資料由法律人 LawPlayer整理提供·EU law / curated by LawPlayer from EUR-Lex
This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the enforcement of Regulation (EU) 2016/679 where those cases concern cross-border processing. The handling of complaints and the conduct of investigations in cases concerning cross-border processing includes the determination of whether a case concerns cross-border processing.
For the purposes of this Regulation the definitions in Article 4 of Regulation (EU) 2016/679 apply.
The following definition also applies:
‘party under investigation’ means the controller or processor investigated for an alleged infringement of Regulation (EU) 2016/679 that concerns cross-border processing.
1. Supervisory authorities shall conduct proceedings within the scope of this Regulation in an expedient and efficient manner. They shall cooperate with each other in a sincere and effective manner, including by providing support where necessary and responding to each other’s requests without delay.
2. A supervisory authority may join or separate proceedings in accordance with national procedural law, insofar as joining or separating those proceedings does not undermine the rights of the parties under investigation or those of the complainant.
3. A complainant shall have the possibility to communicate exclusively with the supervisory authority with which the complainant has lodged his or her complaint pursuant to Article 77 of Regulation (EU) 2016/679.
4. The handling of a complaint shall always lead to a decision that is subject to an effective judicial remedy within the meaning of Article 78 of Regulation (EU) 2016/679.
5. In the interest of efficiency of the proceedings, supervisory authorities may limit the length of the submissions of the party under investigation and of the complainant, taking into account the complexity of the case and the documents that have already been submitted.
1. A complaint on the basis of Regulation (EU) 2016/679 concerning cross-border processing shall be admissible provided that it includes the following information:
(a)
the name and contact details of the person lodging the complaint;
(b)
where the complaint is lodged by a not-for-profit body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, proof that that body, organisation or association has been properly constituted in accordance with the law of a Member State;
(c)
where the complaint is lodged on the basis of Article 80(1) of Regulation (EU) 2016/679, the name and contact details of the not-for-profit body, organisation or association lodging that complaint and proof that that body, organisation or association is acting on the basis of a mandate of a data subject;
(d)
information which facilitates the identification of the controller or processor that is the subject of the complaint;
(e)
a description of the alleged infringement of Regulation (EU) 2016/679.
No information additional to that referred to in the first subparagraph shall be required in order for a complaint concerning cross-border processing to be admissible.
Administrative modalities and requirements under the national procedural law of the supervisory authority with which the complaint has been lodged shall continue to apply.
2. Where the supervisory authority with which a complaint has been lodged determines that the complaint does not contain the information referred to in paragraph 1, first subparagraph, it shall, within two weeks of receiving that complaint, declare that complaint inadmissible and inform the complainant of the reasons thereof.
3. The complainant shall not be required to have contacted the party under investigation before lodging a complaint in order for that complaint to be admissible.
Without prejudice to the first subparagraph, where a complaint relates to the exercise of a right of the data subject that relies on the data subject concerned making a request to the controller, that request shall be made to the controller before that complaint is lodged.
4. The supervisory authority with which the complaint has been lodged shall determine, by way of a preliminary conclusion, the following:
(a)
whether the complaint concerns cross-border processing;
(b)
which supervisory authority it presumes to be competent to act as lead supervisory authority in accordance with Article 56(1) of Regulation (EU) 2016/679; and
(c)
whether Article 56(2) of Regulation (EU) 2016/679 applies.
5. Where a complaint that concerns cross-border processing is admissible and in the absence of an early resolution pursuant to Article 5, the supervisory authority with which the complaint has been lodged shall transmit that complaint to the supervisory authority it presumes is competent to act as lead supervisory authority no later than six weeks from the receipt of that complaint and inform the complainant of that transmission.
The determination of admissibility of a complaint by the supervisory authority with which that complaint has been lodged shall be binding on the lead supervisory authority.
6. Within six weeks of the receipt of a complaint, the supervisory authority presumed to be competent to act as lead supervisory authority shall either confirm its competence or, where there are conflicting views on which of the other supervisory authorities concerned is competent for the main establishment, refer the subject matter to the European Data Protection Board (the ‘Board’) for dispute resolution under Article 65(1), point (b), of Regulation (EU) 2016/679.
Where the supervisory authority presumed to be competent to act as lead supervisory authority does not confirm its competence or refer the subject matter to the Board within the time limit referred to in the first subparagraph, the supervisory authority with which the complaint has been lodged shall refer the subject matter to the Board for dispute resolution under Article 65(1), point (b), of Regulation (EU) 2016/679.
7. Without prejudice to its admissibility, the supervisory authority with which a complaint has been lodged or the lead supervisory authority may request the complainant to submit supplementary information in order to facilitate the handling of that complaint and enable its full investigation.
8. The lead supervisory authority shall inform the party under investigation of the lodging of a complaint and of its main elements without delay.
1. A complaint concerning cross-border processing which concerns the exercise of the rights of the data subject under Chapter III of Regulation (EU) 2016/679 may, where appropriate, be resolved through a procedure allowing for its early resolution by:
(a)
the supervisory authority with which the complaint has been lodged, after it has determined by way of preliminary conclusion that the complaint concerns cross-border processing and prior to the possible transmission of the complaint to the supervisory authority presumed to be competent to act as lead supervisory authority; or
(b)
the lead supervisory authority to which the complaint has been transmitted, at any time before the submission of the preliminary findings to the other supervisory authorities concerned pursuant to Article 19 of this Regulation, or, where the simple cooperation procedure referred to in Article 6 of this Regulation applies, before the submission of the draft decision.
Supervisory authorities may encourage and facilitate the early resolution of complaints, and communicate with the party under investigation or the complainant for this purpose, as appropriate.
2. For the purpose of early resolution, where the supervisory authority referred to in paragraph 1, first subparagraph, point (a) or (b), establishes, based on supporting evidence, that the alleged infringement has been brought to an end, that supervisory authority shall consider the complaint devoid of purpose.
Where the complaint has been found to be devoid of purpose, the supervisory authority referred to in paragraph 1, first subparagraph, point (a) or (b) shall, using clear and plain language, inform the complainant:
(a)
that the alleged infringement has been brought to an end and that it considers the complaint devoid of purpose;
(b)
of the consequences of the early resolution; and
(c)
of the possibility for the complainant to submit an objection to the early resolution within four weeks of receiving such information.
3. In a procedure before the supervisory authority with which a complaint has been lodged, where the complainant does not submit an objection within the time limit set out in paragraph 2, second subparagraph, point (c), that supervisory authority shall, within two weeks of the expiry of that time limit, establish that the complaint has been resolved and inform the complainant, the party under investigation, and, where applicable, the lead supervisory authority of that resolution.
4. In a procedure before the lead supervisory authority to which the complaint has been transmitted, where the complainant does not submit an objection within the time limit set out in paragraph 2, second subparagraph, point (c), of this Article, that lead supervisory authority shall submit a draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 within four weeks of the expiry of that time limit, with a view to adopting a final decision in accordance with Article 60(7) of Regulation (EU) 2016/679 establishing that the complaint has been resolved.
5. The early resolution of a complaint shall be without prejudice to the exercise by the lead supervisory authority of the powers set out in Article 58 of Regulation (EU) 2016/679 with regard to the same subject matter.
6. Articles 10 to 20 do not apply to complaints resolved pursuant to this Article.
1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it may cooperate with the other supervisory authorities concerned through a simple cooperation procedure, in accordance with this Article, where:
(a)
it considers that no reasonable doubt exists as to the scope of the investigation, in particular with regard to the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which is to be investigated; and
(b)
the legal and factual issues identified by the lead supervisory authority do not require the additional cooperation with the other supervisory authorities concerned that would be required for the purposes of a complex investigation, in particular where those issues can be addressed on the basis of previous decisions in similar cases.
Where the lead supervisory authority applies the simple cooperation procedure referred to in the first subparagraph, Articles 10, 11, 16, 19, 20, Article 23(1), points (a) and (b), and Article 23(2) of this Regulation shall not apply. The lead supervisory authority shall submit a draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 within the time limit referred to in Article 12(6) of this Regulation.
2. The lead supervisory authority shall notify the other supervisory authorities concerned of its intention to apply the simple cooperation procedure and provide information on the characteristics of the case relevant to establish whether the conditions set out in paragraph 1 of this Article have been fulfilled, within six weeks of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
3. Where any of the other supervisory authorities concerned object to the application of the simple cooperation procedure within two weeks of being notified thereof, that procedure shall not apply and the lead supervisory authority shall draft a summary of key issues in accordance with Article 10 and cooperate with the other supervisory authorities concerned under the procedures set out in Chapter III.
4. When applying the simple cooperation procedure, the lead supervisory authority shall, prior to the submission of a draft decision, ensure that, where applicable, the parties under investigation are provided with the right to be heard and that the complainant is provided with an opportunity to make his or her views known. For the purpose of this paragraph, administrative modalities and requirements under the national procedural law of the lead supervisory authority, or the supervisory authority with which the complaint has been lodged, where applicable, shall continue to apply.
5. Chapter III does not apply to cases handled by the supervisory authority concerned pursuant to Article 56(2) of Regulation (EU) 2016/679.
The provisions in this Section concern the cooperation between supervisory authorities and do not confer rights on, or limit the rights of, individuals or the parties under investigation.
While cooperating in an endeavour to reach consensus, as provided for in Article 60(1) of Regulation (EU) 2016/679, supervisory authorities may use all the means provided for in that Regulation, including mutual assistance pursuant to Article 61 of that Regulation and joint operations pursuant to Article 62 of that Regulation.
1. The lead supervisory authority and the other supervisory authorities concerned shall exchange the relevant information referred to in Article 60(1) and (3) of Regulation (EU) 2016/679. That information shall include, where applicable:
(a)
information on the opening of an investigation of an alleged infringement of Regulation (EU) 2016/679;
(b)
requests for information pursuant to Article 58(1), point (e), of Regulation (EU) 2016/679 and related documents resulting from those requests;
(c)
information on the use of other investigative powers referred to in Article 58(1) of Regulation (EU) 2016/679 and related documents resulting from the exercise of those investigative powers;
(d)
in the event that a full or partial rejection or dismissal of a complaint is intended, the lead supervisory authority’s reasons for rejection or dismissal of the complaint;
(e)
information on the early resolution of the complaint pursuant to Article 5 of this Regulation;
(f)
the summary of key issues and comments on that summary referred to in Article 10 of this Regulation;
(g)
information on the scope of investigation;
(h)
information on developments or findings which might lead to the modification of the scope of investigation or the initiation of a new investigation;
(i)
information concerning steps taken and legal analysis carried out aiming to determine whether there has been an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision;
(j)
preliminary findings;
(k)
the responses of the parties under investigation to the preliminary findings;
(l)
the views of the complainant on the non-confidential version of the preliminary findings and, if relevant, on other aspects of the investigation on which formal written submissions might have been made by the complainant;
(m)
in the event of a full or partial rejection or dismissal of a complaint, the written submissions of the complainant;
(n)
information on any relevant steps taken by the lead supervisory authority after receiving the responses of the parties under investigation to the preliminary findings and prior to submission of a draft decision referred to in Article 60(3) of Regulation (EU) 2016/679;
(o)
the views of the parties under investigation on a revised draft decision;
(p)
any other information deemed useful and relevant for the investigation.
2. In the course of the investigation, the lead supervisory authority and the other supervisory authorities concerned shall exchange the information referred to in paragraph 1 of this Article as soon as possible and no later than one week from when such information becomes available, unless otherwise provided for in this Regulation or in Regulation (EU) 2016/679.
3. The Board may specify the modalities and requirements for the exchange of relevant information between supervisory authorities.
1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.
2. The summary of key issues shall include the following:
(a)
the main relevant facts;
(b)
a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which is to be investigated;
(c)
legal and factual issues identified;
(d)
an analysis of relevant views expressed by the party under investigation or the complainant where those views are available at the time of drafting the summary of key issues;
(e)
where applicable, preliminary identification of potential corrective measures.
3. The lead supervisory authority shall provide the other supervisory authorities concerned with the summary of key issues without delay, and within three months of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
4. The supervisory authorities concerned may provide comments on the summary of key issues within four weeks of receipt of that summary. The lead supervisory authority may extend that period by two weeks due to the complexity of the case or upon the request of the other supervisory authorities concerned.
5. Where the supervisory authorities concerned provide comments pursuant to paragraph 4, those comments shall be shared with all the other supervisory authorities concerned. The lead supervisory authority shall respond to those comments within four weeks of the expiry of the period referred to in paragraph 4 indicating whether and how it intends to take them into account. The lead supervisory authority may extend that period by two weeks due to the complexity of the case.
6. When transferring a case to the lead supervisory authority, the supervisory authority with which the complaint has been lodged may provide information relevant for the preparation of the summary of key issues to the lead supervisory authority.
7. The Board may specify the modalities and requirements for the provision of comments by the supervisory authorities concerned on the summary of key issues.
1. Pursuant to Article 60(1) of Regulation (EU) 2016/679, the lead supervisory authority and the other supervisory authorities concerned shall endeavour to reach consensus on cases concerning cross-border processing, in accordance with this Article, and may use all the means provided for in Regulation (EU) 2016/679, including mutual assistance pursuant to Article 61 of Regulation (EU) 2016/679 and joint operations pursuant to Article 62 of that Regulation.
2. Where a supervisory authority concerned disagrees with the lead supervisory authority and in the absence of consensus, that supervisory authority may make a request for mutual assistance under Article 61 of Regulation (EU) 2016/679 to the lead supervisory authority or may request the lead supervisory authority to conduct joint operations pursuant to Article 62 of that Regulation, or both, in order to reach consensus on the following:
(a)
the scope of the investigation in complaint-based cases, including the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement to be investigated;
(b)
the legal or factual issues referred to in Article 10(2), point (c), of this Regulation, where applicable;
(c)
the preliminary identification of potential corrective measures pursuant to Article 10(2), point (e), of this Regulation.
3. A request under paragraph 2 of this Article shall be made within one month of the expiry of the period referred to in Article 10(5).
4. Where a request to conduct joint operations pursuant to Article 62 of Regulation (EU) 2016/679 is made pursuant to paragraph 2 of this Article, the lead supervisory authority shall respond to that request within one month of its receipt.
5. The lead supervisory authority shall engage with the other supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Articles 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach consensus. The consensus on matters referred to in paragraph 2 of this Article shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings or, where applicable, to provide the supervisory authority with which the complaint has been lodged with the reasoning for the purposes of Article 16(1) of this Regulation.
6. Where, in a complaint-based investigation, following the procedures under Article 10(5) of this Regulation and paragraph 5 of this Article, there is no consensus between the lead supervisory authority and one or more other supervisory authorities concerned on the preliminary identification of the scope of the investigation referred to in Article 10(2), point (b), of this Regulation, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met and the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679.
7. When requesting an urgent binding decision of the Board pursuant to paragraph 6 of this Article, the lead supervisory authority shall provide the Board with the following:
(a)
the information referred to in Article 10(2);
(b)
the comments of the other supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation;
(c)
further exchanges between the lead supervisory authority and the other supervisory authorities concerned under Article 10(5) and Article 11(5);
(d)
any other relevant document or information requested by the Board.
8. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of all the information received.
1. The lead supervisory authority shall submit a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 within 15 months of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
2. Where the lead supervisory authority makes a request pursuant to Article 11(6), the time limit referred to in paragraph 1 of this Article shall be suspended until the Board has adopted its binding decision.
3. On an exceptional basis, the lead supervisory authority may extend the time limit referred to in paragraph 1 once, for a period of no longer than 12 months, due to the complexity of the case. The lead supervisory authority shall inform the other supervisory authorities concerned of its intention to extend the time limit referred to in paragraph 1, setting out the duration of and the reasons for the intended extension, at least four weeks before the expiry of the time limit referred to in paragraph 1.
4. Any supervisory authority concerned may submit an objection to the extension of the time limit within two weeks of being informed thereof pursuant to paragraph 3. That authority shall set out the reasons for its objection. When determining whether to extend the time limit referred to in paragraph 1 and, where applicable, the duration of that extension, the lead supervisory authority shall take due account of such an objection.
5. Where the lead supervisory authority extends the time limit referred to in paragraph 1 of this Article in accordance with paragraphs 3 and 4 of this Article, any other supervisory authority concerned may inform the lead supervisory authority that it considers there is a need to act in order to protect the rights and freedoms of data subjects. Where the lead supervisory authority does not submit a draft decision within the extended time limit, a supervisory authority that has informed the lead supervisory authority of a need to act in order to protect the rights and freedoms of data subjects may adopt a provisional measure on the territory of its Member State in accordance with Article 55 of Regulation (EU) 2016/679. In that case, the urgent need to act under Article 66(1) of Regulation (EU) 2016/679 shall be presumed to be met.
6. Where the simple cooperation procedure under Article 6 of this Regulation is applied, the lead supervisory authority shall submit a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 within 12 months of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
Where national law requires prior or subsequent domestic proceedings which necessitate that a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 be submitted after the expiry of the time limit referred to in the first subparagraph, the lead supervisory authority may extend that time limit once, for a period of no longer than two months. In such a case, the lead supervisory authority shall inform the other supervisory authorities concerned of the extension of the time limit, setting out the duration of that extension, at least two weeks before the expiry of the time limit referred to in the first subparagraph.
1. Where national law requires that subsequent domestic proceedings related to the same case be opened after the adoption of a decision pursuant to Article 18 or 21, the lead supervisory authority shall:
(a)
not draft a new summary of key issues;
(b)
repeat the procedural steps in accordance with Article 16 or Articles 19 and 20 only where the lead supervisory authority’s factual or legal assessment differs from a preceding decision adopted pursuant to Article 18 or 21; and
(c)
submit a draft decision before adopting any subsequent decision that is different from a preceding decision pursuant to Article 18 or 21.
2. The time limits referred to in Article 12 shall apply to the submitting of a draft decision in any subsequent proceedings referred to in paragraph 1 of this Article.
Where this Regulation or Article 65(6) of Regulation (EU) 2016/679 requires that a supervisory authority take a procedural step within a specified time limit, taking such a step after the expiry of that time limit shall not affect the legality or validity of that procedural step or of the final decision.
In determining whether a supervisory authority has not handled a complaint pursuant to Article 78(2) of Regulation (EU) 2016/679, consideration shall be given to whether that supervisory authority, within the time limit provided for in this Regulation or in Article 65(6) of Regulation (EU) 2016/679, including any possible extensions of such a time limit, has not:
(a)
submitted a draft decision or revised draft decision; or
(b)
adopted a final decision.
1. Where the lead supervisory authority intends to fully or partially reject or dismiss a complaint, it shall, prior to submitting a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679, provide the supervisory authority with which the complaint has been lodged with the reasons for its preliminary view that the complaint is to be fully or partially rejected or dismissed.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the reasons for the preliminary view referred to in the first subparagraph, provide the complainant with the opportunity to make his or her views known in writing and inform the complainant of the consequences of not making his or her views known.
The lead supervisory authority shall set an appropriate time limit for the complainant to make his or her views known. That time limit shall be no shorter than three weeks and no longer than six weeks.
2. The supervisory authority with which the complaint has been lodged shall transmit any views made known by the complainant to the lead supervisory authority, as soon as possible and no later than one week from when they become available.
3. Where the views made known by the complainant in accordance with paragraph 1 of this Article do not lead to a change of the preliminary view referred to in paragraph 1, first subparagraph of this Article, the lead supervisory authority, in cooperation with the supervisory authority with which the complaint has been lodged, shall prepare a draft decision and submit it to the other supervisory authorities concerned, in accordance with Article 60(3) of Regulation (EU) 2016/679.
4. Where the draft decision submitted pursuant to paragraph 3 concludes that the complaint is to be partially rejected or dismissed, the lead supervisory authority shall continue its investigation in cooperation with the other supervisory authorities concerned on the part of the complaint which remains to be investigated.
Where the lead supervisory authority determines that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679, fully or partially rejecting or dismissing a complaint, raises new elements on which the complainant should have the opportunity to make his or her views known, the supervisory authority with which the complaint has been lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the opportunity to make his or her views known on such new elements in accordance with Article 16 of this Regulation.
When adopting a decision fully or partially rejecting or dismissing a complaint in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the supervisory authority with which the complaint has been lodged shall inform the complainant of the judicial remedy available to him or her in accordance with Article 78 of Regulation (EU) 2016/679.
1. Following the consultations and procedures under Articles 10 and 11 of this Regulation, where the lead supervisory authority intends to submit a draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679 finding an infringement of Regulation (EU) 2016/679 to the other supervisory authorities concerned, it shall draft preliminary findings.
2. The preliminary findings shall include the findings of the investigation and present allegations raised in an exhaustive and sufficiently clear manner to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, the preliminary findings shall set out clearly all the facts, the list of the evidence relied upon and the entire legal assessment raised against the parties under investigation, so that they can express their views on those facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679.
The preliminary findings shall indicate, based on the information available at that stage and without prejudice to the views of the parties under investigation, corrective measures the lead supervisory authority considers using.
Where the lead supervisory authority, based on the information available at that stage and without prejudice to the views of the parties under investigation, considers whether to impose an administrative fine in accordance with Article 83 of Regulation (EU) 2016/679, it shall list in the preliminary findings the main legal and factual elements, which are known to it, and on which it intends to rely when deciding whether to impose an administrative fine and on the amount of the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it intends to take into account.
3. The lead supervisory authority shall transmit the preliminary findings to the other supervisory authorities concerned. Those authorities may provide comments on those findings to the lead supervisory authority within four weeks from the transmission of the preliminary findings to the other supervisory authorities concerned. Upon request of one of the other supervisory authorities concerned, the lead supervisory authority shall extend that period by two weeks.
4. The lead supervisory authority shall notify the preliminary findings, where relevant as amended to take into account comments provided by the other supervisory authorities concerned, to each of the parties under investigation.
5. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set an appropriate time-limit no shorter than three weeks and no longer than six weeks from the date of notification, within which those parties may provide their views in writing, or hold a hearing within the same time-limit in order to hear the views of the parties under investigation orally.
6. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Articles 24 and 25.
7. The parties under investigation may, in their reply to preliminary findings, set out all facts and legal arguments known to them that are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall base its draft decision only on the allegations and facts and the legal assessment based on those facts in respect of which the parties under investigation have been given the opportunity to provide their views.
1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint has been lodged shall provide the complainant with those preliminary findings, in accordance with rules on access to the administrative file and on confidential information under Articles 24 and 25, and the lead supervisory authority shall set an appropriate time-limit no shorter than three weeks and no longer than six weeks, within which the complainant may make his or her views known in writing.
2. For the purpose of paragraph 1, administrative modalities and requirements under national procedural law of the supervisory authority with which the complaint has been lodged shall continue to apply.
3. Paragraph 1 of this Article shall also apply where the lead supervisory authority:
(a)
handles a complaint jointly with other complaints;
(b)
handles a part of a complaint separately; or
(c)
modifies the scope of the investigation in the preliminary findings in any way, including after a binding decision of the Board pursuant to Article 11(8).
1. After submitting the draft decision to the other supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of those other supervisory authorities object to the draft decision within the periods referred to in Article 60(4) or (5) of Regulation (EU) 2016/679, as applicable, the lead supervisory authority shall, within one month from the end of the period referred to in Article 60(4) or (5) of Regulation (EU) 2016/679:
(a)
adopt its decision referred to in Article 60(7) or, where applicable, Article 60(9), of Regulation (EU) 2016/679; and
(b)
notify the decision referred to in point (a) to the main establishment or single establishment of the controller or processor, as the case may be.
2. The information to be provided to the complainant pursuant to Article 60(7) and (9) of Regulation (EU) 2016/679 shall consist of:
(a)
a version of the decision adopted that includes its operative part in full and the grounds of that decision that do not include elements considered confidential in accordance with Article 25 of this Regulation; or
(b)
a summary of the decision adopted, including the relevant facts and grounds of that decision.
In any event, the complainant shall, upon request, be provided with a version of the decision referred to in the first subparagraph that includes its operative part in full and the grounds of that decision that do not include elements considered confidential in accordance with Article 25 of this Regulation.
Administrative modalities and requirements under the national procedural law of the lead supervisory authority shall continue to apply.
1. Where the lead supervisory authority determines that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679, finding an infringement of Regulation (EU) 2016/679, raises new elements on which the parties under investigation are to have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the opportunity to make their views known on such new elements.
2. The lead supervisory authority shall set an appropriate time-limit no shorter than three weeks and no longer than six weeks within which the parties under investigation may make their views known.
3. The lead supervisory authority shall inform the other supervisory authorities concerned of the views made known by the parties under investigation, as soon as possible and no later than one week from when they become available.
1. A relevant and reasoned objection, as defined in Article 4, point (24), of Regulation (EU) 2016/679, shall:
(a)
be based on factual and legal elements included in the draft decision or the cooperation file;
(b)
not concern the scope of an investigation where none of the supervisory authorities concerned have provided comments in accordance with Article 10(4) of this Regulation or where consensus has been reached following comments received, or the scope of an investigation as defined in a binding decision of the Board adopted under Article 11(8) of this Regulation;
(c)
not concern a draft decision adopted in accordance with Article 5 of this Regulation.
2. Notwithstanding paragraph 1, point (b), a supervisory authority concerned may submit relevant and reasoned objections that concern the scope of an investigation referred to in paragraph 1, point (b), in duly justified cases, provided that:
(a)
the lead supervisory authority has failed to investigate all the elements of the summary of key issues on which consensus was reached pursuant to Article 10(5) or Article 11(5), or has failed to comply with the binding decision of the Board under Article 11(8); or
(b)
new elements, not available at the time of reaching consensus on the summary of key issues pursuant to Article 10(5) or Article 11(5), or at the time of the binding decision of the Board under Article 11(8), demonstrate a significant risk posed by the draft decision as regards the fundamental rights and freedoms of the data subject and, where applicable, the free flow of personal data within the Union; or both.
3. A relevant and reasoned objection shall be sufficiently clear, coherent and precise and, where necessary, it shall identify the elements of the draft decision to be amended in order to enable supervisory authorities to prepare their positions and, as the case may be, to enable the Board to efficiently resolve the dispute.
1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 shall consist of the documents which have been obtained or produced by the lead supervisory authority and the other supervisory authorities concerned and assembled by the lead supervisory authority during the investigation procedure, including all inculpatory and exculpatory evidence.
The administrative file shall not include internal communications within a supervisory authority.
2. Upon request of a party under investigation, or a complainant where the decision is liable to affect his or her interests adversely, the lead supervisory authority shall grant access to the administrative file to the parties under investigation, or the complainant, enabling them to exercise their right to be heard.
The first subparagraph shall be without prejudice to more favourable rules on granting access to the administrative file under the national law of the lead supervisory authority.
Where access is granted in accordance with the first subparagraph, the party under investigation shall be provided with such access by the lead supervisory authority, while the complainant shall be provided with such access by the supervisory authority with which the complaint has been lodged.
3. The following documents or parts of the following documents shall be excluded from access, notwithstanding whether access is granted under Union or national law:
(a)
correspondence or deliberations between the supervisory authorities;
(b)
confidential information pursuant to Article 25(1).
4. The lead supervisory authority shall grant access to relevant and reasoned objections submitted pursuant to Article 60(4) of Regulation (EU) 2016/679 on the basis of which that supervisory authority intends to adopt a revised draft decision only where such access is necessary to enable the parties under investigation or the complainant to make their views known and defend their rights.
1. Any information, documents or parts of documents shall be considered confidential in so far as they contain trade secrets as defined in Directive (EU) 2016/943 of the European Parliament and the Council ( 5 ) or other confidential information in accordance with Union or national law.
2. Unless otherwise provided for by Union or national law, information collected, produced or obtained by a supervisory authority in a case concerning cross-border processing under Regulation (EU) 2016/679, which is considered confidential pursuant to paragraph 1, shall not be communicated or made accessible to a party under investigation, a complainant or any third person.
3. A party under investigation, a complainant, or a third person submitting information that it considers to be confidential shall clearly identify that information, giving reasons for the confidentiality claimed. The party under investigation, complainant, or third person shall always provide the full version of the information. Where possible, it shall also provide a proposed non-confidential version.
4. Without prejudice to paragraph 3, the supervisory authority to which the information is submitted may require the parties under investigation, or any other person that submits documents, to identify the documents or parts of documents that they consider to contain trade secrets or other confidential information belonging to them and to identify the persons concerned with regard to the confidentiality of those trade secrets or other confidential information.
5. The supervisory authority to which the information is submitted shall set an appropriate time-limit no longer than six weeks for parties under investigation and any other person claiming that the information submitted is confidential to:
(a)
substantiate their claims that the information submitted contains trade secrets or other confidential information for each individual document or part of document, statement, or part of statement;
(b)
propose, where possible, a non-confidential version of the documents and statements, in which the trade secrets or other confidential information are redacted;
(c)
provide a concise, non-confidential, description of each piece of redacted information.
6. If the parties under investigation or any other person fails to comply with paragraphs 4 and 5, the supervisory authority to which the information is submitted may assume that the documents or statements concerned do not contain trade secrets or other confidential information.
7. The supervisory authority to which the information is submitted shall determine whether or not the information or relevant and specific parts of documents are confidential, in accordance with paragraph 1. It shall ensure that the redaction of documents is limited to what is necessary and proportionate to protect the confidential information. The supervisory authority to which the information is submitted shall inform the other supervisory authorities about the confidential nature of the information when transmitted.
8. Information regarded as confidential information under the national law of the supervisory authority to which the information is submitted and exchanged between supervisory authorities in the application of Regulation (EU) 2016/679, shall continue to be treated as confidential by the supervisory authority receiving it.
1. For the purpose of exchanging relevant information between the lead supervisory authority and other supervisory authorities concerned in accordance with Article 9, the lead supervisory authority shall ensure such relevant information is made available through a cooperation file dedicated to each complaint or investigation. The cooperation file shall include all information exchanged pursuant to Article 9.
2. The cooperation file shall be maintained in electronic form and shall, by means of a common electronic tool, be remotely accessible to supervisory authorities and, upon referral of a matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679, and, where applicable, when an urgent opinion or an urgent binding decision is requested pursuant to Article 66 of that Regulation, to the Board. The cooperation file shall not be directly accessible to parties under investigation, complainants or third persons.
1. Within three months of the expiry of the period referred to in Article 60(4) of Regulation (EU) 2016/679, the lead supervisory authority shall submit a revised draft decision pursuant to Article 60(5) of that Regulation or refer the subject matter to the Board for dispute resolution under Article 65(1), point (a), of that Regulation.
2. Within three months of the expiry of the period referred to in Article 60(5) of Regulation (EU) 2016/679, the lead supervisory authority shall submit another revised draft decision under 60(5) of that Regulation or refer the subject matter to the Board for dispute resolution under Article 65(1), point (a), of that Regulation.
3. When referring the subject matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679, the lead supervisory authority shall provide the Board with the following:
(a)
the draft decision or revised draft decision subject to the relevant and reasoned objections;
(b)
a summary of the relevant facts;
(c)
views made in writing by the parties under investigation pursuant to Article 19 and, as the case may be, Article 22 of this Regulation, at least to the extent that those views relate to the subject matter submitted to the Board;
(d)
views made in writing by complainants, as the case may be, pursuant to Articles 16, 17, and 20 of this Regulation at least to the extent that those views relate to the subject matter submitted to the Board;
(e)
the relevant and reasoned objections which were not followed by the lead supervisory authority and the objections that the lead supervisory authority has rejected as being not relevant or reasoned;
(f)
the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or rejected the objections as not relevant or reasoned.
4. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
5. The Board shall, within four weeks of being provided with the documents and information referred to in paragraph 3 of this Article, make a preliminary determination of whether the objections referred to in Article 65(1), point (a), of Regulation (EU) 2016/679 are relevant and reasoned objections and whether they comply with Article 23 of this Regulation. Within that same period, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
6. The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall not run during the period provided for in paragraph 5 of this Article.
1. Prior to adopting the binding decision under Article 65(1), point (a), of Regulation (EU) 2016/679, the Board shall provide the party under investigation, or, where the Board’s decision could result in a full or partial rejection or dismissal of a complaint, the complainant, with the opportunity to make their views known in writing on any new factual or legal elements on which its decision is to be based, including on the relevant and reasoned objections which it intends to follow in its decision.
2. Where the party under investigations or the complainant, as applicable, are provided with an opportunity to make their views known in accordance with paragraph 1, the Board shall set an appropriate time limit not longer than two weeks for them to make their views known.
3. The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall be suspended until the party under investigation or the complainant, as applicable, have made their views known or until the expiry of the time limit referred to in paragraph 2 of this Article, whichever is the earlier.
1. When referring a subject matter to the Board under Article 65(1), point (b), of Regulation (EU) 2016/679, the supervisory authority referring the subject matter shall provide the Board with the following:
(a)
a summary of the relevant facts, including regarding the processing in question;
(b)
the assessment of those relevant facts in order to establish whether a supervisory authority is competent to act as lead supervisory authority pursuant to Article 56(1) of Regulation (EU) 2016/679, in particular the assessment as to whether the processing is to be considered as cross-border processing and as to where the main establishment of the controller or processor is located;
(c)
views made known by the controller or processor whose main establishment is the subject of the referral;
(d)
the views of other supervisory authorities concerned by the referral;
(e)
any other document or information the supervisory authority referring the subject matter considers relevant and necessary in order to find a resolution on the subject matter.
2. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
3. Within one week of being provided with the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
1. When referring a subject matter to the Board under Article 65(1), point (c), of Regulation (EU) 2016/679, the supervisory authority or the Commission shall provide the Board with the following:
(a)
a summary of the relevant facts;
(b)
the opinion, as the case may be, issued by the Board pursuant to Article 64 of Regulation (EU) 2016/679; or the decision, as the case may be, adopted by the competent supervisory authority following the opinion issued by the Board pursuant to Article 64 of Regulation (EU) 2016/679;
(c)
the views of the supervisory authority referring the subject matter or of the Commission as to whether, as the case may be, a supervisory authority was required to refer the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or whether a supervisory authority did not follow the opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an indication of which parts of that opinion were not followed and a reference to the relevant part of the adopted decision.
2. The Board shall request the following:
(a)
the views of the supervisory authority alleged to have breached the requirement to refer a draft decision to the Board or to have failed to follow an opinion of the Board;
(b)
any other document or information that that supervisory authority considers relevant and necessary in order to find a resolution on the subject matter.
3. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
4. Within one week of being provided with the documents and information referred to in paragraph 2, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
5. Where any supervisory authority declares its intention to submit its views on the referred subject matter, it shall submit those views within two weeks of the referral referred to in paragraph 1.
1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than four weeks prior to the expiry of provisional measures adopted under Article 66(1) of that Regulation and shall contain the following:
(a)
a summary of the relevant facts, including the allegations of infringement of Regulation (EU) 2016/679;
(b)
the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the urgent opinion, its duration and the reasons for adopting it, including a justification of the urgent need to act in order to protect the rights and freedoms of data subjects;
(c)
a justification of the urgent need for final measures to be adopted, including an explanation of the exceptional nature of circumstances requiring the adoption of those final measures.
2. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it for an urgent opinion.
3. Within one week of being provided with the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
1. A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than four weeks prior to the expiry of provisional measures adopted under Article 61(8), Article 62(7) or Article 66(1) of that Regulation. That request shall contain the following:
(a)
a summary of the relevant facts, including the allegations of infringement of Regulation (EU) 2016/679;
(b)
the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the urgent binding decision, its duration and the reasons for adopting it, including a justification of the urgent need to act in order to protect the rights and freedoms of data subjects;
(c)
information on any investigative measures taken on the territory of the Member State of the supervisory authority requesting the urgent binding decision and responses received from the parties under investigation or any other information in the possession of that requesting supervisory authority;
(d)
a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of those measures, or proof that a supervisory authority failed to comply with Article 61(5) or Article 62(2) of Regulation (EU) 2016/679;
(e)
where the requesting supervisory authority is not the lead supervisory authority, the views of the lead supervisory authority;
(f)
where applicable, the views of the local establishment of the parties under investigation to which the provisional measures referred to in Article 66(1) of Regulation (EU) 2016/679 were addressed.
2. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
3. Within one week of the receipt of the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
4. Where the Board adopts an urgent binding decision indicating that final measures are to be adopted, the supervisory authority to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.
5. Where an urgent binding decision indicates that final measures do not urgently need to be adopted, the lead supervisory authority and the other supervisory authorities concerned shall follow the procedure in Article 60 of Regulation (EU) 2016/679.
1. A request for an urgent opinion or an urgent binding decision of the Board pursuant to Article 66(3) of Regulation (EU) 2016/679 shall contain the following:
(a)
a summary of the relevant facts;
(b)
a justification of the urgent need to take appropriate measures in order to protect the rights and freedoms of data subjects, bearing in mind the exceptional circumstances requiring the adoption of such measures, in particular any elements which the competent supervisory authority should have taken into account in order to protect the rights and freedoms of data subjects;
(c)
where relevant and available, information on any investigative measures taken by the requesting supervisory authority on the territory of the Member State of the supervisory authority requesting an urgent opinion or an urgent binding decision and replies received from the parties under investigation or any other information in the possession of that requesting supervisory authority;
(d)
the views of the competent supervisory authority referred to in Article 66(3) of Regulation (EU) 2016/679.
2. The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
3. Within one week of being provided with the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
1. As part of the annual report to be drawn up under Article 71 of Regulation (EU) 2016/679, the Board shall provide statistics on the enforcement of Regulation (EU) 2016/679 in cases falling within the scope of this Regulation, and in particular:
(a)
the number of complaint-based and ex officio cases initiated;
(b)
the number of complaint-based and ex officio cases concluded;
(c)
the number of investigations requested by supervisory authorities concerned pursuant to Article 61(1) of Regulation (EU) 2016/679;
(d)
the number of complaints lodged;
(e)
the number of complaints fully or partially rejected or dismissed;
(f)
the average duration of complaint-based and ex officio cases concluded;
(g)
the number and amounts of administrative fines imposed pursuant to Articles 83 and 84 of Regulation (EU) 2016/679.
2. Where the statistics referred to in paragraph 1 are not directly available to the Board, the supervisory authorities shall, upon request, provide them to the Board in a timely manner.
The Commission, as part of its report on the evaluation and review of Regulation (EU) 2016/679 under Article 97 of that Regulation, shall also report on the application and functioning of this Regulation.
Chapters III and IV shall apply to ex officio investigations opened after 2 April 2027 and to complaint-based investigations where the complaint was lodged after 2 April 2027.
Chapters V and VI of this Regulation shall apply to all cases referred to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after 2 April 2027.
1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
2. This Regulation shall apply from 2 April 2027.
Regulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679 (Text with EEA relevance) (EUR-Lex). Retrieved via LawPlayer, https://lawplayer.com/eu/act/32025R2518
© European Union, https://eur-lex.europa.eu, 1998-2026. Reuse authorised under Commission Decision 2011/833/EU, provided the source is acknowledged.
本頁資料來源：EUR-Lex·整理提供：法律人 LawPlayer· lawplayer.com