Regulation
Overview
Issues
Concepts
Regulation PDF

To show that the broader concepts can also be turned into a real-life Regulation we have developed a Draft Regulation.

While it is by no means perfect or final, the draft lays down options for harmonised rules relating to procedural aspects of the cooperation between  supervisory authorities and the enforcement of the GDPR.

Article 16 – Opening and scope of procedures

Chapter IV – Ex officio procedures

  1. The lead supervisory authority may open an ex officio procedure at any time.

  2. If there is probably cause that a provision of the GDPR may be violated, any concerned supervisory authority may ask for an ex officio procedure with the lead supervisory authority by submitting a written request that must at least contain: [65]

    (a) a declaration to be a concerned supervisory authority under Article 4(22) GDPR;

    (b) any evidence in support of the probable cause;

    (c) the details of the respondent or respondents;

    (d) any available relevant information; and

    (e) the scope of the procedure, including the factual and legal matters to be investigated.

  3. Within two weeks, the assumed lead supervisory authorities must,

    (a) accept the request to open an ex officio procedure, expand an existing ex officio procedure to include the matters raised; or

    (b) return the request to the filing supervisory authority, if it takes the view that it is not the lead supervisory authority or there is no probable cause for a violation. In this case, the concerned supervisory authority may either initiate an amended ex officio procedure if it agrees, or otherwise request a determination by the coordination committee under Article 22 within two weeks.

Article 17 – End of an ex officio procedure

Chapter IV – Ex officio procedures

  1. The lead supervisory authority shall investigate the matter and issue a draft decision under Article 60(3) GDPR within six months. The duration may be extended for no more than six months if the lead supervisory authorities are otherwise unable to finish the procedure.

  2. If a concerned supervisory authority initiated the ex officio procedure, it may only be closed with the agreement of that concerned supervisory authority.[66]

[65] Probable cause is the first requirement for the opening of an ex officio by another SA, the SA must also be a “concerned” SA. In addition, a clear outline of the case should ensure that SAs have to invest certain time and effort into triggering an ex officio procedure.

[66] This ensures that if a CSA insists, there has to be a decision under Article 60(3) GDPR which can then lead to an Article 65 GDPR procedure.