Regulation

To show that the broader concepts can also be turned into a real-life Regulation we have developed a Draft Regulation.

While it is by no means perfect or final, the draft lays down options for harmonised rules relating to procedural aspects of the cooperation between  supervisory authorities and the enforcement of the GDPR.

Article 11 – Admissibility and scope

Chapter III – Complaints Procedures

  1. The filing supervisory authority shall assess the admissibility of a compliant and shall reject inadmissible complaints in accordance with national law.

  2. The scope of the complaint is exclusively defined by the applicable national procedural law before the filing supervisory authority.[58]

  3. Other supervisory authorities may not reassess the admissibility or the scope of the complaint.

Article 12 – Initial procedure[59]

Chapter III – Complaints Procedures

  1. Without delay, but no later than two weeks from the filing of an admissible complaint, the filing supervisory authority must,

    (a) determine the parties to the procedure and the assumed lead supervisory authority;

    (b) provide all relevant information to the assumed lead supervisory authority; and

    (c) inform the complainant of the above.

  2. Within two weeks from being provided the relevant information, the assumed lead supervisory authority must,

    (a) accept the complaint and provide the complaint to the respondent and request an answer to the complaint within two weeks, including all relevant evidence; or

    (b) return the complaint to the filing supervisory authority, if it takes the view that it is not the lead supervisory authority. In this case, the filing supervisory authority may either repeat the steps under paragraph 1, if it agrees with this view, or otherwise request a determination by the Coordination Committee under Article 23 within two weeks.

  3. The filing supervisory authority will forward the answer of the respondent to the complainant within one week, requesting a statement from the complainant within two weeks.

  4. The filing supervisory authority forwards the statement of the complainant to the lead supervisory authority within one week.

  5. Durations under this article may be expanded for no more than one weeks if the supervisory authorities are otherwise unable to provide for a translation of documents.

Article 13 – Handling of complaints

Chapter III – Complaints Procedures

  1. Within two weeks from the provision of the statement under Article 12(4), the supervisory authorities jointly determine the necessary steps to come to a legally binding decision within six months from the filing of the complaint.

  2. The supervisory authority shall use its powers to investigate the complaint in a swift, efficient, transparent and thorough manner.

Article 14 – Closing of a complaints procedure[60]

Chapter III – Complaints Procedures

  1. Where provided for in applicable national law of the filing procedural authority, a complaints procedure may be closed, if:

    (a) a complaint is withdrawn by the complainant, especially if the respondent has remedied alleged violations or the parties have otherwise settled the complaint;[61]

    (b) a complainant did not comply with procedural deadlines or requirements that are necessary to continue the proceeding;[62] or

    (c) the complainant lost the right to have a complaint decided[63] or the handling of the complaint is otherwise impossible.

  2. In accordance with Article 60(8) GDPR the filing supervisory authority issues a legally binding decision to close the complaints procedure.[64] The lead supervisory authority informs the respondent about the closure no later than within one week.

Article 15 – End of a complaints procedures

Chapter III – Complaints Procedures

  1. Any complaints procedure shall end with a legally binding decision under Article 60(7) to (9) GDPR or a formal decision to close the procedure under Article 13 of this Regulation.

  2. The end of a complaints procedure does not prevent supervisory authorities from taking further steps in the course of an ex officio procedure.

[58] The Admissibility and Scope of the complaint should be defined by the Filing DPA, right now the LSAs “second guess” under their law if a complaint was filed correctly.

[59] The idea is to have a quick first exchange of positions. Right now parties often wait for years to just get an admission from the controller back that they violated the law. A quick exchange between the parties allows understanding the core arguments of the parties, the scope of the dispute, the option to settle the case quickly and/or the need to investigate certain matters further.

[60] This is an addition to the other two options in Article 60(8) “rejection” and “dismissed”.

[61] This makes clear that an “amicable resolution” is based on the consent of the complainant to withdraw the complaint.

[62] For example, when a complainant cannot be contacted anymore or does not participate in the procedure anymore.

[63] For example, a party does not exist anymore.

[64] This should open the path to a legal remedy in all cases that are not a “dismissal” or “rejection” of a case.