European Union: Adopted EU Parliament position on proposal for a Regulation laying down additional procedural rules relating to the enforcement of GDPR

On 10 April 2024, the European Parliament adopted its position on the proposal for a Regulation laying down additional procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR). The regulation aims to harmonise rules for the handling of complaints and conducting investigations for the timely completion of investigations and the delivery of swift remedies for individuals. In particular, the proposed regulation harmonises the requirements for a cross-border complaint to be admissible and establishes common rights for complainants. The proposed regulation also outlines the rights of data controllers and processors under investigation, such as the right to be heard at important stages in the procedure and the right to access the administrative file. Further, the regulation would establish a cross-border cooperation framework between data protection authorities to facilitate the dispute resolution mechanism under Article 65 of the GDPR. Under the Parliament position, the procedural deadlines are amended to require the supervisory authorities to acknowledge receipt in 2 weeks and assess the admissibility of complaints. Within three weeks, authorities must determine if a case is cross-border and assign a lead authority, and the draft decisions would have to be issued within nine months of complaint receipt. Further, the Parliament amended the sections regarding the amicable settlements, requiring them to have the explicit consent of parties and enable the authorities to investigate on their own initiative conduct that was resolved in such settlements.