Regulation

To show that the broader concepts can also be turned into a real-life Regulation we have developed a Draft Regulation.

While it is by no means perfect or final, the draft lays down options for harmonised rules relating to procedural aspects of the cooperation between  supervisory authorities and the enforcement of the GDPR.

Article 29 – Remedies under Article 78 GDPR

Chapter VIII – Remedies

  1. Without prejudice to remedies under national law, each natural or legal person shall have the right to an effective judicial remedy:

    (a) against a legally binding decision of a supervisory authority concerning them;

    (b) where they are parties to the procedure[84] and the supervisory authorities do not handle a complaint or where the supervisory authorities to not decide over a complaint within the legally required deadlines under this Regulation, the GDPR or under applicable national law;

    (c) where they are parties to the procedure and where a supervisory authority does not comply with its obligations under this Regulation a decision by the Coordination Committee or the Board;[85]

    (d) where they are parties to the procedure and where a supervisory authority does not use its discretionary powers to ensure that another supervisory authority progresses the procedure;[86] or

    (e) where they are data subject and are not provided with the information under Article 77(2) GDPR every three months.

  2. Without prejudice to national law and Article 78(3) GDPR, any supervisory authority concerned may be joined to a national procedure in another Member State.[87]

Article 30 – Additional remedies before national courts

Chapter VIII – Remedies

Without prejudice to the rights under Article 78 GDPR and national laws, the parties to the procedure have the right to seek judicial redress if a supervisory authority does not comply with this Regulation, a decision by the Coordination Committee or the Board.

[84] This limits the possible applicants to parties of the procedure.

[85] This could allow for national enforcement of EDPB decisions, as the EDPB seems to lack the power to act

[86] While the Court of one Member State does not have jurisdiction over the SA in another Member State,

[87] This could ensure that data subjects can bring procedures before their home court and at least have the LSA heard, even if the Court may not have direct jurisdiction over the LSA. This should ensure that national courts can have a full overview in cases of cooperation issues and hear all SAs.