Irish Council for Civil Liberties

…1 1st Floor 34 Usher’s Quay Dublin 8 T: +353 1 912 1640 E: [email protected] W: www.iccl.ie Directorate General for Justice and Consumers European Commission 23 March 2023 Further specifying procedural rules relating to the enforcement of the General Data Protection Regulation Dear colleagues, 1. I write on behalf of the Irish Council for Civil Liberties (ICCL), Ireland’s oldest non-profit human rights organisation. We have been involved in several cross-border complaints and procedures in different Member States, and monitor these matters closely.

…in several cross-border complaints and procedures in different Member States, and monitor these matters closely. 2. We heartily commend the Commission for initiating the development of a proposal for a Regulation on procedural harmonisation. In addition, we recommend harmonisation on amicable resolution, standing and rights, deadlines and communication, admissibility, investigations, standards of expertise, and an enhanced role for the EDPB. Amicable resolution 3. We concur with the EDPB’s suggestion (Proposal 8) that harmonised rules for amicable resolution should be introduced to. Further, we suggest that the Regulation should further clarify the EDPB’s Guidelines on the use of amicable resolution.1 Harmonised rules are necessary for four reasons.

…the EDPB’s Guidelines on the use of amicable resolution.1 Harmonised rules are necessary for four reasons. First, the EDPB register of final decisions indicates that Ireland is the only Member State whose supervisory authority has registered any amicable resolutions so far.2 Indeed, while no other lead supervisory authority appears to have registered an amicable resolution, the Irish Data Protection Commission (DPC) registered 46 in a single year. This indicates an extreme variance in how amicable resolution is used. Second, despite being the result of extensive deliberation, the EDPB Guidelines are not respected.

…resolution is used. Second, despite being the result of extensive deliberation, the EDPB Guidelines are not respected. As a result, matters that should be investigated in the normal one-stop-shop procedure are instead superficially addressed for a single data subject and left unresolved 1 “Guidelines 06/2022 on the practical implementation of amicable settlements”, EDPB, 12 May 2022 (URL: https://edpb.europa.eu/system/files/2022- 06/edpb_guidelines_202206_on_the_practical_implementation_of_amicable_settlements_en.pdf). 2 Final One Stop Shop Decisions register, EDPB (URL: https://edpb.europa.eu/our-work-tools/consistency- findings/register-for-article-60-final- decisions_en?f%5B0%5D=article_60_lsa%3A705&f%5B1%5D=article_60_types_of_decision%3AOther). Note that the Estonia, Luxembourgish, and Swedish decisions listed as “other” do not appear to be amicable resolutions. Ref.

…that the Estonia, Luxembourgish, and Swedish decisions listed as “other” do not appear to be amicable resolutions. Ref. Ares(2023)2121957 - 23/03/2023 2 for hundreds of millions of people across the Union. Many of the DPC’s 46 amicable resolutions in the EDPB register fall in to one or more of the following categories: • the issue was resolved for an individual data subject, but the matter affects a large number of other data subjects, too, and will continue to do so; • the issue indicated systemic failures; or • the same large-scale data controller is repeatedly involved.3 The EDPB Guidelines indicate that such matters should not be amicably resolved, but should instead be investigated and fully dealt with in the normal procedure. Third, it is apparent that supervisory authorities do not consider themselves bound by the Guidelines, as the point above illustrates.

…that supervisory authorities do not consider themselves bound by the Guidelines, as the point above illustrates. The amicable resolution decisions registered by the DPC in the EDPB final decision registry are dated after the Guidelines were voted. Fourth, the variance and misapplication of amicable resolution appears to be a significant problem.

…were voted. Fourth, the variance and misapplication of amicable resolution appears to be a significant problem. The Irish DPC’s published statistics say that nearly all (87%) of the 1,091 cross-border complaints it accepted between May 2018 and September 2022 concerned the same eight large-scale data controllers: Meta (including WhatsApp), Google, Twitter, Microsoft (including LinkedIn), Apple, Airbnb, Yahoo, and Match Group (Tinder).4 Despite that fact, the DPC reports that 83% of the 793 cross-border complaints that it claims to have resolved5 in that period were by way of amicable resolution, at its own discretion.6 This suggests a high risk that matters affecting a large number of people across the Union are not being investigated.

This suggests a high risk that matters affecting a large number of people across the Union are not being investigated. 4. Variance and misapplication of amicable resolution also undermines the cooperation between data protection supervisory authorities in cross-border cases. It also reduces confidence in the role of amicable resolutions. Amicable resolution may be an efficient means of addressing inconsequential infringements, but only if its application is strictly limited to those matters. We therefore propose that the Commission should clarify the relevant element of the EDPB guidelines7 and include it in the Regulation as a clear and binding rule on supervisory authorities. Standing of complainants and other parties, parties rights, and admissibility 5.

…rule on supervisory authorities. Standing of complainants and other parties, parties rights, and admissibility 5. In addition to supporting the EDPB’s suggestion (EDPB Proposal 1) to harmonise the status of parties, we also recommend that a complaint or representative body should be a party and enjoy the standing and rights of a party. 3 Final One Stop Shop Decisions register, EDPB (URL: https://edpb.europa.eu/our-work-tools/consistency- findings/register-for-article-60-final- decisions_en?f%5B0%5D=article_60_lsa%3A705&f%5B1%5D=article_60_types_of_decision%3AOther). 4 See “One-stop-shop cross-border complaint statistics 25 May 2018-19 Sept 2022”, Data Protection Commission, 26 September 2022 (URL: https://www.dataprotection.ie/sites/default/files/uploads/2022- 10/04.10.22%20Cross%20border%20complaint%20stats%202018%20to%20Sept%202022.pdf), p. 15. 5 ibid., p. 4.

…p. 15. 5 ibid., p. 4. 6 Irish law gives the DPC wide discretion to decide whether to pursue an amicable resolution or not. In the Irish Data Protection Act the words “considers appropriate” in Section 109 (1), and “may take such steps as it considers appropriate” in Section 109 (2), and “where the Commission considers” in Section 109 (4), give the DPC broad discretion in whether to pursue amicable resolution. 7 “Guidelines 06/2022 on the practical implementation of amicable settlements”, EDPB, 12 May 2022 (URL: https://edpb.europa.eu/system/files/2022- 06/edpb_guidelines_202206_on_the_practical_implementation_of_amicable_settlements_en.pdf), pp 7-8, 19. 3

…pp 7-8, 19. 3 6. In addition, we have observed the lead authority in several cases depriving a complainant of their standing and rights in the process by “parking” their complaint, and instead initiating an own volition investigation. This has exposed data subjects to significant risk. Harmonised rules should be introduced to prevent lead supervisory authorities “parking” complaints and introducing replacement own volution investigations.

…to prevent lead supervisory authorities “parking” complaints and introducing replacement own volution investigations. 7. We concur with the EDPB’s recommendations (EDPB Proposals 2, 3, and 4) for harmonisation of parties’ procedural rights, access to the file, rules of confidentiality, and right to be heard, including at the EDPB. The right to be heard and to see correspondence to and from other parties allows equality of arms among parties. It is also enables the supervisory authority to be better assisted by the parties in its deliberations. In contrast, we have observed that blanket assertions of confidentiality without a genuine commercial sensitivity being evident renders a complainant unable to assist the supervisory authority, and establishes a bias in favour of a controller.

21 → 12

originalus šaltinis (PDF) ↗