
Article European Law | 28/07/23 | 1 min. |
On July 4th, the European Commission put forth a significant proposal aiming to establish new procedural rules for handling complaints and conducting investigations by supervisory authorities concerning the cross-border application of the General Data Protection Regulation (GDPR). These rules would apply to contentious cases involving data protection authorities from multiple countries. This includes scenarios where data processing is carried out by a company with establishments in several European states or by a company established in one state but significantly affecting individuals in at least one other EU member state.
In the proposed reform, the Commission specifies that the data protection authority designated as the "lead authority" will share a "summary of essential points" with its counterparts. This summary will contain the main elements of the investigation and the lead authority's "preliminary opinion" on the case. This approach is intended to enable the lead authority to express its viewpoint from the outset of the case, potentially facilitating the emergence of a consensus among the different authorities, as governed by Article 60(1) of the GDPR.
The reform also aims to achieve swift dispute resolution and provide greater legal certainty for individuals and businesses. For individuals, the proposal involves clarifying the information required when submitting a complaint and ensuring their active involvement throughout the procedure. For businesses, the rules will specify their procedural rights when an authority investigates potential GDPR violations related to their actions.
With the European elections scheduled for June 2024, the European Parliament and the Council of the EU have less than a year to reach a consensus and finalize this project.