GDPR Procedures Regulation: Commission Proposal is an attack on users' rights in GDPR procedures
Today the EU Justice Commissioner Reynders has issued a proposal to fix the (lack of) cooperation between some Data Protection Authorities (DPAs). Currently the GDPR only tells DPAs to cooperate, but lacks the details about how this cooperation should work. Unfortunately, the Commission proposal seems to be technically and materially flawed and rather strips citizens of existing rights than ensuring their enforcement. Ideally, a new Regulation could follow established high level principles for cross-country procedures - leading to less interference with national procedures and more legal certainty.
- Link to the Commission Proposal
- Press Release by the Commission
- Find the noyb Proposal at https://gdpr-procedure.eu/
Background. The GDPR so far says that national DPAs must cooperate with each other, but the details of the procedures are left to the Member States. There is no clear conflict of law provisions, that would regulate which national law applies to which element of the procedure. The EU law elements are limited to certain steps of the cooperation procedure. This lead to many conflicts among DPAs, all the way to a lawsuit by the Irish DPC against the European Data Protection Board (EDPB) for alleged overreaches by the EU coordination body.
Max Schrems: "The GDPR basically tells DPAs to 'cooperate' but they all have different views on how the procedures should work and which national law applies to which step. In addition, some Member States have passed procedural rules aimed at undermining GDPR procedures. In other Member States DPAs and courts have developed practices that are not compliant with EU minimum standards. This situation makes cross-country procedures often extremely slow and messy."
Commission approach flawed. The Commission proposal seems to be based mainly on (some) DPA's demands to remove citizens from procedures to "simplify" them. When trying to fix issues, the Commission only tries to plug individual holes in the system, which surfaced in the first bigger cases between the Irish DPC and its European Counterparts. Other than in existing EU cross-country procedures regulations (like the "Brussels"- or "Rome"-Regulations) the Commission proposal does not take a systematic approach, delegating jurisdiction to Member States for certain parts of the procedure and ensuring that there are European minimum standards. Instead, the Commission proposal seems to implant certain European elements into existing laws - leading to a hybrid between EU and national laws and procedures.
Imbalance between users and companies. While some key elements that would lead to faster procedures – such as substantial deadlines for the lead supervisory authority investigating a cross-border case are mostly missing, the Commission’s approach would even tilt the already problematic balance of arms in data protection cases further towards companies. While citizens will only be heard in a minimal manner, the draft provides for ample rights for the companies: they are heard throughout the procedure and get access to the case files. This could lead to cementing existing problems before opaque regulators such as the DPC rather than solving them.
Max Schrems: "We hoped for a solution, but this is fundamentally shifting a procedure about the rights of users to a procedure about the rights of companies. We need to study the proposal in more detail, many elements are clearly a step back for users' rights. We think there would be more traditional ways to tackle the problems that would at the same time interfere less with national procedural laws and be much simpler - while also fixing the problems on a systematic level. We will engage with the European legislators to see if the proposal can be fixed, but it seems this would be a long way to go."
Way forward. The Commission proposal is on a very tight schedule, given that the term of the European Commission is over in 2024. The proposal now has to go to the European Parliament and the Member States, that would have to agree on a final version. It is unclear if the current proposal would be welcomed by the other European legislative bodies. noyb will closely monitor the process.
