The European Parliament and the Council of the EU have now published their amendments to the Commission's draft GDPR Procedural Regulation. We have analyzed the two versions and made a first overview (video and presentation).
Click here for noyb's presentation and analysis.
Background. Under the GDPR, data protection authorities (DPAs) from different member states are supposed to cooperate in handling user complaints and enforcing the law against international companies. However, different authorities operate under very different national procedural laws. Some member states do not even have codified procedures. The GDPR itself does not really provide much clarity on these procedural aspects either.
In 2023, the European Commission proposed a new regulation to remove barriers to cooperation. However, it is fair to say that the proposal has largely been criticized for its lack of legal quality, the shifting of powers from the relevant authorities to the lead authorities, and the failure to truly address many underlying problems.
Original proposal and amendments. In the normal EU legislative process, the European Parliament (led by the LIBE Committee) and the Council (with representatives from each EU member state) have now submitted two amended versions of the Commission's proposal:
You can also view slides from the video here:
The next step is to reconcile these two versions into one text - a huge challenge that will be carried out in so-called "trilogues."
In general, we think the Parliament and Council versions seem to be moving in the same direction from a political point of view. However, Parliament's version takes a cleaner, high-level approach and has also removed unnecessary steps, while the Council has mainly added elements to the Commission's proposal, some of which make it even more complicated to read.
In the coming weeks, we will show the second video on the Art 65/66 procedure and a full written comparison.
