Federation of European Data and Marketing

Answer to consultation Page 1 Federation of European Data and Marketing Av. Des Arts 43, 5th Floor, 1040 Brussels +32 2 779 4268 www.fedma.org Further specifying procedural rules relating to the enforcement of the General Data Protection Regulation FEDMA is pleased to provide its input to the European Commission’s Call for Evidence on an initiative on procedural aspects of the GDPR. Over almost five years of GDPR implementation, Data Protection Authorities (DPAs) have made full use of the margin of manoeuvre available under the text. However, the resulting fragmentation is not only due to diverging national interpretation and guidance on the GDPR, but also differences in national legislations. The objective of the Commission must be to address both points, including as required a modification of the text of the GDPR.

…of the Commission must be to address both points, including as required a modification of the text of the GDPR. The lack of EU harmonised administrative procedures to handle cross-border cases – including the position of the parties in the proceedings, admissibility criteria, transparency duration of proceedings, deadlines, possibility to share confidential information with other DPAs and with the parties undergoing the investigation, right to be heard etc. – and different interpretations relating to the cooperation mechanism jeopardise the consistent application and enforcement of the GDPR from the perspective of a Digital Single Market. More importantly, they jeopardise due process and the fundamental right to a fair trial, which are the cornerstones of our democratic societies.

…due process and the fundamental right to a fair trial, which are the cornerstones of our democratic societies. Next to reiterate the importance on addressing the fragmented interpretation of the GDPR, we also support the Commission’s objective to harmonise some aspects of the administrative procedure the DPAs apply in cross-border cases. However, on top of supporting the different high-level policy options outlined in the Call for Evidence, FEDMA recommends: • conducting a study to identify all divergences in national procedural laws and the impact of different approaches on the application and enforcement of the GDPR. This would help to narrow down the areas of procedural laws that require the most urgent harmonization and where a harmonized approach could provide the most benefits to DPAs, the parties undergoing an investigation and as the case may be complainants.

…could provide the most benefits to DPAs, the parties undergoing an investigation and as the case may be complainants. As different legal traditions across the EU stem from cultural and strategic differences, the Study would also contribute to foster mutual understanding of these traditions among national authorities in order to facilitate the harmonisation process. • centralising information on all national procedural laws applicable to parties under investigation at EU level through the EDPB’s or the Commission’s website. Though these aspects of procedural law could eventually be harmonised, a single point of reference for the provision of this Ref. Ares(2023)2154145 - 24/03/2023 Answer to consultation Page 2 Federation of European Data and Marketing Av.

…of this Ref. Ares(2023)2154145 - 24/03/2023 Answer to consultation Page 2 Federation of European Data and Marketing Av. Des Arts 43, 5th Floor, 1040 Brussels +32 2 779 4268 www.fedma.org information would be extremely useful, especially in cross-border case, for the parties under investigation to be aware of the details on the process, the right to be heard, deadlines at all stages of the procedure, including timelines and opportunities for full answer and defense. • providing the parties under investigation with information on any relevant and reasoned objections made to a proposed decision, including where appropriate relevant interactions between the DPAs, as well as with the opportunity to be heard vis-à-vis the EDPB, especially in case of pending fines or sanctions.

DPAs, as well as with the opportunity to be heard vis-à-vis the EDPB, especially in case of pending fines or sanctions. • Providing the party under investigation with the draft decision taken by the lead DPA when it is circulated to the concerned DPAs. • Providing the party under investigation with the details of the contacts at the DPAs that have declared themselves as concerned authorities to enable the party under investigation to contact the concerned DPAs and to present their observation (right to be heard) before the DPA can decide to raise or not to raise relevant and reasoned objections. • including strict deadlines that the leading DPA in a cross-border case must comply with when answering investigation and enforcement requests from other concerned DPAs or the EDPB.

…case must comply with when answering investigation and enforcement requests from other concerned DPAs or the EDPB. This would replicate part of the design of the Digital Services Act (DSA)’s first enforcement layer, ensuring that decisions are delivered within months. • streamlining the processes and requirements for the adoption of Codes of Conduct as a tool to enhance GDPR application and enforcement. In particular, we believe that the substantive assessment of the candidate code of conduct should be made by the EDPB and the European Commission simultaneously as part of a single procedure, rather than having to face a doubling of the procedures that may discourage candidates from considering codes of conduct. Enhancing the adoption of Codes of Conduct has also the potential to enable resource savings at both the national and EDPB level. ***

originalus šaltinis (PDF) ↗