Procedural rights – Status of the parties to the procedure

Article(s) involved (national, EU, or other):

Problem

Complaint procedures generally involve the intervention of the following actors:

• the data subject(s) / complainant(s)
  
  
• the representative of the data subject(s) (if any)
  
  
• the controller or processor (if identified)
  
  
• the SA (or CSAs and LSA).

There is currently no indication in the GDPR with respect to the status of these different actors, and whether in particular the complainant should be considered as a party to a complaint procedure.

The lack of harmonisation makes the exercise of procedural rights particularly challenging in the context of cross-border cases.

Ideal Solution

The text should clarify who ought to be considered a party to the procedure, the rights/obligations attached to this qualification and the legal basis for it.

Procedural rights for each party should at least include:

• the right to access all documents of the file;
  
  
• the right to be heard, including the right to submit one’s factual and legal arguments throughout the procedure;
  
  
• the right to appeal any decision rendered by the SA.

In cross-border cases, some procedural rights are provided by one SA but not by the LSA or the EDPB (or conversely).

Proposed Solution

Concept 9 should take care of this matter, as well as proper definitions in the Regulation.

Reference to specific noyb cases:

See Swedish case on Spotify, where noyb was denied to be a party to the procedure and could allegedly not go to court. This was then overruled by the Swedish courts.

Reference to EDPB documents/table:

EDPB internal document 02/2021  states that Article 77 does not establish a right for a complainant to become a party to the procedure, see para. 44.

The Contribution of the EDPB to the evaluation of the GDPR under Article 97 confirms, on page 11, that the
complainant is “not being always perceived as a party to the proceeding before the SA”. This is also shown by the
“Overview on resources made available by Member States to the Data Protection Authorities and on enforcement actions by the Data Protection Authorities” issued by the EDPB on 5 August 2021. By way of example, according to this report, complainants have a right to be heard under Austrian, Belgian, Bulgarian, Irish, Maltese, Norwegian and Polish law; by contrast, this is not the case under Czech, French, and Swedish law. Under Spanish law, complainants are not considered as parties except where the envisaged decision may adversely affect them which is assessed on a case-by-case basis but is by default deemed to be the case in all proceedings related to the exercise of data protection rights.