The preliminary findings define the scope of the investigation and therefore the scope of any future final decision, as the case may be, taken on the basis of a binding decision issued by the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 which can be addressed to controllers or processors. The preliminary findings should be, even if succinct, sufficiently clear to enable the parties under investigation to properly identify the nature of the alleged infringement of Regulation (EU) 2016/679. The obligation to give the parties under investigation all the information necessary to enable them to properly defend themselves is satisfied if the final decision does not allege that the parties under investigation have committed infringements other than those referred to in the preliminary findings and takes into consideration only facts on which the parties under investigation have had the opportunity of making their views known. The final decision of the lead supervisory authority does not, however, need to be a replica of the preliminary findings. The lead supervisory authority should be permitted in the final decision to take account of the responses of the parties under investigation to the preliminary findings, and, where applicable, to the revised draft decision under Article 60(5) of Regulation (EU) 2016/679. The lead supervisory authority should be able to carry out its own assessment of the facts and the legal arguments put forward by the parties under investigation in order either to reject the arguments when the lead supervisory authority finds them to be unfounded or to supplement and redraft its findings, both in fact and in law, in support of the arguments which it maintains. For example, taking account of an argument put forward by a party under investigation during the administrative procedure, without it having been given the opportunity to express an opinion in that respect before the adoption of the final decision, cannot per se constitute an infringement of rights of defence.
