On Wednesday 10 April, MEPs adopted their position ahead of negotiations with the Council of the EU on additional procedural rules for the application of the General Data Protection Regulation (GDPR) (329 votes in favour, 213 against, 79 abstentions) (see EUROPE 13351/11).
“Parliament is today strengthening the rights of complainants and giving parties under investigation a degree of clarity in the procedure. We are strengthening the fundamental right to data protection in the EU”, commented the rapporteur, Sergey Lagodinsky (Greens/EFA, German).
In concrete terms, MEPs will be tackling the inter-institutional negotiations (‘trilogues’) with the aim of streamlining cross-border procedures and strengthening the provisions relating to joint dossiers. In this case, these files would contain all the information relating to a case and the supervisory authorities concerned would have “instant, unlimited and continuous” access to the file.
Deadlines would be specified to speed up procedures: the report suggests a period of two weeks for a supervisory authority to acknowledge receipt of a complaint and declare it admissible or inadmissible. The competent authority then had three weeks to determine whether or not it was a cross-border case, and to decide which authority should take the lead.
Draft decisions should then be issued within nine months of receipt of the complaint. There are exemptions for “exceptional situations”.
The rules would also be clarified for out-of-court settlements of disputes, whether the resolution is consensual or the result of negotiation. According to MEPs, the out-of-court settlement should neither prevent a data protection authority (DPA) from opening an investigation on its own initiative nor prevent other DPAs from asking the lead authority to open such an investigation.
The interinstitutional negotiations will begin after the next European elections, which will take place from 6 to 9 June. (Original version in French by Thomas Mangin)