Council and European Parliament reach deal to make cross-border GDPR

The Council, represented by the Polish presidency of the Council of the EU, and the European Parliament secured a provisional deal on a new law which will improve cooperation between national data protection authorities when they enforce the General Data Protection Regulation (GDPR) in cross-border

We have taken a big step towards improving cooperation between national data protection bodies when they enforce citizens' rights under the General Data Protection Regulation. The objective is to speed up the process of handling cross-border GDPR complaints filed by citizens or organisations.

Krzysztof Gawkowski, Deputy Prime Minister, Minister for Digital Affairs

The European co-legislators agreed on rules that will streamline administrative procedures relating to, for instance, the rights of complainants or the admissibility of cases, and thus make enforcement of the GDPR, which has been in application since 25 May 2018, more efficient.

Admissibility

Once adopted, the regulation will speed up the process of handling cross-border GDPR complaints filed by citizens or organisations, and any follow-up investigations. This is due in particular to the harmonisation of the requirements for the admissibility of cross-border action. Regardless of where in the EU a citizen files a complaint relating to cross-border data processing, admissibility will be judged on the basis of the same information.

Rights of complainants and parties under investigation

The new regulation will harmonise the requirements and procedures for the complainant to be heard if a complaint is rejected and provides common rules on the involvement of the complainant in the procedure.

The right to be heard for the company or organisation that is being investigated is also ensured at key stages throughout the procedure.

The complainant and the company or organisation under investigation will be given the right to receive the preliminary findings (i.e. before the final decision) in order to express their views on it.

Deadlines

The new rules introduce deadlines for the completion of investigations. The co-legislators agreed on an overall investigation deadline of 15 months, which can be extended by 12 months for the most complex cases. In the case of a simple cooperation procedure between national data protection bodies, the investigation should be wrapped up within 12 months.

Swifter resolution of complaints

The Council and the European Parliament agreed on a mechanism to resolve complaints more swiftly. This early resolution mechanism allows data protection authorities to resolve a case before triggering the standard procedures for handling a cross-border complaint – in other words, before involving other national authorities. This may be the case where the company or organisation in question has addressed the infringement and where the complainant has not objected to the early resolution of the complaint.

Simple cooperation procedure

In order to avoid protracted discussions between the different data protection bodies on a specific case, the new law introduces measures to facilitate consensus-building. One such measure is an obligation for the lead authority to send a summary of key issues to their counterparts in the EU. This will ensure that they have all the necessary information to express their views on the case early on.

The final text maintains a proposal from the Council for a simple cooperation procedure, which offers the option of not applying all the additional rules when a case is more straightforward. This allows data protection authorities to avoid any administrative burden, to act swiftly on non‑contentious cases and to take advantage of the newly introduced additional cooperation rules for more complex investigations.

Next steps

The provisional agreement reached today will have to be confirmed by the Council and the European Parliament. The new rules will enter into force following the final adoption in both institutions.

Background

The GDPR, the EU's landmark data protection law, which harmonises data protection rights across Europe, has put in place a system of cooperation between national data protection bodies. Those authorities, which are responsible for enforcing the GDPR, are obliged to cooperate when a data protection case concerns cross-border processing. This is the case, for instance, when the complainant resides in a member state other than that of the company under investigation.

In such cross-border cases, a single national authority will take on the role of lead authority in the investigation, but is required to cooperate with its counterparts in other member states.