To show that the broader concepts can also be turned into a real-life Regulation we have developed a Draft Regulation.

While it is by no means perfect or final, the draft lays down options for harmonised rules relating to procedural aspects of the cooperation between  supervisory authorities and the enforcement of the GDPR.

Article 21 – Scope and Initiation

Chapter VI – Consistency Procedure

  1. The scope of the consistency procedure is defined by the relevant and reasoned objections under Article 60(4) GDPR.

  2. When the lead supervisory authority received objections that it does not intend to follow under Article 60(4) GDPR:

    (a) it shall share the case file and the reasoned objections with the parties to the procedure within two weeks,

    (b) request a statement from the parties to the procedure on the draft decision and the reasoned objections within another two weeks[78] and

    (c) it shall submit the matter to the Board within further two weeks.

  3. Should the lead supervisory authority fail to submit the matter to the Body within the period above, any party to the procedure and any concerned supervisory authorities may submit the matter to the Board for a decision under Article 65(1)(a) GDPR.

Article 22 – Referral and assessment of the case file

Chapter VI – Consistency Procedure

  1. The lead supervisory authority shall refer the entire case file and at least the following documents to the Board:

    (a) an objective and concise summary of the case, including all relevant facts and legal questions, an objective overview of arguments submitted by all parties of the procedures insofar as it relates to the scope of the consistency procedure;

    (b) a concise summary of the proposed final decision of the lead supervisory authority and an explanation as to the reasons why the lead supervisory authority does not follow the reasoned objection or is of the opinion that the objection is not relevant or reasoned;

    (c) the draft decision or revised draft decision subject to the reasoned objections;

    (d) the objections made by the supervisory authorities concerned;

    (e) the written observations submitted by the parties of the procedure in the national procedure and under Article 21(2)(b).

  2. Within two weeks from the referral, the Board shall either accept the case and or reject it as being incomplete. In such a case, the lead supervisory authority shall provide any missing information within two weeks. The Board shall inform the supervisory authorities and the parties to the procedure about any acceptance or rejection of the case.

Article 23 – Investigations by the Board

Chapter VI – Consistency Procedure

  1. The Board shall give due regard to the statements of the parties of the procedure, as provided under Article 21(2)(b), the draft decision and the reasoned objections.

  2. The Board shall rely on the case file when making its decision, unless there is probable cause that the case file is not fully representative of the facts of the case or there Board deems it impossible to decide on the case without further information.

  3. In such a case, the Board may rely on Article 61 GDPR and request supervisory authorities to gather additional information, conduct its own investigations or conduct an oral hearing of the parties to the procedure.

  4. The duration of the procedure under paragraph 3 shall be excluded from the deadline under Article 65(2) GDPR.

Article 24 – Rapporteur

Chapter VI – Consistency Procedure

  1. The decisions shall be prepared and drafted by the Secretariat and upon decision of the Chair, together with a Rapporteur and expert subgroups members. The concerned supervisory authorities and the lead supervisory authority cannot be the Rapporteur. The Secretariat can act as Rapporteur.

  2. The Rapporteur shall make sure that the procedural requirements are met, that the file is complete, that the rights of the parties are respected. The Rapporteur shall present the matter to the Board.

Article 25 – Decision of the Board

Chapter VI – Consistency Procedure

  1. The decision of the Board shall address all matters within the scope of the procedure. Decisions by the Board must be specific enough that the lead authority can clearly determine the required contents of a legally binding decision.

Article 26 – Procedure

Chapter VI Consistency Procedure

The Board can further specify procedural rules in its rules of procedure adopted according to Article 72(2) GDPR. These rules shall especially regulate:

  1. the use of languages before the Board and matters of translations;

  2. the format and the length of documents that must be submitted before the Board;

  3. standard forms to be used by supervisory authorities and the parties to the procedure;

[78] This would ensure that the right to be heard (Article 41 CFR) is taken care of by the SAs.