To show that the broader concepts can also be turned into a real-life Regulation we have developed a Draft Regulation.

While it is by no means perfect or final, the draft lays down options for harmonised rules relating to procedural aspects of the cooperation between  supervisory authorities and the enforcement of the GDPR.

Article 33 – Deadlines

Chapter X – Final provisions

  1. Regulation 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits shall apply to this Regulation.

  2. In exceptional cases and in accordance with national procedural law, deadlines under this Regulation may be extended by supervisory authorities or the Board to the minimum necessary. Such exceptional cases are for example force majeure, strict inability of the parties to comply with deadlines.

Article 34 – Forms and data structures

Chapter X – Final provisions

Without prejudice to Articles 61(9), and 67 GDPR, the Commission may, by means of implementing acts, specify the format and procedures for steps referred to in this Regulation and the arrangements for the exchange of information by electronic means between supervisory authorities, and between supervisory authorities and the Board. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2).

Article 35 – Statistics

Chapter X – Final provisions

  1. Supervisory authorities must report the following numbers in their activity report under Article 59 GDPR:

    (a) the number of ex officio investigations initialed by the supervisory authority;

    (b) the number of ex officio investigations initiated by another supervisory authorities;

    (c) the number of complaints under Article 77 GDPR received, including the number that were rejected, dismissed, closed, partly upheld and fully upheld;

    (d) the number of legally binding decisions currently on appeal;

    (e) the number and average duration of open and decided procedures under (a) to (d) to date;

    (f) the number of each type of measure taken in accordance with Article 58(2) GDPR or applicable national law;

    (g) the number and the overall amount of fines issued and collected under Article 83 and 84 GDPR or relevant national law;

    (h) andthe annual budget and the number of staff, itemized by training, tasks and organizational units.

  2. Supervisory authorities must publish the activity report for the past year without undue delay, but no later than 30 June.

  3. The Board shall make the information of all supervisory authorities in paragraph 1 available to the public no later than 31 July of each year.

Article 36 – Entry into force and application

Chapter X – Final provisions

  1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

  2. It shall apply to procedures initiated after 31. December 2023.