Concepts
Overview
Issues
Regulation
Concepts PDF

From the list of issues, we have derived sixteen “core concepts”, which can provide solutions via high-level principles and rules.

Ideally, these concepts should be abstract enough to capture many problems, with a simple rule or principle that can be included in various provisions throughout the new Regulation.

When developing these principles, we have actively considered existing mechanisms in EU law, such as instruments in procedural rules, which seem to have many common features with GDPR procedures.

Concept 2: National procedures apply between each national SA and any national party, but the Regulation requires minimum standards and an equivalence principle

Default Rule: National procedural law

To further limit the interference of the Regulation with national law and ensure that residents are not surprised by a different set of procedural laws, it is useful to have the national law apply between the SAs and the persons before it (“national inferface”). This would also include foreign persons before a national SA. For example, if a French citizen chooses to file against a Spanish controller directly in Spain they will be subject to Spanish procedural law. However, if the same French citizen files in France, it is subject to French procedural law.

This default rule should in most cases be sufficient to properly determine the applicable rules for procedures. However, the difference in CSA and LSA procedural laws may also lead to problems, as the relevant SAs may have higher/lower standards than the other SAs. While it can be assumed that all Member States share a common tradition of procedural fairness, e.g. under Article 6 ECHR or Article 41 CFR, the details may still be different. At the same time, SAs usually have wide discretion to structure procedures; e.g. to determine the order of procedural steps, deadlines and alike. This would allow adding certain exceptions to the default rule in law and practice, to overcome differences in national laws that deviate from the common standards.

Exception 1: If national law does not comply with EU principles.

As some Member States lack procedural law or SAs limit procedural rights to an extent that may breach Article 41 CFR, the Regulation should provide for clear minimum standards. For most Member States, these minimum standards should be irrelevant, as it can be assumed that their national procedural laws are compliant with Article 41 CFR principles. However, for Member States where minimum procedural guarantees are not foreseen – e.g. in Sweden or France it is disputed whether data subjects have the right to be heard – the SAs would have to grant more extensive rights in cross-country procedures.

Exception 2: National law goes beyond EU minimums.

In some cases, Member State law may go beyond EU minimum guarantees. In such cases, one party may be granted more rights in Member State A than then other party is granted in Member State B.

For example, in noyb v. Meta the Irish DPC took the view that draft decisions must be shared with the parties and the controller can make submissions on them. However, the Austrian, German or Belgian SAs do not share these documents as they consider them to be “internal” documents. Furthermore, the EDPB shares these documents via freedom of information laws. This means the data subject was not able to make submissions, as it never received the same documents as the controller. At the same time, the German BfDI took the view that the complainant must only be heard on facts, not on matters of law – such limited submissions would however conflict with requests by the Irish SA.

The Article 41 CFR principle of fairness and equality could overcome these issues. This also seems necessary to comply with the right to equal treatment before the law in Article 20 CFR. The SAs would then have to apply the “higher standard” and grant both parties the same rights. This may also be necessary under various national law provisions (like audiatur et altera pars). In similar national situations, national law suggests that when an authority grants rights to one party, it must equally grant these procedural rights to all concerned parties to ensure overall fairness in the procedure. This principle may be extended to a European level (“leveling up”). However, this approach requires that the SAs openly communicate about the steps taken in each jurisdiction.

The application of this principle could be limited by limiting the principle of equivalence to substantial difference. For example, the equivalence principle could apply to issues of the right to be heard, but not minor differences in formalities.

The only logical alternative to the second exception would be that the higher standard would be dis-applied, which would not be desirable and could raise issues when a case is appealed nationally, as this may give rise under national constitutional or procedural laws.

Benefits

  • This solution would allow for a minimal interference with (most) national procedural law that already complies with typical baseline guaranteed like Article 41 CRF and Article 6 ECHR.
  • As a default, parties to the procedure and SAs can act under the known national procedural law and not under a separate European procedure.
  • In most cases, minimum thresholds will already be complied with by Member State law, as these standards are largely in line with Article 6 ECHR and Article 41 CFR.
  • Only in cases where the national procedural law is unclear or lacks sufficient protections, the Regulation would fill the gap and the SA and parties would have to apply the national law as well as the Regulation in parallel. This may be overcome by adjustments in national procedural law. Otherwise the parallel application would be similar than the need to apply GDPR and national law, which is already the case – even if not ideal.

Downsides

  • There may still be differences in procedure that would require SAs to coordinate bilaterally for an equivalence tests under exception 2. This requires comparisons of procedural laws that may generate further legal uncertainty.
  • A limitation on exception 2, to only include material differences in procedural law may allow SAs for more flexibility, but would also generate more legal uncertainty. Overall such a limitation however seems to be beneficial.