Procedural rights – Status of the parties to the procedure
Article(s) involved (national, EU, or other):
Complaint procedures generally involve the intervention of the following actors:
- the data subject(s) / complainant(s)
- the representative of the data subject(s) (if any)
- the controller or processor (if identified)
- the SA (or CSAs and LSA).
There is currently no indication in the GDPR with respect to the status of these different actors, and whether in particular the complainant should be considered as a party to a complaint procedure.
The lack of harmonisation makes the exercise of procedural rights particularly challenging in the context of cross-border cases.
The text should clarify who ought to be considered a party to the procedure, the rights/obligations attached to this qualification and the legal basis for it.
Procedural rights for each party should at least include:
- the right to access all documents of the file;
- the right to be heard, including the right to submit one’s factual and legal arguments throughout the procedure;
- the right to appeal any decision rendered by the SA.
In cross-border cases, some procedural rights are provided by one SA but not by the LSA or the EDPB (or conversely).
Concept 9 should take care of this matter, as well as proper definitions in the Regulation.