Data protection: agreement on clarifying cross-border enforcement

Harmonised rules to improve co-operation in cross-border cases

Aim is to speed up procedures, build consensus between authorities

Easier access to information for complainants

EP and Council negotiators have agreed on clarifying the rules for cross-border enforcement of the General Data Protection Regulation.

The European Parliament and the Polish Presidency of the Council have reached a provisional agreement on additional rules that aim to speed up the cross-border enforcement of the General Data Protection Regulation (GDPR) and clarify the relevant procedures and rights. The new law fleshes out earlier provisions on cross-border enforcement, including co-operation and dispute resolution.

Faster procedures

The law establishes deadlines for procedures to ensure that complaints are dealt with in a reasonable time. Once a lead supervisory authority has been established, it must finish the investigation and submit a draft decision within 15 months, unless the complexity of the case requires an extension of maximum 12 months.

It also introduces a simplified cooperation procedure which streamlines the rules when there is no doubt about the scope of the investigation, no objection is raised by the other authorities, and the lead authority has faced similar investigations in the past. In such cases, the deadline for investigations is 12 months with a possible extension in cases where national law requires subsequent procedures.

The law encourages the national authorities to work towards a consensus from an early stage in the proceedings and introduces an early resolution procedure for cases where an authority can demonstrate that the infringement has ceased and the complainant does not object within four weeks.

Complainants’ rights

During negotiations, Parliament pushed for improving the rights of complainants and ensure the rights of parties under investigation. The agreement boosts complainants’ right to be heard, giving them an opportunity to make their views known before a decision regarding their complaint is made.

The agreed law also improves complainants’ access to information. They will have access to relevant files when they are being heard in the context of a procedure. Member states can also provide for greater access if they so choose.

Quote

Rapporteur Markéta Gregorová (Greens/EFA, CZ) said: ”This regulation will improve the cooperation between data protection authorities by ensuring that consensus on the case is reached early on while individuals’ and companies’ rights are fully guaranteed. This will foster consistent enforcement of the GDPR across Europe. All parties will have a voice in the process and national law providing additional rights is protected. On top of that, the EP secured that cases will now have an end date by setting deadlines that authorities must abide by. In line with the simplification objectives, we have also introduced a streamlined procedure to resolve straightforward cases more quickly, without compromising the rights of those involved.”

Background

The GDPR, which harmonised the data protection rights of EU citizens and ensured the free flow of personal data between the Member States, has been applicable since 25 May 2018. The public enforcement of the GDPR is handled by independent national data protection authorities (DPAs), which must cooperate on cross-border cases.