Data protection: Commission adopts new rules to ensure stronger enforcement of the GDPR in cross-border cases

This article is brought to you in association with the European Commission.

Today, the Commission proposes a new law to streamline cooperation between data protection authorities (DPAs) when enforcing the General Data Protection Regulation in cross-border cases. The new regulation will set up concrete procedural rules for the authorities when applying the GDPR in cases which affect individuals located in more than one Member State. For example, it will introduce an obligation for the lead Data Protection Authority to send a ‘summary of key issues’ to their counterparts concerned, identifying the main elements of the investigation and its views on the case, and therefore allowing them to provide their views early on. The proposal will contribute to reduce disagreements and facilitate consensus among authorities since the initial stages of the process.

For individuals, the new rules will clarify what they need to submit when making a complaint and ensure that they are appropriately involved in the process. For businesses, the new rules will clarify their due process rights when a DPA investigates a potential breach of the GDPR. The rules will therefore bring swifter resolution of cases, meaning quicker remedies for individuals and more legal certainty for businesses. For data protection authorities, the new rules will smoothen cooperation and enhance efficiency of enforcement.

Harmonising procedural rules in cross-border cases

The new regulation provides detailed rules to support the smooth functioning of the cooperation and consistency mechanism established by the GDPR, harmonising rules in the following areas:

• Rights of complainants: The proposal harmonises the requirements for a cross-border complaint to be admissible, removing the current obstacles brought by DPAs following different rules. It establishes common rights for complainants to be heard in cases where their complaints are fully or partially rejected. In cases where a complaint is investigated, the proposal specifies rules for them to be properly involved.
• Rights of parties under investigation (controllers and processors): The proposal provides the parties under investigation with the right to be heard at key stages in the procedure, including during dispute resolution by the European Data Protection Board (EDPB), and clarifies the content of the administrative file and the parties’ rights of access to the file.
• Streamlining cooperation and dispute resolution: Under the proposal, DPAs will be able to provide their views early on in investigations, and make use of all the tools of cooperation provided by the GDPR, such as joint investigations and mutual assistance. These provisions will enhance DPAs’ influence over cross-border cases, facilitate early consensus-building in the investigation, and reduce later disagreements. The proposal specifies detailed rules to facilitate the swift completion of the GDPR’s dispute resolution mechanism, and provides common deadlines for cross-border cooperation and dispute resolution.

The harmonisation of these procedural aspects will support the timely completion of investigations and the delivery of a swift remedies for individuals.

Background

As we have seen, the GDPR works. The Commission’s Regulation does not affect any substantial elements of the GDPR, such as the rights of data subjects, the obligations of data controllers and processors, or the lawful grounds for processing personal data as set by the GDPR. Since the GDPR entered into force, over 2,000 ‘one-stop-shop’ cases have been created in the EDPB’s case register, and 711 final decisions have been taken. In some cases, fines of hundreds of millions of euros have been imposed. The next report on the application of the GDPR is due in 2024.

The GDPR is enforced by independent national DPAs, as well as national courts. In cases that involve processing that takes place, or substantially affects data subjects in more than one Member State, the GDPR’s ‘one-stop-shop’ enforcement system applies. This means that the DPA where the entity under investigation is based conducts the investigation in cooperation with other concerned DPAs. Under the GDPR, DPAs cooperate in an endeavour to reach consensus on the application of the GDPR in cross-border cases. Where DPAs are unable to reach consensus, the GDPR provides for dispute resolution by the European Data Protection Board (EDPB).

When enforcing the GDPR, DPAs apply national procedural rules. In its 2020 report on the application of the GDPR, the Commission noted that procedural differences applied by DPAs hinder the smooth and effective functioning of the GDPR’s cooperation and dispute resolution mechanisms. In October 2022, the EDPB sent the Commission a ‘wish-list‘, containing suggestions to streamline and improve some procedural aspects to strengthen cooperation and help to deliver a quicker remedy for data subjects.

Today’s proposal addresses the input from a wide range of stakeholders, including the EDPB, representatives from civil society, businesses, academia, and legal practicioners, as well as Member States. From February to March 2023, the Commission published a call for evidence, receiving feedback from a wide variety of stakeholders, including civil society and industry associations. The Commission also held bilateral meetings on the proposal on request, with civil society representatives,