1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it may cooperate with the other supervisory authorities concerned through a simple cooperation procedure, in accordance with this Article, where:
|
(a) |
it considers that no reasonable doubt exists as to the scope of the investigation, in particular with regard to the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which is to be investigated; and |
|
(b) |
the legal and factual issues identified by the lead supervisory authority do not require the additional cooperation with the other supervisory authorities concerned that would be required for the purposes of a complex investigation, in particular where those issues can be addressed on the basis of previous decisions in similar cases. |
Where the lead supervisory authority applies the simple cooperation procedure referred to in the first subparagraph, Articles 10, 11, 16, 19, 20, Article 23(1), points (a) and (b), and Article 23(2) of this Regulation shall not apply. The lead supervisory authority shall submit a draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 within the time limit referred to in Article 12(6) of this Regulation.
2. The lead supervisory authority shall notify the other supervisory authorities concerned of its intention to apply the simple cooperation procedure and provide information on the characteristics of the case relevant to establish whether the conditions set out in paragraph 1 of this Article have been fulfilled, within six weeks of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
3. Where any of the other supervisory authorities concerned object to the application of the simple cooperation procedure within two weeks of being notified thereof, that procedure shall not apply and the lead supervisory authority shall draft a summary of key issues in accordance with Article 10 and cooperate with the other supervisory authorities concerned under the procedures set out in Chapter III.
4. When applying the simple cooperation procedure, the lead supervisory authority shall, prior to the submission of a draft decision, ensure that, where applicable, the parties under investigation are provided with the right to be heard and that the complainant is provided with an opportunity to make his or her views known. For the purpose of this paragraph, administrative modalities and requirements under the national procedural law of the lead supervisory authority, or the supervisory authority with which the complaint has been lodged, where applicable, shall continue to apply.
5. Chapter III does not apply to cases handled by the supervisory authority concerned pursuant to Article 56(2) of Regulation (EU) 2016/679.
The provisions in this Section concern the cooperation between supervisory authorities and do not confer rights on, or limit the rights of, individuals or the parties under investigation.
While cooperating in an endeavour to reach consensus, as provided for in Article 60(1) of Regulation (EU) 2016/679, supervisory authorities may use all the means provided for in that Regulation, including mutual assistance pursuant to Article 61 of that Regulation and joint operations pursuant to Article 62 of that Regulation.
1. The lead supervisory authority and the other supervisory authorities concerned shall exchange the relevant information referred to in Article 60(1) and (3) of Regulation (EU) 2016/679. That information shall include, where applicable:
|
(a) |
information on the opening of an investigation of an alleged infringement of Regulation (EU) 2016/679; |
|
(b) |
requests for information pursuant to Article 58(1), point (e), of Regulation (EU) 2016/679 and related documents resulting from those requests; |
|
(c) |
information on the use of other investigative powers referred to in Article 58(1) of Regulation (EU) 2016/679 and related documents resulting from the exercise of those investigative powers; |
|
(d) |
in the event that a full or partial rejection or dismissal of a complaint is intended, the lead supervisory authority’s reasons for rejection or dismissal of the complaint; |
|
(e) |
information on the early resolution of the complaint pursuant to Article 5 of this Regulation; |
|
(f) |
the summary of key issues and comments on that summary referred to in Article 10 of this Regulation; |
|
(g) |
information on the scope of investigation; |
|
(h) |
information on developments or findings which might lead to the modification of the scope of investigation or the initiation of a new investigation; |
|
(i) |
information concerning steps taken and legal analysis carried out aiming to determine whether there has been an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision; |
|
(j) |
preliminary findings; |
|
(k) |
the responses of the parties under investigation to the preliminary findings; |
|
(l) |
the views of the complainant on the non-confidential version of the preliminary findings and, if relevant, on other aspects of the investigation on which formal written submissions might have been made by the complainant; |
|
(m) |
in the event of a full or partial rejection or dismissal of a complaint, the written submissions of the complainant; |
|
(n) |
information on any relevant steps taken by the lead supervisory authority after receiving the responses of the parties under investigation to the preliminary findings and prior to submission of a draft decision referred to in Article 60(3) of Regulation (EU) 2016/679; |
|
(o) |
the views of the parties under investigation on a revised draft decision; |
|
(p) |
any other information deemed useful and relevant for the investigation. |
2. In the course of the investigation, the lead supervisory authority and the other supervisory authorities concerned shall exchange the information referred to in paragraph 1 of this Article as soon as possible and no later than one week from when such information becomes available, unless otherwise provided for in this Regulation or in Regulation (EU) 2016/679.
3. The Board may specify the modalities and requirements for the exchange of relevant information between supervisory authorities.
1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.
2. The summary of key issues shall include the following:
|
(a) |
the main relevant facts; |
|
(b) |
a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which is to be investigated; |
|
(c) |
legal and factual issues identified; |
|
(d) |
an analysis of relevant views expressed by the party under investigation or the complainant where those views are available at the time of drafting the summary of key issues; |
|
(e) |
where applicable, preliminary identification of potential corrective measures. |
3. The lead supervisory authority shall provide the other supervisory authorities concerned with the summary of key issues without delay, and within three months of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
4. The supervisory authorities concerned may provide comments on the summary of key issues within four weeks of receipt of that summary. The lead supervisory authority may extend that period by two weeks due to the complexity of the case or upon the request of the other supervisory authorities concerned.
5. Where the supervisory authorities concerned provide comments pursuant to paragraph 4, those comments shall be shared with all the other supervisory authorities concerned. The lead supervisory authority shall respond to those comments within four weeks of the expiry of the period referred to in paragraph 4 indicating whether and how it intends to take them into account. The lead supervisory authority may extend that period by two weeks due to the complexity of the case.
6. When transferring a case to the lead supervisory authority, the supervisory authority with which the complaint has been lodged may provide information relevant for the preparation of the summary of key issues to the lead supervisory authority.
7. The Board may specify the modalities and requirements for the provision of comments by the supervisory authorities concerned on the summary of key issues.
1. Pursuant to Article 60(1) of Regulation (EU) 2016/679, the lead supervisory authority and the other supervisory authorities concerned shall endeavour to reach consensus on cases concerning cross-border processing, in accordance with this Article, and may use all the means provided for in Regulation (EU) 2016/679, including mutual assistance pursuant to Article 61 of Regulation (EU) 2016/679 and joint operations pursuant to Article 62 of that Regulation.
2. Where a supervisory authority concerned disagrees with the lead supervisory authority and in the absence of consensus, that supervisory authority may make a request for mutual assistance under Article 61 of Regulation (EU) 2016/679 to the lead supervisory authority or may request the lead supervisory authority to conduct joint operations pursuant to Article 62 of that Regulation, or both, in order to reach consensus on the following:
|
(a) |
the scope of the investigation in complaint-based cases, including the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement to be investigated; |
|
(b) |
the legal or factual issues referred to in Article 10(2), point (c), of this Regulation, where applicable; |
|
(c) |
the preliminary identification of potential corrective measures pursuant to Article 10(2), point (e), of this Regulation. |
3. A request under paragraph 2 of this Article shall be made within one month of the expiry of the period referred to in Article 10(5).
4. Where a request to conduct joint operations pursuant to Article 62 of Regulation (EU) 2016/679 is made pursuant to paragraph 2 of this Article, the lead supervisory authority shall respond to that request within one month of its receipt.
5. The lead supervisory authority shall engage with the other supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Articles 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach consensus. The consensus on matters referred to in paragraph 2 of this Article shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings or, where applicable, to provide the supervisory authority with which the complaint has been lodged with the reasoning for the purposes of Article 16(1) of this Regulation.
6. Where, in a complaint-based investigation, following the procedures under Article 10(5) of this Regulation and paragraph 5 of this Article, there is no consensus between the lead supervisory authority and one or more other supervisory authorities concerned on the preliminary identification of the scope of the investigation referred to in Article 10(2), point (b), of this Regulation, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met and the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679.
7. When requesting an urgent binding decision of the Board pursuant to paragraph 6 of this Article, the lead supervisory authority shall provide the Board with the following:
|
(a) |
the information referred to in Article 10(2); |
|
(b) |
the comments of the other supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation; |
|
(c) |
further exchanges between the lead supervisory authority and the other supervisory authorities concerned under Article 10(5) and Article 11(5); |
|
(d) |
any other relevant document or information requested by the Board. |
8. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of all the information received.
1. The lead supervisory authority shall submit a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 within 15 months of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
2. Where the lead supervisory authority makes a request pursuant to Article 11(6), the time limit referred to in paragraph 1 of this Article shall be suspended until the Board has adopted its binding decision.
3. On an exceptional basis, the lead supervisory authority may extend the time limit referred to in paragraph 1 once, for a period of no longer than 12 months, due to the complexity of the case. The lead supervisory authority shall inform the other supervisory authorities concerned of its intention to extend the time limit referred to in paragraph 1, setting out the duration of and the reasons for the intended extension, at least four weeks before the expiry of the time limit referred to in paragraph 1.
4. Any supervisory authority concerned may submit an objection to the extension of the time limit within two weeks of being informed thereof pursuant to paragraph 3. That authority shall set out the reasons for its objection. When determining whether to extend the time limit referred to in paragraph 1 and, where applicable, the duration of that extension, the lead supervisory authority shall take due account of such an objection.
5. Where the lead supervisory authority extends the time limit referred to in paragraph 1 of this Article in accordance with paragraphs 3 and 4 of this Article, any other supervisory authority concerned may inform the lead supervisory authority that it considers there is a need to act in order to protect the rights and freedoms of data subjects. Where the lead supervisory authority does not submit a draft decision within the extended time limit, a supervisory authority that has informed the lead supervisory authority of a need to act in order to protect the rights and freedoms of data subjects may adopt a provisional measure on the territory of its Member State in accordance with Article 55 of Regulation (EU) 2016/679. In that case, the urgent need to act under Article 66(1) of Regulation (EU) 2016/679 shall be presumed to be met.
6. Where the simple cooperation procedure under Article 6 of this Regulation is applied, the lead supervisory authority shall submit a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 within 12 months of the lead supervisory authority confirming its competence pursuant to Article 4(6) of this Regulation or of a binding decision by the Board pursuant to Article 65(1), point (b), of Regulation (EU) 2016/679.
Where national law requires prior or subsequent domestic proceedings which necessitate that a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 be submitted after the expiry of the time limit referred to in the first subparagraph, the lead supervisory authority may extend that time limit once, for a period of no longer than two months. In such a case, the lead supervisory authority shall inform the other supervisory authorities concerned of the extension of the time limit, setting out the duration of that extension, at least two weeks before the expiry of the time limit referred to in the first subparagraph.
1. Where national law requires that subsequent domestic proceedings related to the same case be opened after the adoption of a decision pursuant to Article 18 or 21, the lead supervisory authority shall:
|
(a) |
not draft a new summary of key issues; |
|
(b) |
repeat the procedural steps in accordance with Article 16 or Articles 19 and 20 only where the lead supervisory authority’s factual or legal assessment differs from a preceding decision adopted pursuant to Article 18 or 21; and |
|
(c) |
submit a draft decision before adopting any subsequent decision that is different from a preceding decision pursuant to Article 18 or 21. |
2. The time limits referred to in Article 12 shall apply to the submitting of a draft decision in any subsequent proceedings referred to in paragraph 1 of this Article.
Where this Regulation or Article 65(6) of Regulation (EU) 2016/679 requires that a supervisory authority take a procedural step within a specified time limit, taking such a step after the expiry of that time limit shall not affect the legality or validity of that procedural step or of the final decision.
In determining whether a supervisory authority has not handled a complaint pursuant to Article 78(2) of Regulation (EU) 2016/679, consideration shall be given to whether that supervisory authority, within the time limit provided for in this Regulation or in Article 65(6) of Regulation (EU) 2016/679, including any possible extensions of such a time limit, has not:
|
(a) |
submitted a draft decision or revised draft decision; or |
|
(b) |
adopted a final decision. |
1. Where the lead supervisory authority intends to fully or partially reject or dismiss a complaint, it shall, prior to submitting a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679, provide the supervisory authority with which the complaint has been lodged with the reasons for its preliminary view that the complaint is to be fully or partially rejected or dismissed.
The supervisory authority with which the complaint has been lodged shall inform the complainant of the reasons for the preliminary view referred to in the first subparagraph, provide the complainant with the opportunity to make his or her views known in writing and inform the complainant of the consequences of not making his or her views known.
The lead supervisory authority shall set an appropriate time limit for the complainant to make his or her views known. That time limit shall be no shorter than three weeks and no longer than six weeks.
2. The supervisory authority with which the complaint has been lodged shall transmit any views made known by the complainant to the lead supervisory authority, as soon as possible and no later than one week from when they become available.
3. Where the views made known by the complainant in accordance with paragraph 1 of this Article do not lead to a change of the preliminary view referred to in paragraph 1, first subparagraph of this Article, the lead supervisory authority, in cooperation with the supervisory authority with which the complaint has been lodged, shall prepare a draft decision and submit it to the other supervisory authorities concerned, in accordance with Article 60(3) of Regulation (EU) 2016/679.
4. Where the draft decision submitted pursuant to paragraph 3 concludes that the complaint is to be partially rejected or dismissed, the lead supervisory authority shall continue its investigation in cooperation with the other supervisory authorities concerned on the part of the complaint which remains to be investigated.
Where the lead supervisory authority determines that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679, fully or partially rejecting or dismissing a complaint, raises new elements on which the complainant should have the opportunity to make his or her views known, the supervisory authority with which the complaint has been lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the opportunity to make his or her views known on such new elements in accordance with Article 16 of this Regulation.
When adopting a decision fully or partially rejecting or dismissing a complaint in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the supervisory authority with which the complaint has been lodged shall inform the complainant of the judicial remedy available to him or her in accordance with Article 78 of Regulation (EU) 2016/679.
1. Following the consultations and procedures under Articles 10 and 11 of this Regulation, where the lead supervisory authority intends to submit a draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679 finding an infringement of Regulation (EU) 2016/679 to the other supervisory authorities concerned, it shall draft preliminary findings.
2. The preliminary findings shall include the findings of the investigation and present allegations raised in an exhaustive and sufficiently clear manner to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, the preliminary findings shall set out clearly all the facts, the list of the evidence relied upon and the entire legal assessment raised against the parties under investigation, so that they can express their views on those facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679.
The preliminary findings shall indicate, based on the information available at that stage and without prejudice to the views of the parties under investigation, corrective measures the lead supervisory authority considers using.
Where the lead supervisory authority, based on the information available at that stage and without prejudice to the views of the parties under investigation, considers whether to impose an administrative fine in accordance with Article 83 of Regulation (EU) 2016/679, it shall list in the preliminary findings the main legal and factual elements, which are known to it, and on which it intends to rely when deciding whether to impose an administrative fine and on the amount of the fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it intends to take into account.
3. The lead supervisory authority shall transmit the preliminary findings to the other supervisory authorities concerned. Those authorities may provide comments on those findings to the lead supervisory authority within four weeks from the transmission of the preliminary findings to the other supervisory authorities concerned. Upon request of one of the other supervisory authorities concerned, the lead supervisory authority shall extend that period by two weeks.
4. The lead supervisory authority shall notify the preliminary findings, where relevant as amended to take into account comments provided by the other supervisory authorities concerned, to each of the parties under investigation.
5. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set an appropriate time-limit no shorter than three weeks and no longer than six weeks from the date of notification, within which those parties may provide their views in writing, or hold a hearing within the same time-limit in order to hear the views of the parties under investigation orally.
6. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Articles 24 and 25.
7. The parties under investigation may, in their reply to preliminary findings, set out all facts and legal arguments known to them that are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall base its draft decision only on the allegations and facts and the legal assessment based on those facts in respect of which the parties under investigation have been given the opportunity to provide their views.
1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint has been lodged shall provide the complainant with those preliminary findings, in accordance with rules on access to the administrative file and on confidential information under Articles 24 and 25, and the lead supervisory authority shall set an appropriate time-limit no shorter than three weeks and no longer than six weeks, within which the complainant may make his or her views known in writing.
2. For the purpose of paragraph 1, administrative modalities and requirements under national procedural law of the supervisory authority with which the complaint has been lodged shall continue to apply.
3. Paragraph 1 of this Article shall also apply where the lead supervisory authority:
|
(a) |
handles a complaint jointly with other complaints; |
|
(b) |
handles a part of a complaint separately; or |
|
(c) |
modifies the scope of the investigation in the preliminary findings in any way, including after a binding decision of the Board pursuant to Article 11(8). |
1. After submitting the draft decision to the other supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of those other supervisory authorities object to the draft decision within the periods referred to in Article 60(4) or (5) of Regulation (EU) 2016/679, as applicable, the lead supervisory authority shall, within one month from the end of the period referred to in Article 60(4) or (5) of Regulation (EU) 2016/679:
|
(a) |
adopt its decision referred to in Article 60(7) or, where applicable, Article 60(9), of Regulation (EU) 2016/679; and |
|
(b) |
notify the decision referred to in point (a) to the main establishment or single establishment of the controller or processor, as the case may be. |
2. The information to be provided to the complainant pursuant to Article 60(7) and (9) of Regulation (EU) 2016/679 shall consist of:
|
(a) |
a version of the decision adopted that includes its operative part in full and the grounds of that decision that do not include elements considered confidential in accordance with Article 25 of this Regulation; or |
|
(b) |
a summary of the decision adopted, including the relevant facts and grounds of that decision. |
In any event, the complainant shall, upon request, be provided with a version of the decision referred to in the first subparagraph that includes its operative part in full and the grounds of that decision that do not include elements considered confidential in accordance with Article 25 of this Regulation.
Administrative modalities and requirements under the national procedural law of the lead supervisory authority shall continue to apply.
1. Where the lead supervisory authority determines that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679, finding an infringement of Regulation (EU) 2016/679, raises new elements on which the parties under investigation are to have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the opportunity to make their views known on such new elements.
2. The lead supervisory authority shall set an appropriate time-limit no shorter than three weeks and no longer than six weeks within which the parties under investigation may make their views known.
3. The lead supervisory authority shall inform the other supervisory authorities concerned of the views made known by the parties under investigation, as soon as possible and no later than one week from when they become available.
1. A relevant and reasoned objection, as defined in Article 4, point (24), of Regulation (EU) 2016/679, shall:
|
(a) |
be based on factual and legal elements included in the draft decision or the cooperation file; |
|
(b) |
not concern the scope of an investigation where none of the supervisory authorities concerned have provided comments in accordance with Article 10(4) of this Regulation or where consensus has been reached following comments received, or the scope of an investigation as defined in a binding decision of the Board adopted under Article 11(8) of this Regulation; |
|
(c) |
not concern a draft decision adopted in accordance with Article 5 of this Regulation. |
2. Notwithstanding paragraph 1, point (b), a supervisory authority concerned may submit relevant and reasoned objections that concern the scope of an investigation referred to in paragraph 1, point (b), in duly justified cases, provided that:
|
(a) |
the lead supervisory authority has failed to investigate all the elements of the summary of key issues on which consensus was reached pursuant to Article 10(5) or Article 11(5), or has failed to comply with the binding decision of the Board under Article 11(8); or |
|
(b) |
new elements, not available at the time of reaching consensus on the summary of key issues pursuant to Article 10(5) or Article 11(5), or at the time of the binding decision of the Board under Article 11(8), demonstrate a significant risk posed by the draft decision as regards the fundamental rights and freedoms of the data subject and, where applicable, the free flow of personal data within the Union; or both. |
3. A relevant and reasoned objection shall be sufficiently clear, coherent and precise and, where necessary, it shall identify the elements of the draft decision to be amended in order to enable supervisory authorities to prepare their positions and, as the case may be, to enable the Board to efficiently resolve the dispute.
