This could include the internal deliberations and decision-making of the authority. The least intrusive measures, such as limitation of the use of information or blackening of information should be applied. Parties should always be informed that information was withheld from them, and why.

(5d)

The lead supervisory authority manages the case in line with this Regulation, Regulation (EU) 2016/679 and its national procedural law, while fully cooperating with other supervisory authorities in a spirit of common understanding and trust. Other supervisory authorities should provide any relevant information and their views to the lead supervisory authority. The lead supervisory authority should structure the case in an efficient and expedient way taking full account of the views of other supervisory authorities. At the same time, the procedure should be in line with Regulation (EU) 2016/679, in particular the one-stop-shop dispute resolution architecture and the competences of the lead supervisory authority.

(5e)

Supervisory authorities may also start additional procedures, for example in the case of systemic or repetitive infringements. This should however, not lead to any interference with the rights of the parties.

(5f)

Violations may concern the rights of multiple data subjects, therefore, evidence from procedures may need to be used in other procedures to facilitate an efficient procedure and consistent decision making. In order to objectively assess the amount of non-material damages based on the average data subject, civil courts may benefit from relying on established facts and evidence to determine a claim under Article 82 of Regulation (EU) 2016/679.

(5g)

Each supervisory authority should define one or more languages that it accepts for incoming information by other supervisory authorities. An additional joint ‘cooperation language’ should be defined which all supervisory authorities must accept for incoming or outgoing information. In case of judicial remedies, the supervisory authority against which a judicial remedy is brought should have the duty to translate all relevant documents to the accepted languages.

(6)

Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be appropriate , necessary and proportionate in view of ensuring compliance with Regulation (EU) 2016/679 . It falls within the discretion of each competent authority to decide the extent to which a complaint should be investigated . While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint, but which provides an effective and quick remedy to the complainant . The assessment of the extent of the investigative measures required could be informed by the gravity of the alleged infringement, its systemic or repetitive nature, or the fact, as the case may be, that the complainant also took advantage of her or his rights under Article 79 of Regulation (EU) 2016/679.

(6)

Each complaint handled by a supervisory authority pursuant to Article 57(1), point (f), of Regulation (EU) 2016/679 is to be investigated with all due diligence to the extent appropriate bearing in mind that every use of powers by the supervisory authority must be effective , proportionate and dissuasive in view of ensuring compliance with Regulation (EU) 2016/679. While assessing the extent appropriate of an investigation, supervisory authorities should aim to deliver a satisfactory resolution to the complainant, which requires investigating all relevant legal and factual elements arising from the complaint, to ensure that a decision can be jointly taken and an effective remedy to the complainant can be quickly delivered. Without prejudice to the necessity of providing a satisfactory resolution to the complainant within a short timeframe, supervisory authorities should investigate to a degree that allows them to satisfy themselves as to whether a complaint is indicative of more serious or systemic infringements. Planning the procedure is important to ensure a quick result. Supervisory authorities should not refer to the rights under Article 79 of Regulation (EU) 2016/679 as a reason to limit the investigation of a complaint . To ensure compliance with Article 47 of the Charter, the handling of a complaint should always lead to an appealable decision. Unless a complaint is withdrawn, it should not be possible for complaints to be closed or otherwise terminated without a decision that can be submitted to judicial review.

(7)

The lead supervisory authority should provide the supervisory authority with which the complaint was lodged with the necessary information on the progress of the investigation for the purpose of providing updates to the complainant .

(7)

The lead supervisory authority should provide the supervisory authorities instant remote access to a joint case file that holds all relevant documents of the case, including all internal or confidential information, as well as a translation of all documents to the cooperation language. In addition, the lead supervisory authority should actively inform the other supervisory authorities on major changes that may require imminent action or closer attention. Defining clear and efficient procedures for the handling of complaints in cross-border cases is also necessary, since the complaint may be dealt with by a supervisory authority other than the one with which the complaint was lodged.

(8)

The competent supervisory authority should provide the complainant with access to the documents on the basis of which the supervisory authority reached a preliminary conclusion to reject fully or partially the complaint .

(8)

The competent supervisory authority should provide the parties with remote access to the joint case file, but may restrict this right of access under certain circumstances. Such access should allow the use of an effective judicial remedy in line with Article 47 of the Charter .

(9)

In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should endeavour, where appropriate, to resolve complaints by amicable settlement. The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679.

(9)

In order for supervisory authorities to bring a swift end to infringements of Regulation (EU) 2016/679 and to deliver a quick resolution for complainants, supervisory authorities should be able to endeavour, where appropriate, to resolve complaints by amicable settlement between the parties. Supervisory authorities should not make the handling of a complaint contingent on participation in an amicable settlement process. Settlements should be able to take the form of a contract between the parties under applicable law, but should bind the authorities . The fact that an individual complaint has been resolved through an amicable settlement does not prevent the competent supervisory authority from pursuing an ex officio case, for example in the case of systemic or repetitive infringements of Regulation (EU) 2016/679. However, such an ex officio possibility should not be used to defer decisions on complaints.

(10)

In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679.

(10)

In order to guarantee the effective functioning of the cooperation and consistency mechanisms in Chapter VII of Regulation (EU) 2016/679, it is important that cross-border cases are resolved in a timely fashion and in line with the spirit of sincere and effective cooperation that underlies Article 60 of Regulation (EU) 2016/679. The lead supervisory authority should exercise its competence within a framework of close cooperation with the other supervisory authorities concerned. Likewise, supervisory authorities concerned should actively engage in the investigation at an early stage in an endeavour to reach a consensus, making full use of the tools provided by Regulation (EU) 2016/679. This should be in line with the ‘one-stop-shop’ mechanism of Regulation (EU) 2016/679 and guarantee, where applicable, non-discriminatory treatment of parties, legal certainty and independence of issuing of decisions by the supervisory authorities.

(11)

It is particularly important for supervisory authorities to reach consensus on key aspects of the investigation as early as possible and prior to the communication of allegations to the parties under investigation and adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(11)

It is particularly important for supervisory authorities to reach consensus on key aspects of the case via the summary of key issues and comments on that summary as early as possible and prior to the adoption of the draft decision referred to in Article 60 of Regulation (EU) 2016/679, thereby reducing the number of cases submitted to the dispute resolution mechanism in Article 65 of Regulation (EU) 2016/679 and ultimately ensuring the quick resolution of cross-border cases.

(12)

Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority , with due regard for the margin of discretion enjoyed by each supervisory authority , including in the assessment of the extent appropriate to investigate a case, and for the varying traditions of the Member States. For this purpose, the lead supervisory authority should provide concerned supervisory authorities with a summary of key issues setting out its preliminary view on the main issues in an investigation. It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned but at the same time at a stage where the lead supervisory authority’s views on the case are sufficiently mature . Concerned supervisory authorities should have the opportunity to provide their comments on a broad range of questions, such as the scope of the investigation and the identification of complex factual and legal assessments. Given that the scope of the investigation determines the matters which require investigation by the lead supervisory authority, supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

(12)

Cooperation between supervisory authorities should be based on open dialogue which allows concerned supervisory authorities to meaningfully impact the course of the investigation by sharing their experiences and views with the lead supervisory authority . The supervisory authority with which a complaint has been lodged or which requests an ex-officio action may provide the lead supervisory authority with a summary of key issues setting out its preliminary view on the main issues in an investigation . The lead supervisory authority should draft the final summary of key issues. The summary of key issues should be part of the joint case file, and should be a living document that is updated by the lead supervisory authority during the course of the procedure . It should be provided at a sufficiently early stage to allow effective inclusion of supervisory authorities concerned. Concerned supervisory authorities should have the opportunity to provide their comments on any update of the summary of key issues. The supervisory authorities should be able to raise any dispute with the Board. Supervisory authorities should endeavour to achieve consensus as early as possible on the scope of the investigation.

(13)

In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, the comments of concerned supervisory authorities should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate. The comments of supervisory authorities concerned may be supplemented by additional documents . However, a mere reference in the comments of a supervisory authority concerned to supplementary documents cannot make up for the absence of the essential arguments in law or in fact which should feature in the comments. The basic legal and factual particulars relied on in such documents should be indicated, at least in summary form, coherently and intelligibly in the comment itself.

(13)

In the interest of effective inclusive cooperation between all supervisory authorities concerned and the lead supervisory authority, any documents submitted by concerned supervisory authorities and the parties should be concise and worded in sufficiently clear and precise terms to be easily understandable to all supervisory authorities. Supervisory authorities may therefore limit the length of submissions by the parties. The legal arguments should be grouped by reference to the part of the summary of key issues to which they relate.

(14)

Cases that do not raise contentious issues do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the preliminary findings provided for in Article 14 within nine months.

(14)

Cases that do not raise contentious issues (non-contentious cases) do not require extensive discussion between supervisory authorities in order to reach a consensus and could, therefore, be dealt with more quickly. When none of the supervisory authorities concerned raise comments on the summary of key issues, the lead supervisory authority should communicate the draft decision within three months from the receipt of the complaint .

(15)

Supervisory authorities should avail of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope of a complaint-based investigation , including the provisions of Regulation (EU) 2016/679 the infringement of which will be investigated, or where the comments of the supervisory authorities concerned relate to an important change in the complex legal or technological assessment, the concerned authority should use the tools provided for under Articles 61 and 62 of Regulation (EU) 2016/679 .

(15)

Supervisory authorities should avail themselves of all means necessary to achieve a consensus in a spirit of sincere and effective cooperation. Therefore, if there is a divergence in opinion between the supervisory authorities concerned and the lead supervisory authority regarding the scope or procedural issues of a case , the supervisory authorities should raise the matter quickly with the Board. The Board should make the necessary procedural determinations. The Board and supervisory authorities should endeavour to complete ongoing proceedings as quickly as possible. The lead supervisory authority or one of the supervisory authorities concerned should also be able to request an urgent binding decision of the Board without a request under Articles 61 or 62 having been made .

(16)

If the use of those tools does not enable the supervisory authorities to reach a consensus on the scope of a complaint-based investigation, the lead supervisory authority should request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. For this purpose, the requirement of urgency should be presumed. The lead supervisory authority should draw appropriate conclusions from the urgent binding decision of the Board for the purposes of preliminary findings. The urgent binding decision of the Board cannot pre-empt the outcome of the investigation of the lead supervisory authority or the effectiveness of the rights of the parties under investigation to be heard. In particular, the Board should not extend the scope of the investigation on its own initiative.

(17)

To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, the supervisory authority fully or partially rejecting a complaint should do so by means of a decision which may be challenged before a national court.

(17)

To enable the complainant to exercise her or his right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679, handling of any complaint should always lead to a decision which may be challenged before a national court.

(18)

Complainants should have the opportunity to express their views before a decision adversely affecting them is taken. Therefore, in the event of full or partial rejection of a complaint in a cross-border case, the complainant should have the opportunity to make her or his views known prior to the submission of a draft decision under Article 60(3) of Regulation (EU) 2016/679, a revised draft decision under Article 60(4) of Regulation (EU) 2016/679 or a binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679. The complainant may request access to the non-confidential version of the documents on which the decision fully or partially rejecting the complaint is based.

(19)

It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should obtain the views of the complainant on the proposed rejection of the complaint and should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision rejecting the complaint , that supervisory authority should also have the responsibility of preparing the draft decision under Article 60(3) of Regulation (EU) 2016/679.

(19)

It is necessary to clarify the division of responsibilities between the lead supervisory authority and the supervisory authority with which the complaint was lodged in the case of rejection of a complaint in a cross-border case. As the point of contact for the complainant during the investigation, the supervisory authority with which the complaint was lodged should be responsible for all communications with the complainant. All such communications should be shared with the lead supervisory authority. Since under Article 60(8) and (9) of Regulation (EU) 2016/679 the supervisory authority with which the complaint was lodged has the responsibility of adopting the final decision which needs to comply with its national procedural law, rejecting the complaint that supervisory authority should also be involved by the lead supervisory authority in preparing the draft decision under Article 60(3) and any final decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

(21)

In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the European Union (‘the Charter’), including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right.

(21)

In order to effectively safeguard the right to good administration and the rights of defence as enshrined in the Charter including the right of every person to be heard before any individual measure which would affect him or her adversely is taken, it is important to provide for clear rules on the exercise of this right for all parties involved in a case . Every party should have the right to decline the right to be heard.

(22)

The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties under investigation effectively have the opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties under investigation should be provided with the documents required to defend themselves effectively and to comment on the allegations made against them , by receiving access to the administrative file.

(22)

The rules regarding the administrative procedure applied by supervisory authorities when enforcing Regulation (EU) 2016/679 should ensure that the parties effectively have the right to be heard and opportunity to make known their views on the truth and relevance of the facts, objections and circumstances put forward by the supervisory authority throughout the procedure, thereby enabling them to exercise their rights of defence. The preliminary findings set out the preliminary position on the alleged infringement of Regulation (EU) 2016/679 following investigation. They thus constitute an essential procedural safeguard which ensures that the right to be heard is observed. The parties should be provided with all the necessary documents required to effectively comment on matters relevant to the investigation , by receiving access to the administrative joint case file.

(23)

The preliminary findings define the scope of the investigation and therefore the scope of any future final decision (as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a) of Regulation (EU) 2016/679) which may be addressed to controllers or processors. The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and only takes into consideration facts on which the parties under investigation have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the Article 65(1), point (a), decision resolving the dispute between the supervisory authorities. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties under investigation in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of defence rights.

(23)

The preliminary findings should be couched in terms that, even if succinct, are sufficiently clear to enable the parties to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation of giving the parties all the information necessary to enable them to be heard is satisfied if the final decision only takes into consideration facts on which the parties have had the opportunity of making known their views. The final decision of the lead supervisory authority is not, however, necessarily required to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties to the preliminary findings, and, where applicable, the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, and the decision by the Board resolving the dispute between the supervisory authorities under Article 65(1), point (a), of tha Regulation . The lead supervisory authority should be able to carry out its own assessment of the facts and the legal qualifications put forward by the parties in order either to abandon the objections when the supervisory authority finds them to be unfounded or to supplement and redraft its arguments, both in fact and in law, in support of the objections which it maintains.

(24)

The parties under investigation should be provided with a right to be heard prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

(24)

The parties should be provided with a right to be heard at appropriate stages of the procedure, in particular prior to the submission of a revised draft decision under Article 60(5) of Regulation (EU) 2016/679 or the adoption of a binding decision by the Board pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679.

(25)

Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt the complaint does not bar the qualification of a data subject as complainant. However, an investigation by a supervisory authority of a possible infringement of Regulation (EU) 2016/679 by a controller or processor does not constitute an adversarial procedure between the complainant and the parties under investigation. It is a procedure commenced by a supervisory authority, upon its own initiative or based on a complaint, in fulfilment of its tasks under Article 57(1) of Regulation (EU) 2016/679. The parties under investigation and the complainant are, therefore, not in the same procedural situation and the latter cannot invoke the right to a fair hearing when the decision does not adversely affect her or his legal position. The complainant’s involvement in the procedure against the parties under investigation cannot compromise the right of these parties to be heard.

(25)

Complainants should be given the possibility to be associated with the proceedings initiated by a supervisory authority with a view to identifying or clarifying issues relating to a potential infringement of Regulation (EU) 2016/679. The fact that a supervisory authority has already initiated an investigation concerning the subject matter of the complaint or will deal with the complaint in an ex officio investigation subsequent to the receipt of the complaint does not bar the qualification of a data subject as complainant.

(25a)

Notwithstanding the fact that the parties under investigation and the complainant are not in the same procedural situation, there are circumstances in which complainants can be in a position to adduce arguments and evidence during an investigation which can help the progress of the investigation. This is particularly the case in circumstances in which a not-for-profit body, organisation or association has lodged a complaint on behalf of a data subject or on its own initiative under Article 80 of Regulation (EU) 2016/679. Supervisory authorities should facilitate the hearing of such complainants at all stages of the investigation, including ex officio investigations, while also maintaining their independence.

(26)

The complainants should be given the possibility to submit in writing views on the preliminary findings. However, they should not have access to business secrets or other confidential information belonging to other parties involved in the proceedings. Complainants should not be entitled to have generalised access to the administrative file.

(27)

When setting deadlines for parties under investigation and complainants to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings , in order to ensure that the parties under investigation and complainants have sufficient opportunity to meaningfully provide their views on the issues raised.

(27)

When setting deadlines and limiting the length of submissions for parties to provide their views on preliminary findings, supervisory authorities should have regard to the complexity of the issues raised in preliminary findings as well as the capacity of the parties under investigation and complainants to respond, in order to ensure that the parties have sufficient opportunity to meaningfully provide their views on the issues raised. This should however not lead to unduly long procedures.

(28)

The exchange of views prior to the adoption of a draft decision involves an open dialogue and an extensive exchange of views where supervisory authorities should do their utmost to find a consensus on the way forward in an investigation. Conversely, the disagreement expressed in relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679, which raise the potential for dispute resolution between supervisory authorities under Article 65 of Regulation (EU) 2016/679 and delay the adoption of a final decision by the competent supervisory authority, should arise in the exceptional case of a failure of supervisory authorities to achieve a consensus and where necessary to ensure the consistent interpretation of Regulation (EU) 2016/679. Such objections should be used sparingly, when matters of consistent enforcement of Regulation (EU) 2016/679 are at stake, since every use of relevant and reasoned objections postpones the remedy for the data subject. Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant and reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation.

(29)

In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should be limited to a prescribed length, should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(29)

In the interest of the efficient and inclusive conclusion of the dispute resolution procedure, where all supervisory authorities should be in a position to contribute their views and bearing in mind the time constraints during dispute resolution, the form and structure of relevant and reasoned objections should meet certain requirements. Therefore, relevant and reasoned objections should clearly identify the disagreement with the draft decision and should be worded in sufficiently clear, coherent and precise terms.

(30)

Access to the administrative file is provided for as a part of the rights of defence and the right to good administration enshrined in the Charter. Access to the administrative file should be provided to the parties under investigation when they are notified of preliminary findings and the deadline to submit their written reply to the preliminary findings should be set .

(30)

Access to the joint case file may be provided for in the spirit of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties. Access of the parties to the joint case file may be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest . Such limitation must be proportionate in light of the respective recognised rights of others or the public interest pursued.

(31)

When granting access to the administrative file, supervisory authorities should ensure the protection of business secrets and other confidential information. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information.

(31)

When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information and the protection of information in the public interest in accordance with applicable national law . The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information and provide a non-confidential version .

(33)

When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents listed in Article 23, the Chair of the Board should register the referral of the subject-matter in the sense of Article 65(2) of Regulation (EU) 2016/679.

(33)

When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

(34)

The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in a way which allows the lead supervisory authority to adopt its final decision on the basis of the decision of the Board while maintaining its discretion .

(34)

The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

(36)

In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board.

(36)

In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board. Provisional measures pursuant to Article 66(1) of Regulation (EU) 2016/679 should include all possible measures within the powers of supervisory authorities, pursuant to Article 58 of that Regulation.

(36a)

The Board should be able to request any further information from supervisory authorities necessary for it to take a binding decision.

(36b)

The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

(38)

The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on [ ] ,

(38)

The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on 19 September 2023 ,

(1)

‘ parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing ;

(1)

‘ party under investigation’ means the controller(s) and/or processor(s) complained about, or investigated for alleged infringement of Regulation (EU) 2016/679 , as well as their representative(s) ;

(1a)

‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the proceedings;

(1b)

‘party’ means the party or parties under investigation, the complainant(s) and any third party involved in the proceedings as defined under national law;

(1c)

‘national procedural law’ means laws, regulations and administrative provisions of the Member State that regulate the procedure before a supervisory authority;

(1d)

‘complaints procedure’ means a procedure determining the outcome of a complaint under Article 77 of Regulation (EU) 2016/679;

(1e)

‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1), point (a), of Regulation (EU) 2016/679;

(1f)

‘joint case file’ means a dedicated electronic file for any case falling under the scope of this Regulation, that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case, are stored and made remotely accessible to supervisory authorities concerned and parties to the case;

(1g)

‘complaint-receiving authority’ means the supervisory authority with which the complaint has been lodged as referred to in Article 4(22), point (c), of Regulation (EU) 2016/679;

(2)

‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned identifying the main relevant facts and the lead supervisory authority’s views on the case;

(2)

‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned , identifying the main relevant factual and legal issues within the preliminary scope of the investigation and the lead supervisory authority’s factual and legal views on the case;

(3)

‘preliminary findings’ means the document provided by the lead supervisory authority to the parties under investigation setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

(3)

‘preliminary findings’ means the document provided by the lead supervisory authority to the parties setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

(4a)

‘confidential version of a document’ means a document containing confidential or sensitive information which may be subject to legal privilege under the applicable Union or national law and data protection rules;

(4b)

‘non-confidential version of a document’ means a version of a document from which confidential or sensitive information has been redacted and which can be provided to the complainant without breaching Union or national law or data protection rules.

(a)

to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (‘fair procedure’);

(b)

to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (‘right to be heard’);

(c)

to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (‘procedural transparency’).

(a)

establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant, considering at least the following:

(i)

relevant controller or processor for the processing in question;

(ii)

number of establishments of the controller or processor in the EU;

(iii)

place of the main establishment;

(iv)

activities of establishments in more than one Member State;

(v)

substantial effect or likely substantial effect on data subjects in more than one Member State.

(b)

establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

(c)

take one of the following actions:

(i)

transmit the complaint to the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679 and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority; or

(ii)

handle the complaint under Article 56(2) of Regulation (EU) 2016/679.

II

Submission and handling of complaints

II

Complaints and ex officio procedures

(a)

the expediency of delivering an effective and timely remedy to the complainant;

(a)

the delivery of an effective and timely remedy to the complainant;

(b)

the gravity of the alleged infringement ;

(b)

the investigation of relevant factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7), (8) and (9) of Regulation (EU) 2016/679 ;

(c)

the systemic or repetitive nature of the alleged infringement .

(c)

the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemic , grave or repetitive infringements .

(a)

eight weeks when comments under Article 9(3) are submitted with regard to a summary of key issues or an updated summary of key issues;

(b)

eight weeks where the lead supervisory authority intends to issue fines or other penalties;

(c)

the period of time between a reference under Article 26a(1) or (2) and the decision by the Board;

(d)

the period of any prolongation permitted by the Board under Article 26a(3).

(a)

whether the conditions of an amicable settlement under paragraph 1a are fulfilled, and

(b)

whether to open an ex officio investigation under paragraph 1d.

(a)

the party under investigation is a repeat offender;

(b)

the party under investigation has been the subject of a large number of other amicable settlements;

(c)

the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, is of long duration, or is of serious nature; or

(d)

the exercise of powers is otherwise required to ensure effective, proportionate and dissuasive enforcement of Regulation (EU) 2016/679.

(a)

a declaration to be a supervisory authority concerned, and

(b)

a summary of key issues pursuant to Article 9.

(a)

inform the supervisory authority concerned that it has opened an ex officio procedure;

(b)

inform the supervisory authority concerned that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself; or

(c)

reject the request, if it takes the view that it is not the lead supervisory authority or there is no prima facie violation of Regulation (EU) 2016/679.

(a)

eight weeks when comments under Article 9(3) are submitted against a summary of key issues or an updated summary of key issues;

(b)

eight weeks where the lead supervisory authority intends to issue fines or other penalties;

(c)

the period of time between a reference under Article 26a and the decision by the Board;

(d)

the period of any prolongation permitted by the Board under Article 26a(3).

(a)

translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;

(b)

translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

(a)

information on the opening of an investigation of an alleged infringement of Regulation (EU) 2016/679 ;

(a)

information on the opening of an ex officio investigation or of a complaints procedure ;

(e)

summary of key issues in an investigation in accordance with Article 9;

(e)

the issuing or updating of the summary of key issues in an investigation in accordance with Article 9;

(ea)

any comments to a summary of key issues in accordance with Article 9(3);

(f)

information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings;

(f)

information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision ;

(i)

the views of the complainant on the preliminary findings;

(i)

the views of the complainant on the non-confidential version of the preliminary findings and, if applicable, other aspects of the investigation on which formal written submissions have been made by the complainant ;

(ka)

any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;

(kb)

any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;

(kc)

any judicial remedy brought during a procedure under Article 60 of Regulation (EU) 2016/679 or against a decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

(a)

the main relevant facts;

(a)

the relevant facts;

(b)

a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which will be investigated ;

(b)

a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement , and, where applicable, an indication of whether they appear to have been infringed ;

(c)

identification of complex legal and technological assessments which are relevant for preliminary orientation of their assessment;

(c)

preliminary factual or legal assessments , dealing with all relevant views as expressed by parties when the summary is drafted, and including relevant European case law, as well as guidelines, recommendations and best practices issued by the Board ;

(a)

language used is sufficiently clear and contains precise terms to enable the lead supervisory authority, and, as the case may be, supervisory authorities concerned, to prepare their positions;

(b)

legal arguments are set out succinctly and grouped by reference to the part of the summary of key issues to which they relate;

(c)

the comments of the supervisory authority concerned may be supported by documents, which may supplement the comments on specific points.

(b)

preliminary orientation in relation to complex legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

(b)

preliminary factual or legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

(c)

preliminary orientation in relation to complex technological assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c).

(ca)

preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

(a)

the documents referred to in Article 9(2), points (a) and (b) ;

(a)

the relevant information referred to in Article 9(2), including any updates when they occur ;

(b)

the comments of the supervisory authority concerned that disagrees with the lead supervisory authority’s preliminary identification of the scope of the investigation.

(b)

the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation or the factual or legal assessment of the elements of the summary of key issues referred to in Article 9(2);

(ba)

access to the joint case file.

(a)

the name of the supervisory authority which issued the decision;

(b)

the date of issuing the decision;

(c)

an impartial summary of the relevant facts of the case and their source;

(d)

the legal grounds for the decision;

(e)

the exercised corrective powers, penalties or other measures; and

(f)

information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

1f.

The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision, and information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

1g.

Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless the new decisions do not materially depart from previously published decisions. In accordance with applicable national law, supervisory authorities may redact party names, any other information that may allow the identification of parties, and other information that is protected under applicable law.

(a)

be based exclusively on factual elements included in the draft decision ; and

(a)

be based on factual elements included in the draft decision , or on the evidence the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;

(b)

not change the scope of the allegations by raising points amounting to identification of additional allegations of infringement of Regulation (EU) 2016/679 or changing the intrinsic nature of the allegations raised.

(b)

not change the scope of the case as defined in the latest version of the summary of key issues; and

(ba)

clearly identify the elements of the draft decision that should be changed, including, when possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

(a)

the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

(aa)

the summary of key issues;

(b)

a summary of the relevant facts;

(b)

a summary of the relevant facts , including the description of processing activities, the description of the controller’s organisation and where the relevant decisions on the purposes and means of the processing of personal data are taken ;

(d)

view made in writing by the parties under investigation, as the case may be , pursuant to Articles 14 and 17 ;

(d)

views made in writing by the parties, pursuant to Article 14 ;

(e)

views made in writing by complainants, as the case may be, pursuant to Articles 11, 12, and 15;

(f)

the relevant and reasoned objections which were not followed by the lead supervisory authority;

(f)

the relevant and reasoned objections which were not followed by the lead supervisory authority , and the objections that the lead supervisory authority has rejected as not relevant or reasoned ;

(g)

the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.

(g)

the reasons on the basis of which the lead supervisory authority did not follow objections or rejected the objections as not relevant or reasoned;

(ga)

access to the joint case file.

(a)

the draft decision or revised draft decision subject to the relevant and reasoned objections;

(b)

a summary of the relevant facts;

(c)

view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;

(d)

views made in writing by complainants, as the case may be, pursuant to Articles 11, 12 and 15;

(e)

the retained relevant and reasoned objections;

(f)

the reasons on the basis of which the lead supervisory authority did not follow the retained relevant and reasoned objections.