The European Data Protection Board (EDPB) announced, on September 21, 2023, the adoption, jointly with the European Data Protection Supervisor (EDPS), of an opinion on the European Commission's proposal for a regulation on additional procedural rules for the enforcement of the General Data Protection Regulation (GDPR), and a contribution in response to the Commission's public consultation on the template report for the description of consumer profiling techniques pursuant to Article 15 of the Digital Markets Act (DMA). 

Proposed regulation on additional procedures for GDPR enforcement

The joint opinion welcomes the Commission's efforts to harmonize the information to be provided for a complaint to be considered admissible and the clarifications concerning the right of access to an administrative file. At the same time, the joint opinion also makes several recommendations. Among other things, regarding the consensus-finding proposals on early cooperation procedure between supervisory authorities (SAs), the joint opinion recommends further improvements to ensure that concerned supervisory authorities (CSAs) are more involved in the different steps of the procedure, as this would avoid possible disputes at a later stage. Specifically, the joint opinion takes the view that the 'preliminary findings' addressed to the parties under investigation and the 'preliminary view' to reject the complaint, should be shared with CSAs before they are submitted to the parties under investigation or to the complainant. Moreover, time limits, extendable in duly justified circumstances, should be defined for certain procedural steps to allow swift and efficient enforcement.

Moreover, the joint opinion also urges the co-legislators not to change the current approach to the parties' right to be heard in the dispute resolution procedure, as the proposed change would not be in line with the architecture of the One-Stop-Shop mechanism.

Template report for reporting consumer profiling techniques

On the template report, the joint contribution explains that, under the DMA, designated gatekeepers will have to annually report consumer profiling techniques to the Commission. The template report serves the purpose of specifying what gatekeepers should include in the independently audited descriptions of their profiling techniques, which will be transmitted by the Commission to the EDPB and will inform enforcement actions by SAs. The joint contribution formulates several recommendations on the scope of the information sought by the Commission to this end, such as to require gatekeepers to provide additional information concerning the categories of personal data processed and their sources.

You can read the press release here, the joint opinion here, and the joint contribution here.

Update: September 27, 2023

Germany: BfDI releases statement on joint opinion on proposed regulation on GDPR enforcement

On September 26, 2023, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) announced that it had worked with the EDPB and EDPS on the joint opinion on the proposal for a regulation on additional procedural rules for the enforcement of the GDPR and that it welcomed that the opinion was in favor of faster and more transparent procedures for cross-border enforcement.

More specifically, the BfDI highlighted a need for accelerated procedures, noting that some complaints from 2018 were not yet decided. The BfDI further added that lead supervisory authorities must work more transparently and cooperatively for the effective protection of the fundamental rights of citizens. According to the BfDI, it is up to the European Parliament and the Council of the European Union to incorporate the recommendations of the EDPB and the EDPS into the proposed regulation.

You can read the press release, only available in German, here.