EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

EDPB - EDPS Jo in t O p in i o n 0 1 / 2 0 2 3 on t h e P roposa l f o r a Regu l a t i o n o f t h e E u rop ean Pa r l i amen t a nd o f t h e Counc i l l a y i n g d own add i t i o n a l p ro cedu r a l r u l e s r e l a t i n g t o t h e e n fo r c emen t o f Regu l a t i o n ( EU ) 2 0 1 6 / 6 7 9 Adop t ed o n 1 9 S ep t embe r 202 3 Adopted 2 Article 22 ................................ ................................ ................................ ................................ ........... 53 Article 23 ................................ ................................ ................................ ................................ ........... 53 Article 25 ................................ ................................ ................................ ................................ ........... 54 Article 26 ................................ ................................ ................................ ................................ ........... 54 Adopted 4 Article 28 ................................ ................................ ................................ ................................ ........... 54 Annex: Complaints submitted on the basis of Article 3 ................................ ................................ ... 54 Adopted 5 Executive summary In April 2022, the European Data Protection Board (EDPB) adopted a statement, signalling its enduring commitment to close cross - border cooperation. While the EDPB has taken important steps to promote cooperation and swift enforcement, certain obstacles require legal harmonisation. To this end, the EDPB identified a list of procedural aspects that could benefit from further harmonisation ('the EDPB wish list’) , which was sent to the European Commission on 1 0 October 2022. It addresses, inter alia, the status and rights of the parties to the administrative procedures, procedural deadlines, requiremen ts for admissibility or dismissal of complaints, the investigative powers of supervisory authorities (‘SAs’), and the practical implementation of the cooperation procedure. On 4 July 2023, the European Commission published a Proposal for a Regulation of th e European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 (‘the Proposal’) and formally consulted the EDPB and EDPS in accordance with Article 42(2) of Regulation (EU) 2018/1725 . The EDPB and EDPS very much welcome that the Proposal aims to foster effective enforcement of data protection rules and therefore intends to give effect to many of the suggestions contained in the ‘ EDPB wish list’. It aims to complement Regulation (EU) 2016/679 (‘ the GDPR ’) by specifying procedural rules, streamlining the cooperation and dispute resolution mechanisms, and harmonising the procedural rights of the parties under investigation and complainants in cross - border cases. The timely adoption of this future Regulation, taking into account the recommendations set forth by the EDPB and EDPS in this Joint Opinion, is of paramount importance to further improve the efficiency and consistency of GDPR enforcement . On a general note, the EDPB and EDPS wi sh to underline that the effective enforcement of the GDPR, including through the application of the future Regulation which introduces new procedural steps that are likely to increase the current workload of SAs, will require that both the national SAs an d the EDPB are provided with sufficient resources. Admissibility and preliminary vetting of complaints Article 16 of the T reaty on the Functioning of the European Union (ʽT FEU ʼ ) allows the co - legislator s to address a broad range of issues due to the horizo ntal and general nature of this provision. Therefore, this can include harmonisation of the information to be provided by the complainant, which is welcome . It will facilitate complaint - handling by SAs. However, certain requirements (namely the proof of id entity, signature and telephone number) impose unnecessary barriers for complainants and should be removed from the complaint form annexed to the Proposal or made optional. In addition, it is possible that complaints would be subject to different informati on requirements for their complaint to be deemed admissible depending on whether the case at hand concerns a cross - border processing or not. While the Proposal provides that completeness of the information set out in the Form is a requirement for a complai nt to be admissible, the EDPB and EDPS urge the co - legislators to go further and provide for exhaustive harmonisation of admissibility requirements which would pre - empt conflicting national admissibility requirements . Further, the EDPB and EDPS welcome the provision of a time period to determine the completeness and admissibility of the complaint and recommend including the possibility to extend it. The Joint Opinion also calls for clarifying in the Regulation existi ng arrangements on ‘preliminary vetting’ , by providing a clear legal basis to supervisory authorities for carrying out investigative acts to arrive at a preliminary Adopted 6 conclusion on the cross - border nature of the processing, the local nature of a case and the competence of supervisory authorities. Cooperation procedure and consensus finding With regard to the cooperation mechanism, the approach in the Proposal to strengthen the consensus finding process is welcome, both on the scope and on the outcome of the i nvestigation. The new formal procedural steps, such as the ‘summary of key issues’ to be shared at an early stage by the lead supervisory authority (‘LSA’) with the concerned supervisory authorities (‘CSAs’), hold the potential to unlock a more efficient a nd enhanced cooperation. However, since these steps are applicable to all Article 60 GDPR cases, including the vast majority of non - complex and non - controversial ones, it is important to not overburden SAs, and therefore offer the possibility for the LSA t o follow a proportionat e approach when preparing such documents, depending on the complexity of the case, while ensuring that CSAs may request more detailed information whenever necessary. The EDPB and EDPS appreciate that the Proposal addresses the EDPB’s wish for further clarification of the scope, content and timing of information sharing under the GDPR . In particular, this Joint Opinion suggests clarifying the content of the ‘ summary of key issues ’ to ensure that the LSA and CSAs share the same un derstanding of the case, by design, early on and throughout the procedure. To facilitate consensus and avoid disputes coming up late in the procedure, the EDPB and EDPS consider that the ‘preliminary findings’ addressed to the parties under investigation a nd the ‘preliminary view’ to reject the complaint should be shared with CSAs before they are submitted to the parties under investigation or the complainant , in the same fashion as for the ‘summary of key issues’. The LSA should be obliged to engage with t he CSAs, based on their comments, to resolve any disagreement. In case of disagreements on the ‘ summary of key issues ’ , this Joint Opinion recommends that the use of Article s 61 and 62 GDPR requests should be made optional instead of mandatory. At the same time, the urgency procedure to settle the dispute on the scope of the investigation pursuant to Article 10(4) of the Proposal should only be triggered (possibly also by the CSAs) once it is clear that no consensus can be reached . With regard to relevant and reasoned objections (‘RROs’) that CSAs can raise on a draft decision, Article 18(1) of the Proposal unduly restricts the definition of RRO under the GDPR . The EDPB and EDPS stress that it should still be possible for CSAs to raise RROs on the scope of the investigation, in particular where an EDPB urgent binding decision on the scope of the investigation, in line with Article 10(4) of the Proposal, was not issued or not followed by the LSA. In addition, it should be possible for CSAs to raise RROs on al l legal elements and established facts or documents of the file. The EDPB and EDPS urge the legislators to remove Art icle 18 from the Proposal, as otherwise consensus finding in the final phase of the cooperation procedure would be severely hampered. A tighter framework for certain procedural steps, including time limits, would be necessary to ensure swift and efficient enforcement . Generally, the EDPB and EDPS would welcome a more equal treatment of procedural deadlines and rights of initiative between the LSA and CSAs. In particular, in duly justified circumstances, extendable deadlines for the submissions of the summary of key issues and preliminary findings should be provided for, as well as for the adoption of a final decision after a consensus was r eached on the revised draft decision or for referring the subject matter to the EDPB for dispute resolution in accordance with Article 65(1)(a) GDPR. The EDPB and EDPS positively note the clarifications concerning the right of access to an administrative f ile . The future Regulation could further clarify certain elements, in particular with respect to the content of the administrative file, the scope of the right of access, the confidentiality declaration and the restricted use of Adopted 7 documents disclosed. The ne w harmonised provisions should also not prohibit the sharing of confidential information between SAs and the use of such information to exercise their fining powers under the GDPR. Dispute resolution and urgency procedures Binding decisions under the GDPR are a key tool for the EDPB to ensure the consistent application of the GDPR. While the EDPB and EDPS welcome the Proposal’s approach to streamline the dispute resolution procedure, the new aspects included in the Proposal should be clarified and adapted, bearing in mind the necessity to meet the legal deadline provided for in the GDPR for the adoption of binding decisions. The EDPB and EDPS make detailed recommendations on how to clarify the procedure , including regarding the need to carry out translations (if needed) before the legal deadlines start, the necessary check of the file by the EDPB Secretariat on behalf of the EDPB Chair, and the documents to be provided. With regard to the application of the urgency procedure under Article 66(2) GDPR, the Pro posal unduly restricts the territorial scope of the adopted final measures to the territory of the Member State of the SA requesting the urgent opinion or decision . The EDPB and EDPS urge the co - legislators to specify that the final measures are adopted by the competent SA(s) and, as appropriate, with a broader scope than the territory of the requesting SA. The urgent decision or opinion should therefore be addressed to all CSAs and be binding on them. The EDPB and EDPS also make recommendations to clarify applicable procedural rules. Preliminary findings, preliminary view regarding the rejection of complaints and the right to be heard As for the procedural rights of the parties under investigation and the complainants, the EDPB and EDPS very much support th e harmonisation of their rights . At the same time, it would be beneficial to have more clarity on the interplay and timeline between the following documents: the ‘summary of key issues’, the ‘preliminary view’ to reject a complaint and the ‘preliminary fin dings’. In particular, regarding the preliminary findings provided to the parties under investigation, the EDPB and EDPS understand that the conclusions drawn in the preliminary findings remain of preliminary nature, so that the draft decision, including t he actual corrective measures taken, may differ from those in the preliminary findings, having regard to the views expressed by the parties under investigation. As a result, they make recommendations in order to give the SAs adequate margin of consideratio n in this respect, taking into account the individual case. The EDPB and EDPS also welcome the proposed requirement to submit to complainants the ‘preliminary view’ that the complaint should be fully or partially rejected . Nevertheless, if the complainant fails to comment on this preliminary view, the complaint should not be considered as being withdrawn. The LSA should prepare and submit a draft decision, regardless of whether comments were made by the complainant. During the dispute resolution process, the EDPB and EDPS consider that the change envisaged in the Proposal, consisting of the requirement for the Chair of the EDPB to provide the parties under investigation and the complainant in certain cases with a ‘statement of reasons’, is not in line with the architecture of the one - stop - shop system which provides that the LSA is the sole interlocutor of the controller and processor. The approach pursued in the Proposal is also unnecessary in light of current practice , in which the parties are entitled to provide their views to the SAs prior to the matter being referred to the EDPB on all elements on which the EDPB may potentially rely upon. The existing approach better allows the EDPB to duly take such views into account and reach a decision within the dea dlines. The EDPB and EDPS therefore urge the co - legislator s to remove this requirement and have the future Regulation retain instead the current approach to the right to be heard. Efficient cooperation between national SAs and the EDPS Adopted 8 Additionally, the P roposal provides a timely opportunity to address the existing practical obstacles to efficient cooperation between the national SAs and the EDPS, and vice - versa . The co - legislator s can and should make use of Article 16 TFEU legal basis to address these obs tacles. The Joint Opinion therefore recommends introducing a specific provision to this effect in the future Regulation, which would be instrumental in promoting effective and efficient cooperation between national SAs and the EDPS. Amicable settlements of complaints R egarding amicable settlements of complaints, the EDPB and EDPS call on the co - legislators to clarify and supplement with additional elements the provision on amicable settlements in order to enable its efficient implementation, in particular i n Member States that currently do not have national procedural laws to settle complaints amicably. In addition, the respective roles of the SAs in reaching, communicating and finalising the amicable settlement, as well as the interplay with the GDPR cooper ation procedure, should be clarified. Review clause Lastly, the EDPB and EDPS recommend including a review clause according to which the European Commission shall publish a report on the evaluation and review of the future Regulation at the same time as it publishes its report on the evaluation and review of the GDPR under Article 97 GDPR. Adopted 9 The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation (EU) 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) 1 , H aving regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018 2 , Having regard to the European Commission’s request for a joint opinion of the Europ ean Data Protection Board and the European Data Protection Supervisor of 4 July 2023, on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016 /679 3 . HAVE ADOPTED THE FOL LOWING JOINT OPINION 1 INTRODUCTION On 4 July 2023, the European Commission (‘ the Commission ’) issued a Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 and formally consulted the EDP B and EDP S in accordance with Article 42(2) of Regulation (EU) 2018/1725 (‘the EUDPR’) . In its 2020 report on the application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation 4 , hereinafter ‘ the GDPR’ ) 5 , the Commission noted that ‘ further progress is needed to make the handling of cross - border cases more efficient and harmonised across the EU, including from a procedural point of view, fo r instance on issues such c omplaint handling procedures, the admissibility criteria for complaints, the duration of proceedings due to different timeframes or the absence of deadlines in the national administrative procedural law, the moment in the procedure 1 OJ L 295, 21.11.2018, p. 3 9 . 2 References to ‘Member States’ made throughout this document should be understood as references to ‘EEA Member States’. 3 Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679, COM(2023) 348 final. 4 OJ L 119, 4.5.2016, p. 1. 5 Communica tion from the Commission to the European Parliament and the Council, Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, 24.6.2020, COM(2 020) 264 final. Adopted 10 where the right to be heard is granted, or the informatio n and involvement of the co mplainan ts during the procedure ’ . On 28 April 2022, the EDPB issued a statement on enforcement cooperation (‘ the Vienna Statement ’) 6 . In this S tatement, the EDPB resolved to ‘ identify a list of procedural aspects that could be fu rther harmonised in EU law to maximise the positive impact of GDPR cooperation ’ . Following the S tatement, the EDPB sent a letter to the Commission on 10 October 2022 , containing in its annex ‘ a list of procedural aspects that could benefit from further harmonisation at EU level, with a view of mak ing sure that national procedures do not hinder the full effectiveness of the GDPR ’ s cooperation and consistency mechanism ’ 7 . This list addresses, inter alia , the status and rights of the parties to the administrative procedures, procedural deadlines, requirements for admissibility or dismissal of complaints, investigative powers of Supervisory Authorities and the practical implementation of the cooperation pr ocedure. Following the EDPB w ish l ist, the Commission launch ed an initiative to further specify procedural rules relating to the enforcement of the GDPR 8 . In March and April 2023, the Commission consulted the subgroups of the EDPB that deal with cross - bord er cooperation and enforcement of the GDPR. The EDPB and EDPS strongly welcome the Commission ’ s prioritisation of this file which resulted in t he Proposal being issued on 4 July 2023. The EDPB and EDPS also very much welcome that the Proposal aims to give effect to many of the suggestions put forward by the EDPB. The EDPB and EDPS underline that the EPDB w ish l ist remains an important reference point for the assessment of the Proposal. Where appropriate, this Joint Opinion will make reference to the recommendations included in the EDPB w ish l ist. Furthermore, a list of ‘ready - to - use’ drafting improvements is provided in Annex 1 to this Joint Opinion, in particular to ensure consistent wording with the GDPR and make minor clarifications and corrections . In addition, the EDPB and EDPS recall that, on 25 April 2023 the EDPS submitted his contribution on the Commission initiative to the Commission 9 . This contribution underlined that the future Regulation provides an opportunity to address the existing practical obstacles to efficient cooperation between the EDPS and national SAs, although this was not taken up in the Proposal. The ED P B and EDPS underline that the application of the future R egulation, which contain s several new obligations, will require that SAs and the EDPB are provided with sufficient human and financial 6 EDPB Statement on enforcement cooperation, adopted on 28 April 2022, a vailable at: https://edpb.europa.eu/our - work - tools/our - documents/statements/statement - enforcement - cooperation en . 7 EDPB Letter to the EU Commission on procedural aspects that could be harmonised at EU level, sent on 10 October 2022 , available at: https://edpb.europa.eu/system/files/2022 - 10/edpb letter out2022 - 0069 to the eu commission on procedural aspects en 0.pdf . 8 Commission ini tiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR), available at: https://ec.europa.eu/info/law/better - regulation/have - your - say/initiatives/13745 - Further - specifying - procedural - rules - relating - to - the - enforcement - of - the - General - Data - Protect ion - Regulation en . 9 EDPS contribution in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR): https://edps.europa.eu/system/files/2023 - 04/23 - 04 - 25 edps - contribution - procedural - rules - gdpr - enforcement en.pdf . Adopted 11 resources . Adequate resources are necessary to ensure that SAs could effectively comply with the new obligations . 2 SCOPE AND LEGAL BASI S OF THE PROPOSAL ( ART ICLE 1 ) The EDPB and EDPS welcome that the scope of the Proposal encompasses the handling of complaint s and the conduct of investigations by supervisory authorities in the cross - border enforcement of the GDPR in both complaint - based and ex officio cases 10 . The EDPB and EDPS also note and welcome that the Proposal is based on Article 16 TFEU. According to Article 16(1) TFEU, everyone has the right to the protection of personal data concerning them. To this end, Article 16(2) TFEU empowers the European Parliament and the Council to lay down rules ‘relating the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which f all within the scope of Union law, and the rules relating to the free movement of such data’. In this respect, the EDPB and EDPS underline that Article 16 TFEU allows the co - legislator s to address a broad range of issues due to the horizontal and general n ature of this provision. Indeed, as indicated by Advocate General Szpunar in his opinion in case C - 33/22 11 , Article 16 TFEU (and the GDPR) should benefit from a ‘generalising interpretation’ according to which the ‘scope of EU law’ covers ʽ all activities th at are capable of falling within it ʼ ( ʽ in the sense that they have not been excluded from it on account of the Member States’ exclusive competence ʼ ) 12 . The EDPB and EDPS consider that the co - legislator s can and should make use of the Proposal to address a b roader range of issues and, in particular, to ( i ) clarify that the Proposal fully harmonises all of the requirements for the admissibility of complaints relating to a cross - border processing and (ii) address the obstacles to efficient cooperation between the EDPS and national SAs 13 . Article 1 of the Proposal should then be amended as far as necessary . 3 COMPLAINTS ( A RTICLES 3, 4 AND 5) 10 Article 1 of the Proposal. 11 Opinion of Advocate General Szpunar , of 11 May 2023, Case C ‑ 33/22, Österreichische Datenschutzbehörde, ECLI:EU:C:2023:397 , paragraphs 50 to 80. 12 See as well Judgment of the Court (Grand Chamber) of 22 June 2021, C - 439/19 , Latvijas Republikas Saeima , ECLI:EU:C:2021:504, p ara graph 66: ‘It follows that Article 2(2)(a) of the GDPR, read in the light of recital 16 thereof, must be regarded as being designed solely to exclude from the scope of that regulation the processing of personal data carried out by State authorities in the cours e of an activity which is intended to safeguard national security or of an activity which can be classified in the same category, with the result that the mere fact that an activity is an activity characteristic of the State or of a public authority is not sufficient ground for that exception to be automatically applicable to such an activity’. 13 See Section 9 of this Joint Opinion . Adopted 12 3.1 Admissibility of complaints and handling complaints ( Art icles 3(1) to 3 ( 4) , 3 ( 6 ) , 4 and Annex ( F orm ) ) 3.1.1 Information to be provided in the c omplaint (Article 3(1) and the Annex) Article 3(1) of the Proposal provides that a complaint submitted on the basis of the GDPR and which is about cross - border processing shall provide the information required in the Form , as set out in the Annex. No additional information shall be required in order for the complaint to be admissible . The EDPB and EDPS welcome the harmonis ation of information to be provided for a complaint to be admissible and are pleased to note that it shows significant similarities to the information to be provided according to the EDPB Template Complaint Form (‘EDPB Template’) . 14 In the view of the EDPB and EDPS, complaints constitute a cornerstone of the supervisory work for enforcing the GDPR and the right to file a complaint should not be limited by imposing unnecessary administrative burdens on complainants. T he EDPB and EDPS also note that there are several elements included in the Annex that were not included in the EDPB Template . I n the view of the EDPB and EDPS , this run s the risk of infringing the GDPR and imposing unnecessary barriers for data subjects to file a complaint. First, the EDPB and EDPS note that the Annex to the Proposal requires complainants to submit a form of identification , such as a passport, driving license or national ID. The EDPB and EDPS have strong reservations about such a requirement for the following reasons. T he EDPB and EDPS consider that requiring proof of identity to verify a complainant’s identity by default is not objectively necessary for the handling of complaints 15 . V erification of the complainant’s identity may be needed to a certain extent for the supervisory authority to be able to communicate with the complainant and issue decisions in line with the nation al administrative law requirements (e.g. if the decisions are issued in writing, the authority must be provided with a valid address) . 14 EDPB Template Com plaint Form, adopted on 20 June 2023, available at: https://edpb.europa.eu/system/files/2023 - 06/edpb_20230620_templatecomplaintform_0.pdf . The complaint form as provided for in the Annex to the Proposal thereby builds on the work of the EDPB, in line with commitments made in the Vienna statement. The EDPB and EDPS are pleased to see alignment between the complaint forms as it concerns contact details of the complainant, the subject matter of the complaint, details on the entity which is the subject of the c omplaint, including correspondence with that entity, and relevant documentation and evidence supporting the claims made in the complaint . 15 The EDPB and EDPS recall that, where controllers need to process personal data to confirm a data subject’s identity , controllers should ensure that they do not process more personal data than is necessary to enable the required authentication in line with the data minimisation principle (Article 5(1)(c) GDPR). According to the EDPB, “ using a copy of an identity document as a part of the authentication process creates a risk for the security of personal data and may lead to unauthorised or unlawful processing, and, as such, it should be considered inappropriate, unless it is necessary, suitable, and in line with national law ” (see, EDPB Guidelines 01/2022 on data subject rights - Right of access , version 2.0, after public consultation adopted on 28 March 2023, paragraphs 70 - 74.) . Although th ese considerations were made in the context of requests to exercise data subjects’ rights, and cannot therefore be transposed one - to - one to the situation where a complainant lodges a complaint with a supervisory authority , the EDPB and EDPS consider that they can nevertheless form an important starting point from which to assess whether or not it is in line with the GDPR to require, by default, the submission of identity documents from complainants when they lodge a complaint with a supervisory authority that relates to cross - border processing. Adopted 13 However, this does not mean that ID proof shou ld be a mandatory prerequisite. Current practice shows that many supervisor y authorities can adequately handle complaints without having verified the complainant’s identity through an identity document . This is also reflected in the fact that , in the EDPB Template, such identification details are not included as a mandatory eleme nt but the extent of verification of the complainant's identity is left to the discretion of the supervisory authority (and so of national law) that implements the EDPB Template. The EDPB and EDPS would therefore strongly advise the remov al from the Annex to the Proposal of the information requirement that, where the complainant is a natural person, they must submit a form of identification. In such an event, the EDPB and EDPS wish to advise that the Annex to the Proposal should instead requi re the submission of the full name and surname of the complainant as mandatory information . Secondly, the EDPB and EDPS note that the Annex to the Proposal require s complainants to submit a signature. Referring to the considerations above, it is not clear to the EDPB and EDPS why a signature is objectively necessary, or even suitable, to verify a complainant’s identity. In the same vein, it is not clear to the EDPB and EDPS why the required submission of a telephone number is necessary for complaint - handli ng. Both requirements may add unnecessary and undesirable barriers for complainants to lodge a complaint. The EDPB and EDPS would therefore advise t he remov al of the requirements that a complainant has to provide their telephone number and submit a signatu re in the complaint . Instead, the submission of a telephone number could be added as non - mandatory supplementary information in Part B of the Annex to the Proposal as means for the SA to contact the complainant . Lastly , g iven the scope of the Proposal, which is limited to cross - border enforcement, it is possible that complaints will be subjec t to different information requirements for their complaint to be deemed admissible depending on whether the case at hand concerns a cross - border processing or not. T he EDPB and EDPS consider that i t cannot be expected that complainants ar e aware of and understand the distinction between cross - border processing and non - cross - border processing , let alone be capable of performing an assessment of this themselves . T his m eans , in practice , that in order to facilitate the submiss i on of complaints, supervisory authorities would either have to use the F orm for all complaints (including ones related to non - cross - border pr ocessing ) or seek alternative ways to comply with the future Regulation . The EDPB and EDPS therefore welcome the fact that the Proposal recognises in recital 4 that nothing prevents Member States from extending the use of the Form to cases that do not concern cross - border processing . 3.1.2 Preliminary vetting and i nvestigatory powers of supervisory authorities before competence is established The EDPB and EDPS welcome the explicit confirmation in Article 3(2) of the Proposal that ‘ the supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross - border processing ’ (the so - called ‘preliminary vetting’). However, the EDPB and EDPS regret that Article 3(2) does not further codify existing arrangements on ‘preliminary vetting’ as Adopted 14 provided in the EDPB internal guidelines on the topic. 16 As recalled by the EDPB in the EDPB w ish l ist, experience shows that supervisory authorities have different views on the extent to which they are competent to perform preliminary investigations on the cross - border nature of complaints and, w here appropriate, their potential local impact. In the opinion of the EDPB and ED P S, it is therefore essential to provide a clear legal basis for supervisory authorities to carry out investigative acts in order to arrive at a preliminary conclusion both on the cross - border nature of the processing, as is currently foreseen in the Proposal, bu t also on the local nature of a case pursuant to Article 56(2) GDPR and the comp etence of supervisory authorities. The determination of competence of the lead and conce rned supervisory authorities at the earliest possible stage is essential for the functioning o f the one - stop shop mechanism. The EDPB and EDPS consider that the SA with which the complaint was lodged should be able to make inquiries with the relevant parties with a view to preliminarily establish competence . Such abilities should, in particular, allow t hat SA to assess whether the processing is cross - border in nature and to determine whether or not the subject matter of this case only has local impacts . The EDPB and EDPS therefore believe t hat it is necessary for this to be clarified in the future Regulation 17 . 3.1.3 Admissibility of complaints The EDPB and EDPS note that Article 3( 1) of the Proposal aims to harmonise at least part of the admissibility requirements, though only in so far as they relate to the information that complainants are required to provide to supervisory authorities in cross - border cases in order to lodge a complaint. As regards the determination of whether a comp laint fulfils the information requirements, the Proposal is based on the idea of mutual recognition: only the supervisory authority with which the complaint was lodged carries out this determination. The EDPB and EDPS welcome this clarification. The EDPB a nd EDPS also welcome that the Proposal leaves room for the complainant to submit more information than is required in the F orm, provided that the submission of that additional information is not a requirement for admissibility. While the Proposal makes it clear that completeness of information set out in the F orm is a requirement for a complaint to be admissible , the EDPB and EDPS note that it does not take into account other admissibility grounds , such as statute of limitations , which may restrict the time within which complaint s can be brought before the supervisory authorities in som e Member States . Such other grounds can create difficulties for complaint handling within the one - sto p - shop mechanism, especially where the lead supervisory a uthority has different or stricter admissibility grounds than the supervisory authority with which the complaint was lodged . The EDPB and EDPS consider it unfortunate that the P roposal currently contains no rules about this. The EDPB and EDPS therefore ur ge t he co - legislators to include an exhausti ve harmonisation of admissibility requirements in the future Regulation which would pre - empt conflict s in national 16 See EDPB Internal document 6/2020 on preliminary steps to handle a complaint: admissibility and vetting of complaints, adopted on 15 December 2020 and published after a decision by the EDPB on 14 June 2022. 17 In addition, the EDPB and EDPS note that the ED PB wish under 4.3. of the EDPB w ish l ist was not taken on board and therefore recommend confirming in the future Regulation that SAs are competent to monitor compliance with enforcement orders contained in the final decision . Adopted 15 admissibility requirements. In addition, the EDPB and EDPS would propose that Article 3(3) of the Proposal be reworded in the following direction: ‘The supervisory authority with which the complaint was lodged shall determine the admissibility of the complaint, including the completeness of the information required by the Form , within one mont h ’ 18 . Article 3(4) of the Proposal should be amended accordingly so that it not only refers to the assessment of the completeness of information required by the Form but also to the assessment of the admissibility of the complaint (see also concrete wording s uggestion in the Annex to this Joint Opinion ) . Furthermore , the ED PB and EDPS see two issues with the deadline of one month contained in Article 3(3) of the Proposal . First, t he starting point of the deadline of one month is not specified. The EDPS and ED PB call for this to be specified , for example so that the timeline be gins upon rece ipt of the complaint. Secondly , the deadline contained in Article 3(3) of the Proposal is phrased without possibility for extension. The EDPB and EDPS note that t his would effectively prevent the supervisory authority with which the complaint was lodged from being able to contact the complainant about any shortcomings in the required information detailed in the complaint form and give the complainant the opportunity to suppl ement it . It is undesirable for a complaint to be declared inadmissible after one month because it is not complete without giving the complainant the opportunity to remedy shortcomings. This would also amount to imposing unnecessary barriers for data subje cts to file a complaint . This could be remedied , for example, by adding a possibility for extension in Article 3(3) of the Proposal . 3.1.4 Investigating to the extent appropriate (Article 4) Article 4 of the Proposal , as also explained in recitals 6 and 12 of the Proposal, sets out criteria for supervisory authorities to determine the extent to which it is appropriate to investigate a complaint under Article 57(1)(f) GDPR. R ecital 6 of the Proposal provides that ‘ (…) supervisory authorities should aim to deliv er a satisfactory resolution to the complainant, which may not necessarily require exhaustively investigating all possible legal and factual elements arising from the complaint ’ . The EDPB and EDPS welcome this much - desired clarification of the concept of ‘ investigating to the extent appropriate’ included in Article 57(1)(f) GDPR. However, the current wording of Article 4 of the Proposal le aves in the middle which supervisory authority is referred to. The EDPB and EDPS suggest making ex plicit that the obliga tion contained in Article 4 of the Proposal are incumbent on the lead supervisory authority, and not the superv isory authority concerned with which the complaint was lodged. F urthermore , on the basis of Article 4 of the Proposal, it is unclear how a case must be finalised where that case is based on a complaint for which no conclusion on the merits is reached (i.e. there is no definitive conclusion on the existence of an infringement of the GDPR) after it has been investigated to the extent appropriate and following the consideration of the relevant criteria set ou t in Article 4 of the Proposal . In the view of the EDPB and EDPS, it is desirable to include a clarification on this aspect in the Proposal in light of the requirement under Article 7 8 ( 1 ) GDPR to provide a n effective judicial remedy to the 18 See however below in paragra ph 25 of this Joint Opinion the recommendation to provide for an extension of this time limit. Adopted 16 complainant . In that respect, the EDPB and EDPS would propose to clarify that SA s should finalise complaint - based cases by way of an appealable decision dismissing or rejecting the complaint, following the proce dure provided for in Articles 9, 10, 11, 12 and 13 of the Proposal, where applicable. 3.2 Amicable settlements ( Art icle 5 ) The EDPB and EDPS welcome the introduction of the provision on amicable settlements in the P roposal as it can contribute to ensuring more effective and expeditious enforcement of cross - border complaints 19 . However, Article 5 of the Proposal needs to be further clarified and supplemented with additional elements to enable the effective implementation of this instrument, particular ly in Me mber States that currently do not have national procedural laws to settle complaints amicably . Moreover, the provision affects the existing efficient practices of SAs, established by the EDPB Guidelines 06/2022 on the practical implementation of amicable s ettlements 20 . 3.2.1 Scope of Article 5 As a preliminary remark, the EDPB and EDPS would like to stress that , although Article 5 of the Proposal provides a legal ground f or amicable resolutions, it is not sufficiently comprehensive and clear to prevent legal and practical challenges which SAs in Member States would face, particular ly those SAs whose nati onal law do es not currently provide for the use of amicable settlements 21 . The provision must therefore be clarified and provide further detailed rules regarding amicable settlements, especially with regard to the scope of application and the consequences of a refusal of the amicable settlement by the complainant. Therefore, the EDPB and EDPS call on the co - legislator s to provide a sufficiently comprehensive procedure or to require Member States to do so at national level in the light of the additional specifications called for . Neither Article 5 nor the corresponding R ecital 9 define the concept of an ‘amicable settlement’. The EDPB and EDPS suggest that the P roposal lists a set of criteria, taking into account the EDPB Guidelines 06/2022 22 , where , among others , the EDPB express ed the view that amicable settlements should in general only be considered possible in cases concerning the data subjects’ rights and where with the resolution of the dispute by an amicable settlement , t he object of the complaint is no longer present . 19 See EDPB w ish l ist, proposal 8, which calls on clear and harmonised rules on resolving complaints through amicable settlement or other non - contentious ways and on the clarification of the applicability of Article 60 GDPR in case of amicable settlement. 20 EDPB Guidelines 06/2022 on the practical implementation of amicable settlements, (‘EDPB Guidelines 06/2022’) v ersion 2.0, after public consultation, a dopted on 12 May 2022. 21 See Annex 2 of EDPB Guidelines 06/2022 on the practical implementation of amicable settlements , version 2.0, after public consultation, adopted on 12 May 2022 . 22 EDPB Guidelines 06/2022 on the practical implementation of amicable settlements, v ersion 2.0, after public consultation, a dopted on 12 May 2022. Adopted 17 3.2.2 Role s of the LSA and CSA The P roposal leaves open which supervisory authority seeks the amicable settlement and communicates the settlement to the complainant. The EDPB Guidelines 06/2022 23 envisage that both the LSA and a complaint - receiving SA may try to facilitate the reaching of an amicable settlement . H owever, the complaint - receiving SA may usually do so only in the preliminary vetting phase - that is before the case reaches the LSA as part of the one - stop - shop mechanism . In the one - stop - shop mechanism , the LSA may also attempt to seek an amicable settlement after receiving a case from the complaint - receiving CSA. The EDPB and EDPS thus suggest that the wording of Article 5 of the Proposal is amended so that it specifies and clarifies the roles and activities of the SAs in reaching, communicating and finali s ing the amicable settlement. The P roposal also leaves open the question of the exact role of the complaint - receiving SA in case s where an amicable settlement is attempted by the LSA. In line with the overarching consensus - finding objective and EDPB Guidelines 06/2022, the EDPB and EDPS would suggest clarifying that ‘ the LSA shall obtain the CSA’s views on the proposed settlement. ’ 3.2.3 Application of the one - stop - shop mechanism Article 5 of the Proposa l further provides that if the complainant does not object to the proposed amicable settlement in a specified time period, the complaint shall be deemed withdrawn. The EDPB and EDPS warn that the wording ' does not object ' is not clear and different interpr etations may arise. It is not clear whether this means that the complainant agrees with the proposed settlement, that the complainant fails to respond to the attempts to reach an amicable settlement , or bot h. T herefore , the EDPB and EDPS propose that this be clarifi ed in recital 9 of the Proposal . Furthermore, the EDPB and EDPS call on the co - legislators to clarify the outcomes of the following four scenarios , differentiated on the basis of the complainant's involvement: (1) the complainant actively expresses his or her agreement with the proposed amicable settlement , (2) the complainant objects to the proposed amicable settlement , (3) the complainant does not respond to the proposed amicable settlement , and (4) the complainant partially objects to the proposed amicable settlement because they consider that some of their requests have still to be decided. W ith regard to the first scenario, if it is the complaint - receiving SA that proposes the settlement, the amicable settlement may make it unnecessary to initiate an Article 60 GDPR procedure insofar as the settlement achieved is to the full satisfaction of the parties involved . Where the LSA proposes the settlement, the EDPB and EDPS recommend clarifying that Article 60 GDPR applies in full, including the obligation to submit a draft decision for revision by the CSAs and to adopt a final (albeit sui generis ) decision by the LSA, finding that the complaint has been settled by the LSA with the mutual satisfaction 23 EDPB Guidelines 06/2022 on the practical implementation of amicable settlements, v ersion 2.0, after public consult ation, a dopted on 12 May 2022. Adopted 18 of the data subject and party under investigation 24 . In the event that the case is closed due to an amicable settlement reached by the LSA, the EDPB and EDPS propose that the fut ure Regulation should require the LSA to immediately submit the sui generis draft decision to the CSAs without prior drafting of a summary of key issues and the submission of preliminary findings, in line with the situation envisaged in p aragraph 36 of the EDPB Guidelines 06/2022. With regard to the second scenario, if it is the complaint - receiving SA that proposed the settlement, it will have to forward the complaint along with all the relevant information to the LSA pursuant to Article 56(1) GDPR in order to launch the one - stop - shop mechanism pursuant to the applicable provisio ns. If it is the LSA that proposed the settlement, the LSA shall investigate the complaint to the extent appropriate , resulting in a decision under Article 60 GDPR . With regard to the third scenario, if the settlement was proposed by the complaint - receiving SA, it will have to forward the complaint to the LSA in order for the one - stop - shop mechanism to be launched 25 . Where this is the case , or whe re the settlement is p roposed directly by the LSA, the LSA should investigate the complaint to the extent appropriate , which may also include terminating the handling of the case , considering that no settlement has been reached. The EDPB and EDPS also propose replacing the wording ' the complaint shall be deemed withdrawn ' with ' the handling of the complaint shall be terminated 26 . With regard to the fourth scenario, the future Regulation should clarify that the complainant must specify the part of the proposal with which they disagree and provid e reason s for their disagreement. In this case, the part of the complaint with which the complainant agreed could be settled as in the first scenario while, for the remaining aspects, the complaint should be treated as in the second scen ario. 4 COOPERATION PROCEDUR E AND REACHING CONSE NSUS ( AR T ICLES 2(2), 7, 8, 9 AND 10) 4.1 General Remarks Chapter III of the Proposal aims to streamline the cooperation of SAs in cross - border cases. The EDPB and EDPS welcome the Proposal 's approach to strengthen ing the consensus - finding process . However, the EDPB and EDPS a lso recall that a consensus should be reached both on the scope of the investigation and on the outcome of the investigation ( i.e. on the content of the draft decision ) . Instruments promoting t he establishment of a consensus on the content of the draft decision before it is sent to the parties under investigation would therefore be desirable in Chapter III of the Proposal. 24 EDPB Guidelines 06/2022 on the practical implementation of amicable settlements, v ersion 2.0, a dopted on 12 May 2022, para graphs 28 and 55. 25 In line with Art icle 56(1) GDPR. 26 A draft decision under Article 60(3) GDPR shou ld also be issued in case of termination, in accordance with the EDPB Guidelines 06/2022 on the practical implementation of amicable settlements, v ersion 2.0, after public consultation, a dopted on 12 May 2022, para graph 55. Adopted 19 The EDPB and EDPS reiterate that a tighter framework for certain procedu ral steps, including timelines, is necessary to ensure swift and efficient enforcement 27 . The EDPB and EDPS note that the Proposal generally envisages deadlines with regard to the new steps introduced in Chapter III of the Proposal and only refer to the CSA s. Likewise, certain procedural steps may only b e initiated by the LSA. Generally, the EDPB and EDPS would welcome a more equal treatment of procedural deadlines and rights of initiative between the LSA and CSAs. 4.2 Scope of the Proposal The EDPB and EDPS note that Section 1 of Chapter III of the Proposal directly addresses the EDPB’s wish for further clarification of the scope, content and modalities of information sharing under Article 60(1) and (3) GDPR. The EDPB and EDPS are confident that the new forma l procedural steps introduced in Section 1 hold great potential for a more efficient structure and enhanced cooperation, which will ultimately lead to swifter investigation and – if necessary – enforcement in one - stop - shop cases. At the same time, the EDPB and EDPS note that the new formal steps are applicable to all Article 60 GDPR cases, including the vast majority of non - complex and non - controversial cases. The EDPB and EDPS understand that by its very nature, the Proposal addresses all cross - border proc essing cases as defined in Article 1 of the Proposal to ensure the balanced application of all the relevant rights to all the relevant cases. The EDPB and EDPS further understand that the Proposal aims to do this by providing clarifications on Article 60 GDPR and on the cooperation duties of the LSA and CSAs, - in order to avoid situations where the CSAs can react only by means of RROs, whilst ensuring full compliance with the parties' right to be heard in such proceedings across the whole EEA. Moreover, t he EDPB and EDPS observe and welcome that the Proposal, as point ed out in the above paragraphs ( see Section 3.2 of this Joint Opinion ) , contains tools and instruments that are intended to facilitate and speed up the handling of certain complaint - based case s that lend themselves to being addressed and dealt with in a more straightforward manner such as by way of amicable settlement. However, the new rules do entail an increased administrative workload for SAs in terms of documents to be drafted (e.g. the su mmary of key issues and preliminary findings). For this reason, the EDPB and EDPS recommend that the co - legislators clarify that a proportionate approach could be followed by the LSA when preparing such documents so that the amount of information and of do cuments to be presented at the ’summary of key issues’ stage could be tailored depending on the 'complexity' of the case at issue. This would leave the LSA some leeway in determining the level of detail for the information to be provided under Articles 8 a nd 9 of the Proposal and would also ensure that the CSAs are in a position to ask, by making comments on the summary of key issues, for additional clarifications or documentation when they deem it necessary. Such an approach would also avoid placing an unn ecessary administrative burden on the LSA and would ensure that the CSAs could be, in all cases, allowed to fully participate in the procedure at a more convenient stage. 27 See EDPB wish list, Proposal 5 . Adopted 20 4.3 Information to be shared with the CSAs and ' summary of key issues ' (Articles 8 and 9) The EDPB and EDPS welcome the clarification in Article 8(1) of the Proposal that ‘ the LSA shall regularly update the CSAs about the investigation and provide them with all relevant information once available ’ . Likewise, the EDPB and EDPS welcome the defin ition of 'relevant information' in Article 8(2) of the Proposal. In addition to some clarifications suggested in the Annex to this Joint Opinion, the EDPB and EDPS note that, under Article 8(1) of the Proposal, the LSA must provide the relevant information 'at the earliest convenience'. To ensure that CSAs receive all relevant information in a timely manner during the cooperation procedure, and to avoid having the timing left entirely to the LSA’s discretion, these terms should be replaced by 'without delay as soon as it is available to the LSA'. With regard to the list of information which can be found in Article 8(2) of the Proposal , the EDPB and EDPS consider that the summary of key issues in an investigation under Article 9 of the Proposal and the prelim inary findings under Articles 14 and 15 of the Proposal are highly relevant information for CSAs. The EDPB and EDPS therefore welcome that those items are explicitly mentioned in the list. The EDPB and EDPS, however, also recommend amending Articles 14 and 15 of the Proposal to clarify that preliminary findings must be disclosed to the CSAs before being disclosed to the parties under investigation and the complainant, since the CSAs must be able to assess if they can agree with those findings 28 . On Article 8 (2)(b) of the Proposal , the EDPB and EDPS recommend clarifying that information which was provided by the party under investigation, and which was given in reply to a request for information, should also be included. On Article 8(2)(k) of the Proposal , the EDPB and EDPS recommend also referring to the relevant steps taken by the LSA after receiving the written views of the complainant in accordance with Article 15(1) of the Proposal . Further, the EDPB and EDPS suggest that the co - legislators consider the it ems identified in the EDPB Guidelines 02/2022 on the application of Article 60 GDPR 29 as relevant information to the list in Article 8(2) of the Proposal 30 . The EDPB and EDPS welcome the introduction of the ‘summary of key issues’ in Article 9 of the Proposa l. This new instrument has the potential to provide a good and timely overview, especially in complex procedures, in particular on the subject matter of the investigation. The EDPB and EDPS suggest specifying a concrete timeframe for these 31 . In particular, deadlines for the submissions of the 28 See also para graph 56 of this Joint Opinion. 29 EDPB Guidelines 02/2022 on the application of Article 60 GDPR, adopted on 14 March 2022, paragraph 50. 30 That is: Correspondence with data controller/data subjects on the subject of a complaint or investigation; - Meetings with controllers or processors: Agenda, scope and task, minutes of the meeting/assessment of the outcome of the meeting, intended follow up actions; - Minutes of hearings and rehearings – also related to single issues of the case; - Questionnaires sent to the controller/processor; Possib le first draft report of the investigation/inspection; - Possible Expert reports (legal, technical) also from external providers; Furthermore, the following information should be submitted; - a copy of the complaint where the case is complaint - based ( EDPB Guidelines 02/2022 on the application of Article 60 GDPR, adopted on 14 March 2022, paragraph 50 ).See also Section 8.1.1. of this Joint Opinion, paragraph 156 . 31 See EDPB wish list, proposal 5 and paragraph 42 of this Joint Opinion . Adopted 21 'summary of key issues' and ‘ preliminary findings ’ should be developed. The EDPB and EDPS recommend that a time limit is introduced in the future Regulation for the LSA to submit the ‘ summary of key issues ’ and the ‘ pr eliminary findings ’ in contentious cases, with the possibility for the LSA to provide for specific reasons for extending that period 32 . The EDPB and EDPS are confident that the future Regulation would help the CSAs to resolve disagreements, in particular wi th regard to the scope of the investigation, at an early stage. However, the EDPB and EDPS consider that the interplay between the 'summary of key issues' (Article 9 of the Proposal ), 'preliminary view' (Article 11 of the Proposal ) and 'preliminary finding s' (Articles 14 and 15 of the Proposal ) needs clarification 33 . In addition, the EDPB and EDPS wonder why only 'complex' legal and technological assessments should be shared by the LSA pursuant to Article 9(2)(c) of the Proposal 34 . CSAs should be able to comm ent on the identification of the whole factual and legal assessment carried out by the LSA, regardless of its complexity. Therefore, the term 'complex' should be deleted as the level of detail to be inserted in the summary of key issues should be dependent on the case at stake. Article 9(3) of the Proposal stipulates that CSAs may provide comments on the summary of key issues within four weeks. The EDPB and EDPS suggest clarifying that the comments from CSAs should be shared with all other CSAs and the LSA, rather than only with the LSA, and that the future Regulation should require that the LSA take account of the comments provided by CSAs. In relation to the requirements set out in Article 9(4) of the Proposal , the EDPB and EDPS consider that those require ments are too detailed and risk undermining the capacity of the CSAs to cooperate in an appropriate manner with a view to reaching consensus. Article 9(5) of the Proposal allows the EDPB to specify, in its r ules of p rocedure, restrictions on the maximum le ngth of comments submitted by supervisory authorities concerned on the summary of key issues. The EDPB and EDPS suggest deleting this paragraph as they consider such restrictions to potentially hinder cooperation between SAs and would recommend in any even t that this matter be dealt with by the EDPB 35 , and not in the future Regulation . 4.4 Reaching consensus pursuant to Art icle 60 GDPR (Art icle 10) The EDPB and EDPS welcome the approach taken by Article 10 of the Proposal for reaching consensus between LSAs and CSAs, which is the main objective of the cooperation procedure. As a general observation, the EDPB and EDPS highlight that the scope for appl ication of the means to reach consensus in case of disagreement on the scope of the investigations is currently limited to complaint - based procedures under Article 10(1)(a) of the Proposal. As reflected in the EDPB Guidelines 09/2020 on relevant and reason ed objection under Regulation 2016/679 36 , the duty of sincere and effective 32 However , t he EDPB and EDPS note that the proposed Regulation does not foresee the consequences of non - compliance with the established deadlines in the GDPR as raised und er Proposal 2.1 of the EDPB w ish l ist . 33 See also para graph 129 further below in this Joint Opinion. 34 See also Article 10(1)(b) of the Proposal and Article 10(1)(c) of the Proposal. 35 In accordance with Article 70(1) GDPR . 36 EDPB Gui delines 09/2020 on relevant and reasoned objection under Regulation 2016/679, version 2.0, after public consultation, adopted on 09 March 2021, paragraph 27 (ʽ[i]n own - volition inquiries, the LSA and CSAs Adopted 22 cooperation is not limited to complaint - based investigations. The EDPB and EDPS understand that Article 10 of the Proposal does not intend to diminish this duty of cooperation and s imply does not specify the means to reach a consensus in such cases. In the interest of legal certainty, however, the EDPB and EDPS recommend including a recital which clarifies that the procedures outlined by the Proposal in relation to complaint - based ca ses do not diminish the general duties of sincere and effective cooperation between the lead supervisory authorities and other supervisory authorities concerned in other cases 37 . The EDPB and EDPS consider that Article 10 of the Proposal should be strengthe ned by further elements that facilitate consensus, as explained in the following. Currently, Article 10 of the Proposal, including the last resort urgency procedure, seems to focus on early consensus finding and the scope of the investigation, and not on the legal or technological assessment. The rationale of Article 10 of the Proposal should be extended to the more mature legal assessments, which are included in the procedural steps laid out in Sections 2 and 3 of Chapter III of the Proposal . In particula r, the EDPB and EDPS consider that the future Regulation should provide that the preliminary findings (Article 14 of the Proposal ) are to be formally shared with the CSAs, and provide for the opportunity to find consensus through comments, and non - mandator y requests under Article 61 or 62 GDPR (Article 10(3) of the Proposal) 38 . In addition, the EDPB and EDPS wonder why in Article 10(1) of the Proposal there is no reference to consensus on the potential corrective measures, which are part of the summary of ke y issues under Article 9(2)(d) of the Proposal . Such a reference should be included in Article 10(1) of the Proposal in order to align that paragraph with Article 9(2)(d) of the Proposal . In general, the obligation for the CSAs 39 to make use of Articles 61 or 62 GDPR when they have failed to reach consensus through the commenting procedure remains unclear. Especially when the absence of consensus about the scope of a complaint is already apparent after the exchange of comments and any further exchanges as re quired by Article 10(3) of the Proposal, making a mandatory additional request under Articles 61 or 62 GDPR seems an unnecessary detour which would lead to further delay of the procedure. In addition, the purpose of the reference to Article 62 GDPR in Arti cle 10(1) of the Proposal is not fully clear, considering that the primary rationale of Article 62 GDPR is not the facilitation of finding a consensus but the facilitation of conducting joint investigations. Therefore, some clarifications on the use of thi s tool within the consensus finding process could be helpful. The EDPB and EDPS recommend leaving Article 61/62 GDPR requests under Article 10(1) of the Proposal as optional; if it is clear for the LSA and CSAs that no consensus has been reached after the exchange of comments and following the should seek consensus regarding the scope of the pr ocedure (i.e. the aspects of data processing under scrutiny) prior to initiating the procedure formally. The same applies in cases where a SA dealing with a complaint or report by another SA takes the view that an own - volition inquiry is also necessary to deal with systematic compliance issues going beyond the specific complaint or report’). 37 In the same vein, the EDPB and EDPS understand that as the Proposal does not aim at amending the GDPR, it does not prejudice the ability of SAs to request mutual assi stance or joint operations outside complaint - based cases, including the possibility to request an urgent EDPB decision under Article 61(8) GDPR and Article 62(7) GDPR. 38 See also para graphs 58 et seq. further below in this J oint O pinion . 39 See Recital 15 o f the Proposal. Adopted 23 exchan ges under Article 10(3) of the P roposal, the urgency procedure pursuant to Article 10(4) of the Proposal should be available without having to make Article 61/62 requests. To that end, and in order to facilitate consensus finding, the EDPB and EDPS recommend that the LSA should be obliged to 'engage' with the comments received (and possibly with any requests received under Article 10(1)) of the Proposal within a deadline , corresponding to the CSAs’ deadline in Ar ticle 9(3) of the Proposal . Further, comments and requests (and the LSA‘s respective reactions) should be shared with all CSAs to enable a broad discussion and to find consensus, before the urgency procedure is triggered as a last resort. The EDPB and EDPS recall that any urgent decision on the scope of the investigation shall be binding for all CSAs. Where the scope of the investigation is determined on the basis of a consensus reached after the exchange of comments on the ‘ summary of key issues ’ , the EDPB and EDPS agree with the Proposal that this consensus should be used by the LSA as a basis to continue the investigation and draft the preliminary findings. In the spirit of sincere and effective cooperation, the SAs should stick to this consensus and to t he elements agreed upon. In general, the EDPB and EDPS note that Article 10 of the Proposal does not clarify the procedural rules that are applicable to Article 66(3) GDPR. Further, the EDPB and EDPS observe that, under the current wording of Article 10(4) of the Proposal , the conditions for requesting an urgent binding decision under Article 66(3) GDPR are only presumed to be met where the LSA triggers the urgency procedure, and not if another CSA requests an urgent decision on the scope from the EDPB unde r Article 66(3) GDPR. The EDPB and EDPS consider that, where there is no consensus between the LSA and any other CSA on the scope of the investigation, the presumption set out in Article 10(4) of the Proposal should apply independently from the SA triggeri ng the procedure (whether that is the LSA or another CSA). CSAs have an equally legitimate interest to clarify the scope of the investigation and should therefore also be able to request the urgency procedure under Article 10(4) of the Proposal. In any cas e, the Proposal should require that the CSA that initiates the procedure coordinates its request with all CSAs 40 . The EDPB and EDPS understand from Article 10(5) of the Proposal that the list of documents that the LSA must provide when triggering the Articl e 66(3) GDPR procedure only corresponds to part of the summary of key issues, namely the main relevant facts and the preliminary identification of the scope of the investigation. The EDPB and EDPS would recommend that, when requesting an urgent binding dec ision, the LSA must provide the full summary of key issues within the meaning of Article 9 of the Proposal 41 (and not only the information of the summary under points (a) and (b) of Article 9(2)) of the Proposal as this document will already be available. T he EDPB and EDPS consider that the preliminary orientation of legal and factual assessments and corresponding corrective measure(s) might be useful contextual elements for the purpose of making an informed decision on the scope of the investigation. The ED PB and EDPS are also concerned that the list set out under Article 10(5) of the Proposal would be interpreted as being exhaustive and that it would therefore not be possible for the EDPB to request 40 For example, in the Internal Market Inf ormation (IMI) system, in order to streamline the procedure and avoid that multiple requests for an urgency procedure are made at the same time. 41 See also paragraph 49 (along with f ootnote 32 ) of t his Joint Opinion, which refers to the items identified in the EDPB Guidelines 02/2022 on the application of Article 60 GDPR , adopted on 14 March 2022. Adopted 24 other relevant documents or information, such as supportin g documents mentioned in the LSA’s summary of key issues and CSAs’ comments. Further, if a request under Article 61 GDPR and/or Article 62 GDPR is made, this will give rise to other exchanges between the LSA and the CSA(s) that may be relevant as part of t he urgency procedure. The EDPB and EDPS therefore suggest that the language of Article 10(5) of the Proposal is revised to make it clear that the EDPB may require the LSA to provide other documents or information, as it deems appropriate in the particular case. In addition, the list provided in Article 10(5) of the Proposal should include the documents shared by a CSA under Article 9(4)(c) of the Proposal and the LSA’s position on the comments. Furthermore, the EDPB and EDPS notice that the legal deadline o f two weeks under Article 66(4) GDPR to decide on the scope of the investigation is rather short, especially in complex investigations (e.g. when multiple complaints or several GDPR provisions are involved). It would be difficult to resolve complex factual or legal issues in two weeks, which might result in relatively superficial assessments. Finally, the EDPB and EDPS understand that, following the Article 66 decision, the CSAs are bound by the summary of key issues. Following the EDPB’s decision, the reg ular cooperation procedure continues with any relevant actions leading to the reasons for the LSA’s preliminary views that the complaint should be fully or partially rejected under Article 11 of the Proposal and the preliminary findings under Article s 14 a nd 15 of the Proposal 42 . 5 CONFIDENTIALITY, ACC ESS TO THE FILE, AND TRANSLATIONS ( ART ICLES 3(5), 6, 11 (4), 15 (3) - (5), 19, 20 AND 21 ) 5.1 Confidentiality of the complaint According to Article 3(5) of the P roposal , a complainant may claim confidentiality . I n such a case , the complainant must also submit a non - confidential version of the complaint. The EDPB and EDPS are aware of the importance of confidentiality concerning the complaint procedure 43 . Nevertheless, when there is an alleged infringement of a comp lainant’s personal data protection right (s) , it must be possible for the parties under investigation to conduct an internal investigation, ' defend ' themselves and react to an investigation in to the alleged infringement. As a result , it may not be possible to provide the complainant with ' complete ' confidentiality in some cases as such confidentiality may substantially interfere with the ongoing investigation. T he EDPB and EDPS 42 This is in line with the stance taken by the EDPB in the EDPB Guidelines 02/2022 on the application of Article 60, adopted on 14 March 2022, stating at paragraph 263, regarding the interplay between urgency procedure and OSS procedure that 'Once the EDPB issues its urgent opinion or urgent binding decision, the OSS procedure can recommence and the effects produced by the urgency procedure will have to be factored in the OSS procedure’. 43 See by analogy the Judgment of the EFTA Court of 10 December 2020 in Joined cases E - 11/19 and E - 12/19, Adpublisher AG v J & K stating that ‘The question of nondisclosure of a complainant’s personal data must be examined in the light of the principles for processing personal data under Articles 5 and 6 of the GDPR. Nondisclosure should not be granted if it would inhibit the perfo rmance of the obligations provided in the GDPR, or the exercise of the right to effective judicial remedy and due process as set out in Article 58(4) of the GDPR and under the fundamental right to an effective judicial remedy’. Adopted 25 therefore recommend clarifying the scope of the required confidentiality a s well as the possibility to limit a complainant’s claim of confidentiality. Further, Article 3(5) of the P roposal should specify that the SAs involved in the case would receive the confidential version of the complaint 44 . 5.2 Translations A ccording to Article 6 of the Proposal, the complaint - receiving SA is responsible for translating complaints and views of complainants into the language of the LSA and for translating documents from the LSA into the language of the complainant . Apart from t he (financial) burden this provision would place solely on the complaint - receiving SA, the EDPB and EDPS note that English is, in practice, the working language of the SAs in cross - border cases in accordance with Article 23(1) of the EDPB Rules of procedur e 45 and as mentioned in the EDPB Guidelines 02/2022 on the application of Article 60 GDPR 46 . T his current practice enables the translated documents to be verified for correctness by the (usually) English speaking case handler . In addition, with regard to Article 6(2) of the Proposal , the ED PB and EDPS would recommend that this matter is dealt with by the EDPB 47 , and not in the future Regulation . T he EDPB and EDPS do not see any reason why th e current practice should be abandoned and therefore strongly recommend t hat the future Regulation refrain s from setting specific rules regarding the translation , in order to leave room for mutual agreement between the SAs. 5.3 Access to the file T he EPDB and EDPS note with positivity that Articles 19 to 21 of the P roposal clarify and harmonis e the content of and access to an administrative file . T hese Articles are closely related to Article 14(5) of the Proposal and Article 15(3) of the P roposa l , which establish the right of the parties under investigation and of th e complainant to access (part of) the administrative file . 5.3.1 Content of the administrative file Article 19(1) of the P roposal states that ‘ the administrative file in an investigation concerning an alleged infringement of the GDPR consists of all documents ob tained, produced and/or assembled by the LSA during the investigation ’ . The EDPB and EDPS understand Article 19 of the Proposal as only concern ing the administrative file of the LSA . Regarding the possibility ( ' may ' ) in Article 19(2) of the P roposal for the LSA to ' return ' documents that prove to be unrelated to the subject matter of the investigation to the party from which they have been obtained, the EDPB and EDPS are concerned that such provision could prove very problematic in practice , e speciall y with regard to the possible existing national obligations of deletion , documentation or archiving of documents and files . 44 See also EDPB Guidelines 0 2/2022 on the application of Article 60 GDPR , adopted on 14 March 2022. 45 EDPB Rules of Procedure, adopted on 25 May 2018, version 8.0, adopted on 6 April 2022. 46 EDPB Guidelines 02/2022 on the application of Article 60 GDPR , adopted on 14 March 2022, e.g. paragraph 217. 47 In accordance with Article 70(1) GDPR . Adopted 26 W hile the EDPB and EDPS welcome that , under Article 19 ( 3 ) of the P roposal , the correspondence and exchange of views between the L SA and CSAs are considered internal documents and shall not be accessible to the parties under investigation or the complainant , they recommend adding that correspondence and exchanges of view s between all involved SA s are covered by this provision , and that such information shall also no t be accessible to any third party. The EDPB and EDPS further recommend clarifying in the recitals that there should be a broad interpretation of what qualifies as such c ommunication s and exchange s of views . 5.3.2 Access to the administrative file and use of documents Article 20(1) of the Proposal states that the LSA shall grant access to the administrative file to the parties under investigation after their notification on the preliminary findings. The EDPB and EDPS take note th at the complainant is not mentioned here and that Article 20 of the Proposal does not set out any rules for the modalities of granting the right of access to the file (on request, etc.), including as to any remedies that are available to the parties should the right be denied . Reflecting on th e CJEU 's case law on access to the file 48 , the EDPB and EDPS welcome the harmoni s ed approach to the right of access to administrative files set out in the P roposal . They further welcome that the complainant may request access to the non - confidential version of the documents on which a proposed rejection of the complaint is based , 49 and that the complainant receives a non - confidential version of the preliminary findings 50 a nd as the documents included in the administrative file, if the LSA considers it necessary for the complainant to effectively make known their views 51 . This latter possibility , i n particular, is a positive token of transparency and involvement vis - à - vis the complainant and greatly extends the complainant’s right to access the file compared to the current national procedural laws of various Member States . Nevertheless, the EDPB and EDPS note that while t he Proposal seems to comprehensively regulate the party - under - investigation's right to access the administ rative file wh en the decision adversely affects them ( with an obligation for the LSA to grant such access to these parties ) , this approach has not been followed up systematically with regard to the complainant . T he EDPB and EDPS acknowledge that Article 20(4) , and Article 15(4) and Article 15 (5) of the P roposal complement each other. The EDPB and EDPS fully understand that certain information about a case should not be disclosed or made public during the investigation and decision - making phase so as to, among other things, avoid interference with the proceedings and the ir outcome. Nevertheless, the EDPB and EDPS are of the view that the scope and duration of the restrictions ' for the purpose of judicial or administrative proceedings ' under Article 20(4) of the P roposal ( which differs from the wording ' for the purpose of the concrete investigation ' used in Article 15(4) and Article 15 (5) of the 48 J udgment of the Court (Seventh Chamber) of 14 May 2020, Case C - 607/18 P, NKT Verwaltung and NKT v Commission, not published, ECLI: EU:C:2020:385, paragraphs 261 and 262, as well as J udgment of the C ourt (Seventh Chamber) of 28 November 2019, Case C ‑ 591/18 P , Brugg Kabel and KabelwerkeBrugg v Commission, not published, ECLI: EU:C:2019:1026, paragraph 26. 49 Article 11(4) of the Proposal . 50 Article 15(1) of the Proposal . 51 Article 15(3) of the Proposal . Adopted 27 Proposal ) are u nclear . The EDPB and EDPS therefore recommend clarifying th ese provision s . T he y are concerned that these provisions could appear to forbid the disclosure of any information , or the use of the documents , for other purposes than the case at hand in a way that is not intended – and s o risk the violation of other fundamental rights, e.g. the freedom of speech and freedom of expression 52 . Furthe r , the EDPB and EDPS highlight the significant administrative burden of signing this declaration ( e.g. arising from its verification and management ) . The y therefore suggest that the complaint - receiving SA should be the one which receives such a declaration by the complainant or , at least, that the LSA must inform the CSAs when it receives such a declaration. It is also unclear to the EDPB and EDPS whether such declaration extends to the non - confidential documents in the administrative file with which the complainant may be provided under Article 15 (3) of the Proposal. It seems that the intention is to cover non - confidential information and that it extends to the documents provided according to Article 15(3) of the Proposal. The EDPB and EDPS th erefore recommend clarifying that the declaration is a ' non - disclosure ' declaration rather than a ' confidentiality ' declaration per se . Article 15 of the Proposal does not indicate the legal classification and required content of the declaration or the consequences of the complainant's refusal to sign or comply with such a declaration . The EDPS and EDPB therefore recommend that Article 15(4) and Article 15 (5) and Article 20(4) of the P roposal be reconsidered. According to Article 20(3) of the Proposal , ‘ the conclusions of the LSA in the draft and final decisions pursuant to Article 60(3) GDPR and Article 60 (7) GDPR may only rely on documents cited in the preliminary findings or on which the pa rties under investigation had the opportunity to make their views known ’ . While the EDPB and EDPS welcome this clarification in light of the exercise of the right to be heard and access to the file, they also see a systematic issue when reading this provision together with Article 14(6) and Article 18 of the Proposal . This systematic issue is further explained in Sections 6.1 and 7.1.1 of this Joint Opinion . 5.3.3 Identification and protection of confidential information Although the EDPB and EDPS welcome certain harmoni s ation on the notion of confidentiality in cross - border cases, the y stress that the communication flow between the LSA and the CSA must be ensured. Therefore, the EDPB and EDPS invite the co - legislators to clarify that Artic le 21(1) of the P roposal does not prohibit the communication and sharing of confidential information between the LSA and CSAs . T he EDPB and EDPS welcome the Proposal’s aim o f harmonis ing the confidentiality of information collected or obtained by an SA whi le proceedings are ongoing. Keeping information about the ongoing discussions between SAs confidential is key in order to ensure free and unhampered discussions and cooperation between the SAs. However, the EDPB and EDPS recommend clarifying the interplay between Article 21(1) of the Proposal and Article 21(2) of the Proposal and the wording ‘ a s long as the proceedings are ongoing ’ in Article 21(2) of the Proposal . In this context, Article 21(3) of the P roposal requires the LSA to ensure that information containing business secrets or other confidential information is not used to the detriment of the provider of the 52 J udgment of the Court (Grand Chamber) of 16 December 2008, Case C - 73/07, Satakunnan Markkinapörssi and Satamedia, ECLI: EU:C:2008:727, paragraph 56 . Adopted 28 information . However, it is sometimes necessary t o use the confidential information provided by the party under investigation to their detriment, e.g. in order to calculate a fine. The refore, the EDPB and EDPS call to amend Article 21(3) of the P roposal in order to take this into account . In addition, t he EDPB an d EDPS would appreciate examples of t he ' appropriate arrangements to give full effect to the rights of defence of the parties under investigation with due regard for the confidentiality of the information ' referred to in this provision . T he EDPB and EDP S further welcome the requirement in Article 21 (4) of the P roposal that an entity submitting information as confidential must provide reasons for the confidentiality , and that they must also provide a non - confidential version. This will facilitate the work of the SAs in practi c e . Although it is not explicitly provided for in Article 21 of the P roposal, it appears from this provision that the final assessment whether information is indeed confidential lies in the discretion of the LSA . T he EDPB and EDPS consider that it is necessary to clarify in the future Regulation how this assessment would work in practice, including the possible involvement of the other SAs in the assessment 53 . Further, the EDPB and EDPS understand that , under Article 21(5) of the P roposal , the LSA can approach the controller/processor , on its own initiative , if the LSA thinks that the information provided could be confidential. If this is indeed the case , more clarification on the modalities would be appreciated. Finally, the EDPB and EDP S welcome the clarification in Article 21 (7) of the Proposal t hat , if the parties fail to identify what they consider to be confidential, the LSA may assume that the documents or statements concerned do not contain business secret s or other confidential information. 6 DISPUTE RESOLUTION A ND URGENCY PROCEDURE S 6.1 Dispute resolution (Art icles 2(4), 18, 22, 23, 25 and 26) 6.1.1 Regarding relevant and reasoned objections (Article 18) The EDPB and EDPS welcome the Proposal 's desire to ensure consensus among concerned supervisory authorit ies on key aspects of each case at an early stage , to ensure a mutual understanding of the scope of the investigation, and to p romote an inclusive involvement of all CSAs in the case . The EDPB and EDPS further note that these objectives are aligned with the principle of sincere and effective cooperation and the aim to reduce the risk of a dispute between authorities at a later stage. 53 In this regard, the EDPB and EDPS refer to the EDPB Guidelines 02/2022 on the application of Article 60 GDPR, adopted on 14 March 2022, paragraph 52: ʽ The LSA and other CSAs may flag specific pieces of information as (highly) confidential, particularly when this seems necessary in order to meet requirements of confidentiality constraints laid down in nation al laws. In such a case, the SAs should inform each other immediately and jointly find legal options for a solution against the background that confidentiality provisions usually relate to external third parties and not to CSAs. In this regard, any informa tion received that is subject to national secrecy rules should not be published or released to third parties without prior consultation with the originating authority, whenever possible ʼ . Adopted 29 To achieve these goals , the Proposal provides 54 that matters concerning the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings to the parties under investigation , and that the SAs involved should reach consensus on the s ummary of key issues 55 . Although the Proposal contains processes to reach this consensus , the possib ility for disagreements appear ing at a later stage cannot be ruled out . First , the summary of key issues might not provide all the necessary information and documents on cross - border cases due to the early stage of submission . Second , the preliminary findings define the facts and conclusions of the LSA, a nd so provide a much clearer overview of the future decision's upcoming content , including as to its scope , but t he Proposal does not require that CSAs are given an opportunity to comment on the preliminary findings before they are shared wit h the parties under investigation 56 . Third , even though Art icle 10(3) of the Proposal provides that the consensus on the summary of key issues serves ' as a basis ' for draft ing the preliminary findings , the allegations may evolve in the course of the investigation and the Proposal leav es limited possibilities f o r the CSAs to react , particularly to take into account the views of the parties under investigation on the preliminary findings 57 . Relevant and reasoned objections are a possibility for all CSAs to exercise their competence 58 and collectively contribute to the final decision, with the purpose of ensuring the full implementation of the GDPR including data sub ject rights 59 . Therefore, the EDPB and EDPS believe that i t should still be possible for CSAs to raise objections to the draft decision about the scope of the investigation i f an EDPB decision under Article 10(4) of the Proposal was not issued or not follow ed by the LSA . In addition , it should be possible for CSAs to raise objections ask ing for fur ther investigation by the LSA if the investigation carried out by the LSA unjustifiably fails to cover some of the issues raised by the complainant on which the LSA and the CSAs have reached consensus following exchanges on the summary of key issues 60 . In any case, Article 18(1) of the Proposal appears to unduly restrict the scope of RRO as defined in the GDPR and lacks clarity on what could be commen ted upon by the CSAs by way of an objection . First, Article 18(1)(a) of the Proposal is overly restrictive in so far as it does not refer to legal elements and established facts or documents of the file , but merely refers to ' factual elements included in the draft decision ' . However, there might be instances where factual elements deemed relevant by the 54 See R ecital 28 of the Proposal an d Article 18(1) of the Proposal. Pursuant to Recital 28 of the Proposal, ʽ Since the scope of the investigation and the relevant facts should be decided prior to the communication of preliminary findings, these matters should not be raised by supervisory authorities concerned in relevant a nd reasoned objections. They may, however, be raised by supervisory authorities concerned in their comments on the summary of key issues pursuant to Article 9(3), before preliminary findings are communicated to the parties under investigation ʼ . 55 See Artic le 9(3) of the Proposal . 56 Recital 23 of the Proposal and Article 14 of the Proposal. See also S ectio ns 4. 3 and 4.4 of this Joint Opinion, paragraphs 48 and 56, and Section 7.1.1., paragraph 133 and the recommendation in this regard . 57 See Article 10(3), Article 14(6) and Recital 23 of the Proposal. 58 See in this sense Judgment of the Court (Grand Chamber) of 15 June 2021, C - 645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit , ECLI:EU:C:2021:483 . 59 A nd not as a way to postpone the remedy for data subjects , as mentioned in Recital 28 of the Proposal. 60 See EDPB Guidelines 09/2020 on relevant and reasoned objection under Regulation 2016/679, version 2.0, adopted on 09 March 2021, paragraph 27. Adopted 30 CSAs , and which form part of the preliminary findings or administrative file , are not included in the draft decision . In such case , the CSAs should still b e able to address them. Moreover, it is unclear whether the provision aims to restrict the possibility for RROs to be based on legal elements. The EDPB and EDPS consider that RROs can also serve as a tool in situations where the LSA and the CSAs disagree o n the legal qualification of established facts, e.g. whether a specific conduct amounts to a breach of the GDPR or not. Second ly , t he limitation under Article 18 (1)(b) of the Proposal , which requir es that RROs do not change ' the scope of the allegations ' or the ' intrinsic nature of the allegations ', does not seem in line with the definition of ' relevant and reasoned objections ' under Article 4 (24) GDPR , which explicitly allows CSAs to have a say on ' whether there is an infringement ' of the GDPR . In general , Article 18(1) of the Proposal , and especially the phrases referred to t here, lacks clarity and may unduly limit the ability for CSAs to raise valid RROs in relation to draft decision s . As to the formal requirements laid down in Article 18(2) of the Proposal, the EDPB and EDPS note that this provision is drafted with a very high level of detail . They recommend that issues of length and format of the objections be dealt with by the EDPB 61 , and not in the future Regulation 62 . In light of the above, the ED PB and EDPS recommend the deletion of Article 18 of the Proposal. 6.1.2 Issues concerning the procedural steps under Article 65(1)(a) GDPR (Articles 22 and 23) The EDPB and EDPS welcome the aim of the Proposal to streamline the dispute resolution procedure and to harmonise, in a targeted manner, the procedural rights of the parties under investigation and of the complainant in the dispute resolution procedure. The EDPB and EDPS note that , ' when referring the subject matter to dispute resolution ' under Article 65 GDPR, the LSA would have to provide the EDPB with a number of documents listed under Article 22(2) of the Proposal, and the EDPB w ould then have four weeks to identify the retained RRO. In order for the EDPB to meet this requirement, the Proposal should explicitly allow the EDPB Secretariat to perform a first formal check of the file without delay , before the file is sent to the EDPB and the four - week deadline under Article 22(3) of the Proposal starts running 63 . This is essential as it wou ld allow the EDPB Secretariat to make sure that all the documents referred to in Article 22(2) of the Proposal are available and, for e xample , to verify whether there is a need to translate any of the documents . The four - week deadline should therefore only start running after all of the documents referred to in Article 22(2) of the Proposal are available a nd, if need be, translated. C onsidering that the decision for retaining relevant and reasoned objections referred to in Article 22 ( 3) of the Proposal is not mentioned in the GDPR , the EDPB and EDPS recommend explicitly specifying in the Proposa l that the EDPB should take decision by simple majority in accordance with Article 72(1) GDPR 64 . 61 In accordance with Article 70(1) GDPR 62 See para graph 70 of this Joint Opinion. 63 Under the current wording of Article 22(2) of the Proposal it is not clear whether the file is sent to the E DPB Secretariat first or directly to all the EDPB members. 64 Decision to be taken during a first extraordinary plenary meeting. Adopted 31 Pursuant to Article 23 of the Proposal, the Chair of the EDPB shall register the referral of the matter under Article 65(1)(a) GDPR no later than one week after receipt of the documents listed under Article 23 of the Proposal . However , if any additional information , documents or clarifications (other than those listed in Article 23 of the Proposal ) are necessary for the EDPB to take a binding decision concerning all of the matters which are the subject of the relevant and reasoned objection(s) , t he EDPB and EDPS recommend specifying that the Chair of the EDPB should be abl e to request them from the LSA when the retained RROs are identified by the EDPB 65 . In addition, the EDPB and EDPS recommend specifying a deadline (e.g. one week) for the LSA to provide the requested information , documents or clarifications , or to explain why it would not be in a position to do so . If other information , documents or clarifications are requested by the Chair of the EDPB , the referral would be registered no later than one week after receiving all these other information, documents , and clarif ication s from the LSA. In any event, in order to reduce the risk of the file being incomplete, the EDPB and EDPS recommend ensuring that the list of documents under Article 22(2) and Article 23 of the Proposal is supplemented to also include : the complain t; documentation proving the timing of the provision of the (revised) draft decision and of the objection(s) by the concerned supervisory authority/ authorit ies ; confirmation and evidence of which documents submitted to the EDPB were provided to the parties under investigation and to the complainant, as the case may be, when they were invited to exercise their right to be heard ; and the CSA’s comments on the summary of key issues . The EDPB and EDPS recommend aligning both lists b y redrafting Article 23 of the P roposal in order to specify that the documents required under Article 23 of the Proposal are the same as those listed under Article 22(2) of the Proposal , plus the retained r elevant and reasoned objections . In addition, t he EDPB and EDPS note that the wording ' when referring the subject matter to dispute resolution ' in Article 22(2) of the Proposal leaves it ambiguous as to when the deadline for adopti ng a binding decision under Article 65(2) GDPR and Article 65 (3) GDPR starts running 66 . At the same time, R ecital 33 of the Proposal makes it clear that the Chair of the EDPB should register the referral of the subject - matter in the sense of Article 65(2) GDPR only after the EDPB has received all the necessary documents liste d in Article 23 of the Proposal . Therefore, the EDPB and EDPS recommend e xplicating these elements in Article 23 of the Proposal and clarifying that the deadline provided under Article 65(2) GDPR and Article 65 (3) GDPR only appl ies as from this registratio n. The EDPB and EDPS would like to underline the fact that , considering the high level of complexity of Article 65 binding decision procedure, it can never be excluded that further information or document might still be deem ed necessary within the timefram e for adopting the decision. The current version of the EDPB Rules of Procedure 67 therefore allows the EDPB , in exceptional circumstances, to decide to consider further documents it deems are necessary without having an impact on the deadline . The EDPB and EDPS 65 The retained relevant and reasoned objections being the last document completing the list under Article 23 of the Proposal. 66 i.e. from the moment where the EDPB receives the documents referred to under Article 22(2) of the Proposal for the purpose of identifying retained relevant and reasoned objections under Article 22(3) of the Proposal or later . 67 EDPB Rules of Procedure, a dopted on 25 May 2018, version 8.0, adopted on 6 April 2022 . Adopted 32 welcome the fact that the Proposal does not prevent the EDPB from keeping the current practice unchanged and highlight the EDPB’s intention to retain this possibility in its Rules of Procedure 68 . 6.1.3 Regarding binding decisions adopted under Article 65(1)(b) GDPR and Article 65(1) (c) GDPR (Articles 25 and 26) The EDPB and EDPS welcome the Proposal’s initiative to further clarify the applicable procedure under Article 65(1)(b) GDPR and Article 65(1) (c) GDPR. However, Article s 25 and 26 of the Proposal only refer to the lists of required documents and the registration of the referral of the subject - matter . Pursuant to Article 25(2) of the Proposal, the Chair of the EDPB shall register the referral of the matter under Article 65(1)(b) GDPR no later than one week upon receipt of the documents listed under Article 25(1) of the Proposal, i.e. if the file is complete. As previously recommended in paragraph 102 of this Joint Opinion with regard to the Article 65(1)(a) GDPR procedure, t he EDPB and EDPS recommend specifying that, if further information and/or clarifications are needed for the Board to make a decision , the Chair of the EDPB should be able t o request them from the referring SA within one week. Once all the missing documents are provided by the referring SA, the Chair of the EDPB should have one week to register the referral. The referring SA should also be given a deadline to reply to the EDPB Chair’s request for missing documents. In any event, the EDPB and EDPS recommend completing the current list of documents so that it also include s the description of processing activities, the description of the company 's organisation and the descrip tion of where decisions are taken , as these documents a re required to determine whether the controller/processor has a main or single establishment in the EEA. The EDPB and EDPS would also find it useful if all competent SAs in the dispute have the ability to share all of the relevant information that they have , instead of being limited to the sharing of their ' views ' via the referring SA as currently set out under Art icle 25(1)(d) of the Proposal . In other words, all competent SA s should be treated equally as regards the opportunity to bring all relevant information . The EDPB and EDP S further recommend that the list under Article 26(1) of the Proposal should be completed to include a copy of the decision adopted by the SA . I f the issue being referred is th at a supervisory authority has allegedly failed to follow an opinion of the Board under Article 64 GDPR , there should also be an explanation of which points were not followed and a reference to the relevant part of the adopted decision . The EDPB and EDPS note that Article 26(2) last indent of the Proposal refers to the possibility for SA to declare a need to submit views at a stage where the matter has not yet been shared with them. Therefore , the EDPB and EDPS recommend clarifying the EDPB Chair ’s obligation to inform all SAs about the subject - matter referred by the referring SA or the E uropean Commission , prior to registering the referral under Article 26(3) of the Proposal , so as to allow SAs to make their views known. Finally, the EDPB and EDPS note that Article 65(6) GDPR refers to the adoption by the LSA or complaint receiving SA of a national decision within one month of the notification of the binding decision: while this obligation is clear with respect to binding decisions adopted pursuant to Article 65(1)(a) GDPR , 68 EDPB Rules of Procedure, adopted on 25 May 2018, version 8.0, adopted on 6 April 2022 . Adopted 33 the EDPB and EDPS are of the opinion that it would be beneficial to have further clarifications about the application of Article 65(6) GDPR to disputes under Article 65(1)(b) GDPR . 6.2 Urgency procedure ( A rt icles 27 and 28) Chapter VI of the Proposal lays down procedural rules for the urgency procedure set out under Article 66(2 ) GDPR with respect to urgent opinions (Article 27 of the Proposal ) and urgent decisions (Article 28 of the Proposal ) . With regard to the s cope of the final measures and to the addressees of the urgent opinion or decision , t he Proposal unduly restricts the application of the urgency procedure under Article 66(2) GDPR to the territory of the SA requesting an urgent opinion or decision 69 , even t hough this procedure applies, per se, to cross - border processing. Under the Proposal, the urgent opinion or decision of the EDPB would only be addressed to the requesting SA 70 . The urgency procedure aims to address exceptional circumstances (e.g., where an SA fails to act in line with its mutual assistance or joint operation obligations under the GDPR 71 ). While it is normal that the urgent provisional measures adopted by the requesting SA under Article 66(1) GDPR only appl y to the territory of that SA and for a limited period of time, the intervention of the EDPB aims to ensure a consistent application of the GDPR . By nature, i ts orders should therefore have a broader geographical scope and duration to ensure the protection of the rights and freedoms of all the data subjects affected – which can , depending on the matter, cover several Member States. In this situation, the final measure s should be adopted by the LSA and therefore the LSA should also be the addressee of the EDP B urgent opinion or decision. The EDPB and EDPS would like to underline that Article 65 GDPR binding decisions are addressed to all SAs (Article 65(2) GDPR) and there is no reason to have a different regime for EDPB urgency procedures. Ensuring that EDPB urgent opinions and decisions may have a wider territorial scope, where appropriate and given the specifics of a case, is necessary and in line with the objective of the GDPR. The EDPB and EDPS highlight that the urgency procedure should only be triggered in ' exceptional circumstances ' as it constitutes a derogation from the general GDPR consistency mechanism 72 . L imiting the territorial scope of final measures to the territory of the requesting SA would lead to permanent derogations from the cooperation and consistency mechanisms . Indeed, while the aim of Article 66(1) GDPR is to temporarily derogate from the cooperation and consistency mechanisms by allowing CSAs to adopt provisional measures intended to produce legal effects on their own territory in cross - border cases, Article 66(2) GDPR does not provide a legal basis for the adoption of permanent derogations from the cooperation and c onsistency mechanisms by CSAs. In addition, the EDPB and EDPS consider that such restriction raises serious concerns as it w ould lead to a multiplication of requests from CSAs and a fragmentation of final measures. In practice, where several or all CSAs consider that there is an urgent need to act, the Proposal would require each one of them to adopt provisional measures on its own territory under Article 66(1) GDPR , to each request an EDPB urgent opinion or decision under Article 66(2) GDPR and Article s 27 or 28 of the Proposal , 69 Article 27(1)(c) and Article 28(1 ) (d) of the Proposal. 70 Article 27(2) and Article 28(3) of the Proposal. 71 Article 61(8) GDPR and Article 62(7) GDPR. This applies as well to the situation where the matter is so urgent that it is not possible to apply the regular process, such as the one - stop - shop procedure (Article 66(2) GDPR). 72 Article 66 (1) GDPR. Adopted 34 and to each adopt final measures on its own territory in order to protect the rights and freedoms of data subjects in the EEA . Under the Proposal, then, if a requesting SA has its legal assessment confirmed by the EDPB through an urgency procedure on a matter w h ich concern s several territories , the EDPB could subsequently receive a large number of requests from the other SAs w ho wish to obtain the same result for the individuals in their territory. The EDPB would then receive mu l tiple requests and would have to a dopt multiple urgent opinions or decisions on the same matter within two weeks (Article 66(4) GDPR) , which is highly undesirable. Such situation could also result in a patchwork of final measures and a fragmentation in countries where the SA has not acted . In contrast, ensuring that the EDPB urgent opinions and decisions are addressed to all the concerned SA(s) (including the LSA) would efficiently protect data subjects’ rights and freedoms. The EDPB and EDPS urge the co - legislators to clarify in the futur e Regulation that the territorial scope of the final measures adopted following an EDPB urgent opinion or decision can be broader than the territory of the Member State of the requesting SA and may apply across the EEA (Articles 27(1)(c), 27(2), 28(1)(d) a nd 28(2) of the Proposal). More specifically, the future Regulation should allow the EDPB to determine, based on the circumstances of the case, if the final decision should be adopted by the requesting SA or by the LSA. Urgent decisions should be made binding on the addressees. The future Regulation should also make it possible for the EDPB to instruct the competent SA (as the case may be, the LSA and/or CSAs) to impose different/additional final measures than those possibly requested by the requesting CSA. With regard to the p rocedural rules applying to the urgency procedure , the EDPB and EDPS welcome the intention of the Commission to bring clarity on the Article 66(2) GDPR procedure . However, the EPDB and EDPS also believe that the future Regulation should go further and set out clearer procedural rules. In particular, the future Regulation could clarify the distinction between urgent opinions and urgent binding decisions . In that regard, the EDPB and EDPS note that the lists of documents that must be provided to the EDPB to request an urgent opinion (Article 27(1) (b) and Article 27(1) (c ) of the Proposal) and an urgent decision (Article 28(1) (b) and 28(1) (d ) of the Proposal ) are different . This raises the question o f whether there is a nuance in meaning between the two measures which justifies such differences. I f no such difference exists , the wording should be aligned to avoid raising unnecessary questions of interpretation. With respect to urgent opinions , Article 27(2) of the Proposal provides that they ' shall be similar to an opinion with in the meaning of Article 64(1) [ GDPR ]' . First, it is unclear which exceptional circumstances could justify the need for an SA to request an urgent opinion for matters usu ally addressed by the regular Article 64(1) GDPR procedure, such as the approval of the adoption of a data protection impact assessment list or the approval of binding corporate rules 73 . Second ly , it is unclear how the ' similarity ' mentioned under Article 2 7(2) of the Proposal should be understood . Third, considering that Article 27(2) of the Proposal explicitly refers to Article 64(1) GDPR but not to Article 64(2) GDPR, it seems that the Proposal would not be applicable to opinions requested under Article 6 4(2) GDPR, i.e. when an SA request s an opinion on any matter of general application or producing 73 Article 64(1)(a) GDPR and Article 64(1)(f) GDPR. The same reasoning applies to Article 64(1)(b) to (e) GDPR . Adopted 35 effects in more than one Member State . The Proposal should clarify whether Article 64(2) GDPR opinions can be subject to an urgent opinion under Article 66(2) GDPR . In addition, the EDPB and EDPS recommend clarifying (e .g. in R ecital 36 of the Proposal ) which provisional measures could be adopted in exceptional circumstances whe n the Article 66(1) GDPR procedure appl ies . I n the context of the procedure for urgent opinions, it is uncertain whether competent SAs can exercise all of the powers listed under Article 58 GDPR or whether the provisional measures are limited to authorisations or advisory powers . Further, t he Propos al currently states that , following the EDPB urgent opinion or decision, the requesting SA will ' maintain or amend its provisional measure ' (Articles 27(2) and 28(2) of the Proposal ). However, the ultimate objective of the Article 66(2) GDPR procedure is t o adopt final measures which are not limited to three months and may concern different Member States. This can be the case, for instance, if the LSA need s to adopt final measures pursuant to an urgency procedure triggered by a CSA. In addition, b y allowing the requesting SA to maintain or amend its provisional measures, Articles 27(2) and 28(2) of the Proposal give the impression that the measures adopted after the EDPB intervention w ould also have to be provisional. A ddition ally , the EDPB may instruct the competent SA to amend its measures (this can include cases where the EDPB considers that no final measures should be adopted ) . Therefore, Articles 27(2) and 28(2) of the Proposal should be clarified , for instance as follows: The urgent opinion or decision of the EDPB ' shall be addressed to all the supervisory authorities concerned and specify the supervisory authority or authorities that would need to adopt final measures , if applicable, in light of the urgent opinion or decision of the EDPB pu rsuant to Article 66(2) GDPR ' . Article 28(1)(c ) and Article 28(4) of the Proposal a lso assume that there is a local establishment on the territory of the requesting SA. This reference to a local establishment of a controller or processor should be removed as this is not a precondition under Articles 66(1) and 66(2) GDPR for SAs to take provi sional measures producing effects in the te rritory of their Member State. T he EDPB and EDPS are of the view that the notification of the decision on the final measures to the controller or processor should not always be performed by the requesting SA , as provided in Article 28(4) of the Proposal , but instead by the LSA or another competent SA having adopted the final measures , depending on the circumstances of the case . This obligation to notify the controller or processor should also be clearly added for urgent opinions (under Article 27(2) of the Proposal ). In relation to the t imeframe for the urgency procedure , t he 3 - week timeframe envisaged in the Proposal for requesting the urgent opinion or decision before the expiration of the provisional measures ( Articles 27(1) and 28(1) of the Proposal ) does not leave any time for the EDPB Secretariat to assess – on behalf of the Chair – the completeness of the file , including the need for potential translations 74 , and for the addressee to adopt its final measures . Therefore , the EDPB and EDPS consider that the request for an urgent opinion or decision under Article 66(2) GDPR should be made no later than four weeks prior to the expiry of provisional measures adopted under Articles 61(8), 62(7) or 66(1) GDPR (instea d of ‘ no later than 3 weeks ’ ) . Without such a change , there is a risk that the addressee of the urgent opinion or decision may , in 74 Similarly, see paragraph 101 of this Joint Opinion. Adopted 36 practice , have only one week to adopt its final decision . Indeed, Article 27(2) of the Proposal refers to Article 64(7) GDPR, which requires the requesting SA to ' take utmost account of the opinion ... and shall, within two weeks after receiving [it], communicate ... whether it will maintain or amend its draft decision …' [ emphasis added ] . However, since the EDPB has two weeks t o draft and adopt its urgent opinion , the SA r e questing the urgent opinion or decision would in practice only receive the decis io n of the EDPB one week before the expiry of provision al measures. The EDPB and EDPS consider that this period is too short to allow the addressee to draft and adopt a legally sound decision implementing the final measures. It is therefore suggested provid ing in Article 27(1) of the Proposal and similarly in Article 28(1) of the Proposal , as a minimum , that the urgency procedure s hould be triggered at least four weeks prior to the expiry of the provisional measures . To ensure the completeness of the matter referred to the EDPB , and that the EDPB is able to adopt an urgent opinion or decision, it would appear essential to allow the EDPB Secretariat to perform a formal check , on behalf of the Chair of the EDPB , prior to the launch of the procedure . In particular, this should be done before the two - week deadline starts running ( taking into account the possible need of translations ) in the same fashion as during the dispute resolution procedure (see paragraph 10 1 of this Joint Opinion ). Given that it i s not the EDPB's role to verify if there were ' exceptional circumstances ' justifying the adoption of provisional measures under Article 66(1) GDPR , the justification of the ' exceptional nature of circumstances requiring the adoption of the final measure ' should be removed from Article s 27(1)(c) and 28(1)(d) of the Proposal. More generally , the lists of documents should explicitly set out t he following information, for both lists under Article 27(1) and Article 28(1 ) of the Proposal : (1 ) the existence of a GDPR infringement (including with evidence and facts), (2) the risk of serious and irreparable harm without the adoption of final measure s , and (3) the existence of a causal link between the infringement and the risks. To streamline the urgency procedure, t he Proposal should also specify that the requesting SA should indicate which final measure(s) it would consider appropriate in the case at hand , along with the analysis and reasoning that the requesting SA provides to the EDPB . Specifically for the list of documents to be provided to the EDPB for urgent opinions , Article 27(1) of the Proposal should include the requirement for the requesti ng SA to provide a copy of the decision setting out the provisional measures . Specifically for the list of documents to be provided to the EDPB for urgent decisions, Article 28(1) of the Proposal should require the requesting SA to provide, where applicabl e, the views that have been made in writing by the complainants (similar ly to the requirements under Article 22(2)(e) of the Proposal) to ensure compliance with the right to good administration. In addition, the future Regulation should restrict the scope of the information to be provided by the requesting SA under Article 28(1)(c) of the Proposal , limit ing it to information strictly necessary in the context of the urgency procedure . This is required due to the very short timeframe for the EDPB to assess th e case and adopt its decision. Adopted 37 7 PROCEDURAL RIGHTS OF THE PARTIES UNDER I NVESTIGATION 7.1 During the cooperation procedure (Art icles 2(1), 2(3), 14, 16 and 17) 7.1.1 Preliminary findings T he EDPB and EDPS consider that the interplay between Article 9 of the Proposal ( ' Summary of key issues ' ) , Article 11 of the Proposal ( 'P reliminary view ' ) and Articles 14 and 15 of the Proposal ( ʽ Preliminary findings ʼ ) are unclear and invite the co - legislators for more clarification, in particular on the timeline applicable to these A rticles (see also paragraph 50 of this Joint Opinion) . The EDPB and EDPS understand that the ‘ preliminary findings ’ are relevant for ensuring the exercise of the right to be heard by the parties under investigation , as we ll as information to the complainant . The EDPB and EDPS very much support the harmonisation of the rights of the parties under investigation in Article 14 of the P roposal and of the complainant in Article 15 of the P roposal in this context. The EDPB and E DP S further acknowledge that , while the preliminary findings are mentioned in Article 8( 2 ) ( g ) of the Proposal as relevant information to be shared w ith the CSAs according to Article 60(1) GDPR and Article 60 (3) GDPR, they seem to be drafted for the sole purpose of enabling the part ies under investigation to exercise their right t o be heard. T he EDPB and EDPS reiterate their concern 75 that neither Article 14 of the Proposal nor Article 15 of the P roposal explicitly provide for the complaint - receiving SA or any other CSA to comment on the preliminary findings of the LSA before they are sent to the parties under investigation and the complainant . This is all the more relevant as the EDPB and EDPS understand Article 14(6) of the Proposal to mean that the draft decision according to Article 60(3) GDPR can only include allegations that have been submitted to the parties under investigation as also mentioned in S ection 5.3.2 of this Joint Opinion with regard to access to the file and use of documents . However, as there is no procedure in place to gather the views of the CSAs on the preliminary findings before they are provided to the part ies under investigation, the conclusion and content of the preliminary findings are at the sole discretion of the LSA . This may lead to a situation where CSAs are confronted with elements in a draft decision wi t h which they do not agree , but which can only be address ed by way of a relevant and reasoned objection . The EDPB and EDPS therefore recommend introduc i n g the opportunity for CSAs to comment on the preliminary findings before they are submitted to the parties under investigation and the complainant , as already mentioned in Section 4.2 o f this Joint O pinion . As the goal of the Proposal seems to be consensus - build ing at an early stage (Articles 9 and 10 of the P roposal ) and reduc ing the likelihood of dispute resolution later in the procedure, this approach would strengthen cooperation and give a n opportunity to clear up possible disagreements before the procedure e nters the draft decision stage. This would also facilitate the necessary alignment with Article 8(2)(g) of the P roposal . 75 S ee also Section 4.2 of this Joint Opinion . Adopted 38 Regarding the elements contained in Article 14(2) of the Proposal the E DPB and EDPS point out that a complete and accurate picture of t he relevant circumstances, including all the elements of Article 83(2) GDPR, in particular aggravating and mitigating circumstances, and the assessment whether, and if so, which, appropriate corrective measures can be imposed, may, in some cases, only be d etermined after the investigated parties are heard on the preliminary findings, and not in advance. In practice, the SA may sometimes take note of these facts and circumstances as a result of hearing the parties under investigation . It is apparent from the text of Article 14(2) of the Proposal that, where a fine is to be imposed, Article 14(2) of the Proposal does not include a requirement for the preliminary findings to include the specific amount of the fine, but only the relevant e lements relied upon for the calculation. I t is also the understanding of the EDPB and EDPS that the preliminary findings generally represent the final opportunity to gather the views of the parties under investigation and, if the case is complaint - based, o f the complainant, prior to the issuance of the draft decision and that normally no further preliminary findings need to be prepared and sent after the parties under investigation or the complainant send their views. Furthermore, the EDPB and EDPS understa nd from R ecital 23 of the Proposal that the conclusions drawn in the preliminary findings remain of preliminary nature, so that the draft decision, including the actual corrective measures taken, may differ from those in the preliminary findings, having re gard to the views expressed by the parties under investigation (e.g. as regards the existence aggravating or mitigating circumstances). In order to give the SAs adequate margin of consideration in this respect, taking into account the individual case, t he EDPB and EDPS suggest reformulat ing the last two separate indents of Article 14 (2) of the Proposal as follows: 'The preliminary findings shall indicate the corrective measures that are considered by the lead supervisory authority. Where the imposition of an administrative fine is considered, the lead supervisory authority shall list in the preliminary findings the main elements of facts and law, which are known to it, and on which it intends to rely in deciding whether to impose an administrative fine and in deciding on the amount of the administrative fine, having regard to the elements listed in Article 83(2) of Regulation (EU) 2016/679 .' The parties under investigation have the option to provide a written reply to the preliminary findings under Article 14(4) of the P roposal. The EDPB and EDPS welcome the clear description of the nature of such reply . 7.1.2 Adoption of the final decision With regard to Article 16 of the P roposal , the EDPB and EDPS note that this provision seems to be a repetition of Article 60 (7) GDPR and suggest that either it is deleted or the missing reference to Article 60(9) GDPR should be included. The EDPB and EDPS take further note of the fact that this provision, while determining the final decision, differs from Article 13 of the P rop osal insofar as it stays silent on the information about the judicial remedy. If Article 16 of the P roposal is kept, the EDPB and EDPS therefore recommend harmoni s ing these two provisions. Adopted 39 7.1.3 Right to be heard in relation to the revised draft decision Article 17 of the P roposal stipulates that the LSA shall hear the parties under investigation if the LSA considers that new elements should be brought to their attention before submitting a revised draft decision. Logically, this requires that a draft deci sion has been submitted, that at least one relevant and reasoned objection according to Article 4(24) GDPR and in conjunction with Article 60(4) GDPR has been raised against it , and the LSA decides to follow the concerns of the CSA(s). The EDPB and EDPS no te that neither the CSAs nor the complainant are involved. Acknowledging the different position of the complainant here, the EDPB and EDPS nevertheless think that the complainant should have also the opportunity to make their views known as required in Ar ticle 15(1) of the P roposal with regards to the ‘ preliminary findings ’ , in particular in the event the revised draft decision or parts of it are likely to adversely affect them. Furthe r , the EDPB and EDPS again stress the importance of involv ing the CSAs w hich should be informed of the views received from the parties under investigation before the revised draft decision is circulated by the LSA according to Article 60(5) GDPR. Otherwise, the revised draft decision may incorporate elements with which the CSA s are un familiar . Article 17 of the Proposal refers to a revised draft decision but does not introduce a time limit for the LSA to adopt a final decision after consensus was reached on the revised draft decision or to refer the subject matter to the EDPB for dispute resolution in accordance with Article 65(1)(a) GDPR . The EDPB and EDPS recommend introducing such time limits in the future Regulation, with the possibility for the LSA to provide for specific reasons to extend that period 76 . 7.2 In dispute resoluti on procedures ( Art icle 24) Under Article 24(1) of the Proposal, prior to the adoption of a binding decision under Article 65(1)(a ) GDPR, the Chair of the EDPB shall provide the parties under investigation and/or ( if the investigation is complaint - based a nd in case of a full or partial rejection of the complaint ) the complainant with a ' statement of reasons ', explaining the reasoning of the Board and allowing them to exercise their right to be heard. The EDPB and EDPS welcome the Proposal 's objective to harmonise the extent of the right to be heard of the parties under investigation in the dispute resolution procedure . However, the EDPB and EDPS consider that the EDPB’s current approach , whereby the right to be heard is administered via the LSA and ad ditional actions are taken by the EDPB only if necessary 77 , is fully consistent with the decentralised nature of the GDPR’s ‘one - stop - shop’ mechanism , as well as with the CJEU’s case law on composite procedures 78 . Consequently, the EDPB and EDPS believe that a radical change to the 76 See the EDPB wish list, proposa l 5 . 77 See the EDPB Guidelines 03/2021 on the application of Article 65(1)(a) GDPR , version 2.0, after public consultation, adopted on 24 May 2023. 78 The case law of the CJEU in composite procedures involving the Commission allows the right to be heard to be observed ‘either directly in its dealings with the Commission or indirectly through the [national] authorities, or through the combination of those two administrative channels’ (See Judgment of the Court of First Instance Adopted 40 current approach of the EDPB is not necessary from a legal standpoint ; the parties under investigation can currently provide their views on all the legal and factual elements that the EDPB relies upon for settling the dispute, in l ine with the CJEU case law , via t he LSA, which ensures that the parties are heard on the documents being forwarded to the EDPB prior to referring the dispute to the EDPB . Additionally , the approach suggested in the Proposal runs counter to the General Cou rt order of December 2022 , which declared the controller’s action under Article 263 TFEU against the EDPB Binding Decision 01/2021 inadmissible due to lack of direct concern 79 . The EDPB and EDPS consider that h aving the parties ' submissions at national level from the beginning of the process, as well as the parties ' submissions on the RROs prior to the dispute being launched, allows t he EDPB t o meaningfully and fully take t he parties' views into account . This is, first, because the submissions are availa ble since the very beginning of the dispute resolution decision - making process ; and, secondly, because , under the current process , the parties under investigation always provide their views also on the objections raised 80 . The Proposal, on the other hand, p rovides that the parties under investigation would receive the statement of reasons , but gives discretion to the EDPB to decide whether it should be accompanied by the retained relevant and reasoned objections 81 . In addition, the EDPB and EDPS consider that the deadlines provided for in Article 24(2) of the Proposal and Article 24 (3) of the Proposal (one and two weeks respectively) are too short to allow the parties under investigation to effectively share their views. Moreover, where the views submitted by the parties are lengthy and complex, there is a risk that the EDPB might not be able to meaningfully take those views into account due to the time constraints. In light of the above, the EDPB and EDPS strongly recommend that the future Regulation retains the current approach to the r ight to be heard , where the parties provide their views to the LSA before the dispute is handled by the EDPB . The refore, the EDPB and EDPS recommend the deletion of Article 24 of the Proposal . In stead , the future Regula tion could specify clear rules for the r ight to be h e ard of the parties under investigation , for example if could be specified that the LSA should hear the parties under investigation on all the documents to be included in the dispute resolution file, incl uding on the (Second Chamber, extended compo sition) of 19 June 1997 , Case T - 260/94 - Air Inter v Commission ECLI:EU:T:1997:89, paragraph 65). The EU administration can also offer hearings indirectly and then use the views of the company in making its binding decision. See also Judgment of the Court o f First Instance (First Chamber) of 9 November 1995 , Case T - 346/94 , France - aviation v Commission of the European Communities ECLI:EU:T:1995:187 Judgment of the Court of First Instance (Fifth Chamber) of 18 January 2000 , Case T - 290/97 , Mehibas Dordtselaan BV v Commission of the European Communities ECLI:EU:T:2000:8 ., Judgment of the Court of First Instance (Third Chamber) of 10 May 2001 , Case T - 186/97 , Kaufring AG and Others v Commission of the European Communities ECLI:EU:T:2001:133. 79 Order of the Gener al Court of 7 December 2022 in C ase T ‑ 709/21, WhatsApp Ireland v European Data Protection Board ECLI:EU: T:2022:783 , pending appeal before the Court of Justice of the European Union . 80 See EDPB Guidelines 03/2021 on the application of Article 65(1)(a) GDPR, version 2.0, after public consultation, adopted on 24 May 2023 , para graph 104. 81 Article 24(1) of the Proposal specifies that ‘ it would be up to the Board to decide whether the statement of reasons should be accompanied by the retained relevant and reaso ned objections’. Adopted 41 objections . Such an approach would be in line with the principle of proximity and would ensure that there are no linguistic and/or translation - related issues impeding the smooth hearing of the parties. In addition , the EDPB and EDPS highlight that the Proposal does not provide a definition of the newly introduced concept of ' statement of reasons ' 82 , n or does it lay down specific requirements as to the content and level of detail of this statement . In spite of the lack of legal definition, it is the EDPB and EDPS ' understanding that the preparation of this document requires, in practice, a full agreement on the substance of the binding decision . This may prove extremely challenging – if not impossibl e – to achieve in practice , particularly as the unique design of the GDPR dispute resolution mechanism means that , in many cases , a full agreement can only be reached shortly before the expiry of the deadlines under Article 65(2) and (3) GDPR. It is the E DPB and EDPS’s understanding that the statement of reasons would have to be approved by the EDPB during an extraordinary plenary meeting and by simple majority in accordance with Article 72(1) GDPR . This would imply the need for the EDPB to organise three separate decision - making events : one to decide on the retained relevant and reasoned objections, a second to decide on the statement of reasons, and a third to decide on the adoption of the binding decision , all within a time frame of one month extendable to two month s maximum . The EDPB and EDPS note the suspension of the Article 65(2) GDPR deadline under Article 24(4) of the Proposal. However , the Proposal does not take into account the possible need for a translation of the statement of reasons 83 and of the views of the parties under investigation and/or of the complainant as referred to under Article 24(2) and (3) of the Proposal. The impact of translation on the timeline of the dispute resolution procedure are not further specified and the practical co nsequences are not taken into account 84 . The EDPB and EDPS recall that no such issues arise under the current system, which is designed on the basis of the principle of proximity and where the complaint - receiving CSA hears the complainant , where applicable ( which would not be the case following the Proposal) , and the LSA hears the parties under investigation before the file is referred for dispute resolution. In light of the above, t he EDPB and EDPS are concerned that the requirement to provide the parties under investigation with a statement of reasons , as referred to in Article 24 of the Proposal , before the expiry of the legal deadline for adoption of a binding decision under Article 65(1) GDPR would jeopardi s e the ability of the EDPB to reach a decision within the timeframe provided for in Article 65 GDPR – even with the suspension of 2 weeks as provided for under Article 24(2) and (3) of the Proposal or additional suspension for the translations . If the EDPB misses the deadline imposed by the GDPR, this would create legal uncertainty and risks , making the draft decision of the LSA final and so depriving the CSAs of the chance to participate in the decision making process, in spite of the fact that the final decision would be applicable to the e ntire EU/EE A . 82 Also, the ‘statement of reasons’ is not mentioned in the GDPR. 83 Into the language of the parties under investigation and/or the complainant . 84 For example, t he EDPB may need to involve lawyer - linguists and/or professional translators available to provide urgent translations. For urgent requests, having documents translated by lawyer - linguists or professional translators could take , after having received an offer including a proposed duration and a price, between one working day (for 2 standard pages) and six working days (for 15 standard pages), which is already longer than the one week deadline. Urgent requests are also likely to have a budgetary impact. It is also currently usual that submissions provided in the context of the right t o be heard are much longer. Adopted 42 Consequently, the requirement o f hav ing the statement of reasons referred to in Article 24 of the Proposal appears burdensome and inadequate to promote the effectiveness and efficiency of the whole dispute resolution procedure, and so appears to be contrary to the objective stated in the Explanatory Memorandum. From this standpoint , the EDPB and EDPS reiterate their recommend ation of deleting Article 24 of the Proposal . 8 PROCEDURAL RIGHTS OF THE COMPLAINANT 8.1 Procedural rights of the complainant in case of rejection of the complaint 8.1.1 During cooperation ( Art icles 11, 12 and 13 ) Article 11 of the P roposal covers the complainant's right to be heard before a draft decision is issued which fully or partially reject s the complaint . Articles 12 and 13 of the Proposal respectively address the complainant's right to be hear d in relation to a revised draft decision within the meaning of Article 60(5) GDPR and in relation to the final decision according to Article 60(8) - (9) GDPR. As an initial remark , t he E DPB and EDPS note that, while the term 'parties under investigation' is given a legal definition in Article 2 of the Proposal, there is no such provision for the term ‘ complainant ’ , although R ecital 25 of the Proposal contains further clarifications on the legal position of the complainant . The EDPB and EDPS understand that any p erson that lodges a complaint according to Article 3 o f this Proposal should be regarded as a complainant for the purpose of the Proposal 85 . Article 8(2)(d) of the P roposal states that the LSA shall provide the CSAs with the reasons for rejecting the complaint . However , in contrast to the preliminary findings, the preliminary view as such is not included in the set of relevant information laid out in Article 8(2) of the P rop osal which is shared in the course of the proceedings according to Article 60(1) and (3) GDPR. Likewise, Article 8 of the P roposal does not specify that the relevant information, including the reasons for rejecting the complaint , should be provided to the CSAs before the preliminary views are sent to the complainant 86 . T he Proposal does not provide for the complaint - receiving SA , or any other CSA , to comment on the LSA's preliminary view to reject the complaint in partial or full before it is sent to the co mplainant. In light of the CJEU's jurisprudence on ' sincere and effective cooperation between the LSA and the other 85 Bearing in mind that the full range of Article 80 GDPR situations is not covered by the Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection o f the collective interests of consumers and repealing Directive 2009/22/EC (OJ L 409, 4.12.2020, p. 1), the EDPB and EDPS further recommend, as raised under proposal 1.1. of the EDPB wish list, specifying that ʽ the representative mentioned in Article 80(1) GDPR, when acting on behalf of the data subject, is entitled to the same status and procedural rights as the complainant who is represented. Additionally, when this provision is implemented by Member State law, entities lodging complaints under Article 80 (2) GDPR should also be treated in the same way as individual complainants ʼ . 86 See paragraphs 46 - 49 of this Joint Opinion for further comments on r elevant information to be provided by the LSA to the CSA under Article 8(2) of the Proposal. Adopted 43 SAs ' 87 and R ecitals 125 and 130 GDPR , the EDPB and EDPS therefore urge the co - legislators to include a provision which requires that, before being sent to the complainant, the LSA’s preliminary view referred to in Article 11 of the P roposal is shared with all the CSA and that their views are gathered . Additionally , t he P roposal does not clarify the subsequent cooperative steps to be taken if the complainant fails to provide their views, in particular on how the information about the (non)submission of views of the complaint is shared with the other CSAs , or whether the LSA has to follow the procedure laid down in Article 60(3) – ( 9) GDPR and submit a draft decision including the preliminary view. Article 11(3) of the P roposal provides that the complaint is deemed to have been withdrawn ( and so treated as though it had never been lodged ) if the complainant fails to make known their views within a defined time - limit , without a draft decision according to Article 60(3) GDPR being prepared in this regard. While the intention of the P roposal seems to be t he simple termination of non - promising complaint - based cases, or at least of parts of t hem , th e current approach might lead to a problematic withdrawal of the case , with CSAs not being involved even though the y might not have agreed with the rejection of the complaint if given the possibility to . T he procedure foreseen in Article 11(3) o f the P roposal also deprive s CSAs of their right to object on cross - border decisions provided for in Article 60 GDPR – and , further, deprive s the complainant of the right to an individual decision in the specific case , as ensured in Article 60(8) GDPR , and to an effective judicial remedy if the complaint is di s missed or rejected, as referred to in R ecital 17 of the P roposal . Moreover , the c urrent wording of Article 1 1 (3) of the Proposal indicate s that the complaint is considered ' withdrawn ' , even if the complainant only fails to make their view known on some points of the intended rejection of the complaint. It further leaves room for the interpretation that the complaint is considered to be ' withdrawn ' as a whole, regardless of whether it is fully or par tially rejected . The EDPB and EDPS therefore call upon the co - legislators to clarify that, even i f the complainant fails to comment on the preliminary view pursuant to Article 11(2) and (3) of the P roposal , the LSA will submit a draft decision pursuant to Article 60(3) GDPR and the c omplaint will not be considered withdrawn , as explained in the following of th is Section of this Joint Opinion . Accordingly, it is suggested t hat the wording of Article 11(3) of the P roposal is changed so that the case should b e simply ‘closed’ or 'terminated' and a decision adopted in accordance with Article 60(3) and (8) GDPR . In addition , where the complaint is partially rejected , the EDPB and EDPS calls for the clarification that the case is only ' closed ' or ' terminated ' for those parts of the complaint that are actually rejected and to which the complainant has not expressed their views , and a decision adopted in accordance with 87 Judgment of the Court (Grand Chamber) of 15 June 2021, C - 645/19 Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit, ECLI:EU:C:2021:483 paragraph 5 3: ʽ The application of the ‘one - stop shop’ mechanism consequently requires, as confirmed in recital 13 of Regulation 2016/679, sincere and effective cooperation between the lead supervisory authority and the other supervisory authorities concerned. Accordi ngly, as the Advocate General stated in point 111 of his Opinion, the lead supervisory authority may not ignore the views of the other supervisory authorities, and any relevant and reasoned objection made by one of the other supervisory authorities has the effect of blocking, at least temporarily, the adoption of the draft decision of the lead supervisory authority. ’ Adopted 44 Article 60(3) and Article 60 (8) GDPR. For the other parts of the complaint on which the LSA an d CSA agreed to act, a separate decision should be adopted in accordance with Article 60(9) GDPR. Further, Article 11(5) of the P roposal indicates that, when the complaint is not considered to be withdrawn according to paragraph 3 of this Article, the draf t decision should be prepared by the complaint - receiving SA before it is submitted by the LSA to the other SAs. The EDPB and EDPS emphasi s e that Article 60(3) GDPR states that , in cross - border cases , the draft decision is to be submitted by the LSA to the other C SAs taking ' due account of their views ' . This wording i s in both the GDPR and the EDPB Guidelines 02/2022 88 on the application of Article 60 GDPR . I n EDPB ’s and EDPS ' view , it leave s absolutely no doubt that not only must the LSA circulate the draft decision in the context of every cross - border case that is dealt with in accordance with Article 56(1) GDPR in conjunction with Article 60 GDPR among the CSAs, it must also take the views of the CSAs into account when prepar ing that draft decision : By contrast, Article 11(5) of the Proposal, seems to reverse the allocation of tasks between LSA and the complaint - receiving SA provided for in Article 60(3) GDPR and is , therefore , not in line with the GDPR. The purpose of the change in roles of the LSA and the complaint - receiving SA is not entirely clear to the EDPB and EDPS , a nd there is the risk of difficulties in coordination if a n SA which did not carry out the investigation has to prepare the draft decision. In addition, Articl e 56(2) - (4) GDPR , provides for a specific case in which the complaint - receiving SA may submit a draft for a decision to the LSA . As a result, Article 11( 5 ) of the Proposal would make the voluntary procedure under Article 56(4) GDPR mandatory in every case of a rejection of the complaint. Finally, in the event that a complaint is partially upheld and partially rejected, this approach would mean that different SAs ( i .e. the LSA and the complaint - receiving SA(s)) would have to prepare various draft decisions . There are serious doubt s as to whether this was the intention of the GDPR. Likewise, in this scenario it is unclear if each of the complaint - receiving SA would have to su bmit a draft decision to the LSA if there is more than one complaint - receiving SA. The EDPB and EDPS th er efore strongly encourage that Article 11(5) of the Proposal be change d to adhere to the allocations of tasks as indicated in Article 60(3) GDPR and in the EDPB Guidelines 02/ 2022 on the application of Article 60 GDPR . Revised draft decision fully or partially rejecting a complaint Article 12(1) of the P roposal provide s that the complaint - receiving SA shall hear the complainant if the LSA considers that new elements should be brought to the attention of the complainant before submitting a revised draft decision which fully or partially reject s a complaint. Logically, th is requires that a draft decision was submitted, that at least one relevant and reasoned objection according to Article 4(24) GDPR and in conjunction with Article 60(4) GDPR w as raised against it , and t hat the LSA decide d to follow the concerns of the CSA( s). It is noted that Article 12( 1 ) of the Proposal only refers to the LSA and envisages no coo peration between the LSA and either the complaint - receiving or any other CSA s . T he EDPB and EDPS ask if the complaint - receiving SA should also be given the oppor tunity to initiate this procedure, since it would 88 See EDPB Guidelines 02/2022 on the application of Article 60 GDPR, adopted on 14 March 2022, paragraph 237. Adopted 45 ultimately be required – under Article 60(8) GDPR – to adopt the rejecting final decision and defend it in court. Given the allocation of tasks currently foreseen in Article 11(5) of the P roposal , it also remains unclear whether, under Article 12 of the Proposal, the revised draft decision is supposed to be prepared by the complaint - receiving SA in the same way as the first draft decision under Article 11(5) of the Proposal . The EDPB and EDPS are concerned that the p ath taken in Article 11(5) of the P roposal could lead to coordination difficulties and other significant ambiguities among the SAs. Taking into account Article 60(5) GDPR and the EDPB Guidelines 02/2022 on the application of Article 60 GDPR , the EDPB and EDPS reiterate their concerns about the compliance of such an approach with the provisions of the GDPR and strongly encourage the future Regulation to adhere to the allocations of tasks as indicated in Article 60(5) GDPR and in these Guidelines . With regard to Article 12(2) of the Proposal, it is not clear whether Article 11(3) of the Proposal should also apply if the complainant no longer comments (in whole or in part) on the revised draft decision, as an equivalent provision is missi ng here. Should a similar approach be envisaged for Article 12 of the Proposal, the EDPB and EDPS recommend that it is also amended with the appropriate steps , as previously proposed. If Article 11(3) of the Proposal is to be applied here as well , the EDPB and EDPS reiterate the concerns previously raised regarding this provision . Decision fully or partially rejecting a complaint The EDPB and EDPS welcome Article 13 of the Proposal, harmoni s ing this part of the decision according to Article 60(8) GDPR, as mentioned in the EDPB w ish l ist, proposal 7. The EDPB and EDPS note , however , that the Proposal leaves it to the discretion of the complaint - receiving SA to include the information of the j udicial remedy i n either in the final decision itself or in a cover letter. I t must be also stated that Article 13 of the P roposal does not clarify the roles and steps of the LSA and CSA in case a complainant appeals the decision which full y or partial ly reject s a complaint . This holds true , in particular , in the event the appeal is granted ; in such a situation, the complaint - receiving SA is not solely competent and no procedure is foreseen in the GDPR for the Member State of the LSA to recogni se a court decision from the Member State of the complaint - receiving SA 89 . 8.1.2 In dispute resolution procedures (Art icle 24 ) U nder Article 24 of the Proposal, the L SA would be in direct contact with the complainant to communicate its statement of reasons if it fully or partially rejects the complaint. The EDPB and EDPS consider that this is inconsistent with the rules set out under Article 60(8) GDPR and Article 60(9) GDPR and the principle of proximity, as well as with Article 11 of the Proposal. This obligati on should rather lie with the concerned supervisory authority with which the complaint was lodged and it is to them that the complainant should provide their views where applicable . In addition, the EDPB and EDPS take the view that the deadlines under Arti cle 24(2) and Article 24 (3) of the Proposal , of one and two weeks respectively, are too short to allow complainant s to effectively share their views. 89 EDPB w ish l ist , proposal 7. Adopted 46 Therefore, as further developed in Section 7.2 of th is Joint Opinion with regard to the parties under inve stigation , the EDPB and EDPS consider that the current approach with regard to the right to be heard should be retained, i.e. that the right to be heard should be granted before the file reaches the EDPB while additional actions are taken by the EDPB only if necessary . 8.2 Procedural rights of the complainant in case of decisions addressed to controllers and/or processors (Art icle 15) The EDPB and EDPS welcome that , according to Article 15 of the P roposal , the preliminary findings in cases where the LSA finds an infringement are also brought to the attention of the complainant , who can then make their views known, regardless of how the complaint is dealt with by the LSA. However, un like Articles 11(2), and 14(4) and ( 6) of the Proposal, Article 15 of the Proposal does not set up a procedure to gather the complainant’s views on the preliminary findings . Also it does not provide the concrete modalities for granting access to documents of the administrative fi le under Article 15( 3 ) of the P roposal . Despite the complainant's legal position in Article 15 of the Proposal not entirely corresponding with the ir position under Article 11 of the Proposal or with the one of the parties under investigation under Article 14 of the Proposal , the EDPB and EDPS suggest t hat the Proposal should specify the access to the file in this scenario as well . While Article 15(1) of the P roposal stipulates that the complaint - receiving SA shall provide the complainant with a non - confidential version of the preliminary findings , it is not entirely clear which SA is in charge of preparing th is non - confidential version. Th e EDPB an d EDPS therefore re commend t hat the Proposal should either include a reference to Article 21 of the P roposal or specify in Article 15(1) of the Proposal that the LSA should prepare this version in consultation with the complaint - receiving CSA , which should then sha re it with the complaina nt. Article 15(2) of the P roposal , read in conjunction with R ecital 25 of the P roposal , ensures that the complaint s are dealt with by the LSA in their entirety, regardless of how the LSA does so ( e.g. jointly or split in parts) . T he EDPB and EDPS welcome this provision. Nevertheless, the EDPB and EDPS ask that the wording ' or in any other way exercises its discretion concerning the scope of the investigation as set out in preliminary findings ' be clarified in the operative provisions of the future Regulation , in accordance with R ecital 25, second sentence, of the Proposal 90 . The EDPB and EDPS further note that , according to Article 15(3) of the P roposal , it is in the sole discretion of the LSA to decide if and which documents are provided to t he complainant with regards to the preliminary findings . This is in contrast to Article 14(5) of the P roposal , according to which, the LSA shall provide the parties under investigation with access to the administrative file ' in accordance with Article 20 ' o f the P roposal without assessing the necessity . F inally, t he EDPB a nd EDPS repeat their concerns regarding the restrictions on disclosure and use of the preliminary findings and information according to Article 15 ( 4 ) and ( 5 ) of the P roposal , th e impact o f such restrictions on other fundamental rights of the complainan t , a nd the ambiguities concerning the ’ con fi dentiality ’ declaration, a s stated in Section 5.3.2 of this Joint O pinion. The EDPB and EDPS 90 Recital 25 states ‘ […]The fact that a supervisory has already initiated an investigation concerning the subject matter of t he complaint or will deal with the complaint in an ex officio investigation subsequent to t he receipt the complaint does not bar the qualification of a data subject as complainant.’ Adopted 47 therefore rei terate their recommendation to reconsider the aforementioned Article 15(4) and (5) of the P roposal . 9 COOPERATION BETWEEN THE EDPS AND NATIONA L SA S The EDPB and EDPS wish to stress that the need for effective and efficient cooperation is not limited to cros s - border cases involving multiple national SAs . As underlined by the EDPS , in his contribution submitted on 25 April 2023 in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the GDPR 91 , the same ne ed exists where personal data flow s from Union institutions, bodies, offices and agencies (EUIs) to other public bodies or private entities within the European Economic Area (EEA) and vice - versa 92 . In the context of such processing, cooperation between data protection authorities (EDPS and national SAs) has often prove n successful. At the same time, data protection authorities (‘DPAs’) have encountered several obstacles to efficient cooperation and enforcement. Such obstacles have resulted , in particular , fr om a lack of clarity on the terms of cooperation between the EDPS and national SAs. Moreover, the current legal framework governing cooperation between the national SAs and the EDPS is fragmented 93 , and national SAs and the EDPS are currently not able to us e the same IT tools to securely exchange information. The situation could potentially worsen as the Proposal focuses solely on cross - border processing within the meaning of Article 4(23) GDPR, which may exacerbat e existing obstacles. The EDPB and EDPS consider that the Proposal provides a timely opportunity to address the existing practical obstacles to efficient cooperation between the national SAs and the EDPS, and vice - versa. To this end, the EDPB and EDPS recommend t hat the co - legislators include a specific provision in the future Regulation with the following three elements: 91 EDPS contribution in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR), available at: https://edps.europa.eu/data - protection /our - work/publications/other - documents/2023 - 04 - 25 - edps - contribution - context - commission - initiative - further - specify - procedural - rules - relating - enforcement - general - data - protection en . 92 For example, a need for effective and efficient cooperation between the ED PS and national DPAs arises, inter alia, where: a) an EUI enlists the processing services of a private entity, who is subject to the GDPR, but acting on behalf of the EUI (i.e. acting as a processor for the EUI); b) an EUI provides and manages an informat ion system that supports cooperation of public authorities in EU Member States; c) Member States and EUIs share, together with private entities, responsibilities in areas of particular importance, such as pharmacovigilance; or d) an EUI carries out its t asks together with Member States’ public authorities (e.g. in matters concerning the Area of Freedom, Security and Justice (AFSJ)). 93 Chapter VII EUDPR provides a general legal basis for cooperation between the EDPS and national DPAs, in addition to the in volvement of the EDPS as full member of the EDPB under the GDPR. This general legal framework is supplemented by specific Regulations that apply to the processing of personal data by Europol, Eurojust, the EPPO, Frontex and eu - LISA. Adopted 48  all data protection authorities 94 shall cooperate actively, to the extent necessary for the performance of their respective duties, to ensure effective supervision and consistent enforcement of all Union data protection rules 95 ;  all data protection authorities shall carry out such cooperation in accordance with Articles 61, 62, 64(2), and 66(3) GDPR, Article 50 LED , Articles 61 and 62 EUDPR, and any other relevant provisions of Union law; and  the EDPS shall, for the purpose of such cooperation with national SAs and in accordance with the provisions listed in the preceding indent, be considered as a ' supervisory autho rity ' within the meaning of Chapter VII GDPR and Chapter VII LED. In addition, the EDPB and EDPS suggest amending the Annex to the Internal Market Information System (IMI) Regulation 96 by adding a reference to the EUDPR. Such an amendment would make it poss ible to extend the existing IMI GDPR - related module to further support cooperation between national DPAs and the EDPS. The EDPB and EDPS note that there is currently no common equivalent to IMI for exchang ing information between national DPAs and the EDPS in the framework of AFSJ cooperation. An appropriate secure common electronic information and communication system should be provided for, and implemented by , the EDPB for the benefit of all data protection authorities. The EDPB and EDPS therefore recommen d that the co - legislators include a further provision in the future Regulation specifying that all supervisory authorities shall share information via a secure electronic medium, through secure electronic means using a common information and communication system, and that the EDPB shall be responsible for its implementation. The EDP B and EDPS would like to highlight that the EDPS' contribution offers a comprehensive explanation behind these proposals and provides detailed suggestions for their drafting 97 . 94 I.e. the supervisory authorities established under the GDPR, the supervisory authorities established under the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/ JHA, OJ L 119, 4.5.2016, p. 89 ( ʽ LED ʼ ) , the EDPS as well as the joint supervisory authority established under Article 25 of Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes, OJ L 323, 10.12.2009, p . 20 . 95 In particular, the GDPR, the LED, the EUDPR, rules regulating large - scale IT systems, and any other Union and Member State act relating to the protection of the individual’s rights and freedoms with regard to privacy and the processing of personal data. 96 Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC , OJ L 316, 14.11.2012, p. 1. 97 S ee sections 2 and 3 of, as well as Annex I to the EDPS contribution in the context of the Commission initiative to further specify procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR), available at: https://edps.europa.eu/data - protection/our - work/publications/other - documents/2023 - 04 - 25 - edps - contribution - context - commission - initiative - further - specify - procedural - rules - relating - enforcement - general - data - protection_en . Adopted 49 Therefore, the EDPB and EDPS call on the co - legislators to consider the importance of this matter and to include the proposed measures in the future Regulation. 10 FINAL PROVISIONS (AR TICLES 29 AND 31) The EDPB and EDPS note that the P roposal does not contai n a review clause under which the application of the future R egulation would be evaluated after a certain period of time . Given the purpose of the P roposal , and the fact that it contains complex procedural rules which w ould significantly impact the functio ning of the one - stop - shop procedure, the EDPB and EDPS recommend including a review clause according to which the Commissi on shall publish a report on the evaluation and review of the future Regulation at the same time as it publishes its report on the evaluation and review of the GDPR under Article 97 GDPR . The EDPB and EDPS also note that Article 29 of the Proposal lays down rules on the beginning and calculation of time periods provided for in the GDPR and in the Proposal. The EDPB and EDPS consider that this provision is unnecessary as problems with the calculation of deadlines have not been encountered in practice . In addition, the EDPB and EDPS note that the mentioned Regulation (EEC, Euratom) 1182/71 98 applies in any event, save as otherwise provid ed . Therefore, the EDPB and EDPS recommend removing Article 29 of the Proposal. With respect to Article 31 of the Proposal, t he EDPB and EDPS note that the P roposal would enter into force on the twentieth day following its publication without providing for a separate date for its application . The EDPB and EDPS draw attention to the fact that the future Regulation would require changes and adaptations to be made into national work processes , as well as in to many documents and templates. Further, it is likely that the national legislation would need to be adjusted to be consistent with the future Regulation . T herefore , the EPDB and EPDS recommend t hat the co - legislators take the se elements into consideration and provide that the future Regulation will on ly apply after a n appropriate period , after its entry into force. For the European Data Protection Supervisor The European Data Protection Supervisor (Wojciech Wiewiorowski ) For the European Data Protection Board The Chair (Anu Talus) 98 Regulation (EEC, Euratom) No 1182/71 of the Council of 3 June 1971 determining the rules applicable to periods, dates and time limits (OJ L 124, 8.6.1971, p. 1), Article 1. Adopted 50 11 ANNEX I - WORDING SU GGESTIONS A rticle 1 The EDPB and EDPS underline that the concept of ‘cross - border enforcement’, referred to in Article 1 of the Proposal, is not defined in the GDPR. The EDPB and EDPS therefore recommend replacing the reference to ‘cross - border enforcement’ by a reference to ‘cross - border processing’ as defined in Article 4(23) GDPR. Article 2 While the EDPB and EDPS w elco me the definitions of ‘parties under investigation’ and ‘ preliminary f indings’ in Article 2(1) of the Proposal and Article 2(3) of the Proposal, it remains unclear why it was decided to introduce the term ‘parties under investigation’ but to still name, fo r example, S ect ion 3 of Chapter III the Proposal ‘ Decisions addressed to the controllers and processo rs’ . The EDPB and EDPS therefore suggest adhering to the wording of the GDPR or clarify this difference for example in the recitals to the Proposal. Furthe r, t he term ʽpreliminary view’ (mentioned in Article 11(1) of the Proposal ) is not defined in the Proposal, contrary to the terms ʽsummary of key issues’ and ʽpreliminary findings’ in Article 2(2) and Article 2 (3) of the Proposal. Article 3 Article 3(2) of the Proposal gives the impression that the SA with which the complaint was lodged must determine, with definitive certainty, whether the complaint relates to cross - border processing. However, according to the current agreements between SAs, the SA with which the complaint was lodged must reach only a preliminary conclusion on the cross - border nature of the processing. Given the division of roles and powers laid down in Article 56 GDPR, it is undesirable to require the SA with which the complaint was lod ged to reach a definitive opinion on the cross - border nature of the processing complained of. The EDPB and EDPS therefore propose to consider a rewordi ng of Article 3(2) of the Proposal in the following direction: ‘ The supervisory authority with which the complaint has been lodged shall determine, by way of preliminary conclusion, whether the complaint relates to cross - border processing, which supervisory authority is the assumed lead supervisory authority under Article 56(1) GDPR , and whether the case is l ocal in nature pursuant to Article 56( 2) of Regulation (EU) 2016/679.’ Article 3(4) of the Proposal provides that the complaint - receiving SA shall forward the complaint to the LSA after it has been assessed whether th e mandatory information in the F orm is complete. The EDPB and EDPS note that this wording may be read so that the achievement of amicable settlement according to Article 5 of the Proposal should not be attempted by the SA with which the complaint was lodged. This would deprive complainants of t he currently existing possibility to achieve a quick(er) remedy under existing arrangements regarding ‘preliminary vetting’, and would also not correspond to the objective of that article. Adopted 51 The EDPB and EDPS would therefore propose to consider a rewording o f Article 3( 4) of the Proposal in the following direction, also in view of their recommendation to clarify that the CSA with which the complaint was lodged assesses the admissibility of the complaint: ‘A fter assessing that the complaint is admissible , the supervisory authority with which the complaint was lodged shall forward the complaint to the lead supervisory authority , unless it concludes an amicable settlement as set out in Article 5 of the Proposal . ’ The EDPB and EDPS recommend specifying in Article 3(5) of the Proposal that the non - confidential version of the complaint would be prepared for disclosure to the parties under investigation whereas the CSAs would receive the full version of the complaint. The EDPB and E DPS recommend adding ‘in accordance with national law’ to Article 3(5) of the Proposal. Article 8 It is the EDPB’s and EDPS’ view that Article 8(2) of the Proposal should be reworded as follows: ‘The LSA shall communicate the relevant information within the meaning of Article 60(1) GDPR and Article 60 (3) GDPR, where applicable: [...]’. Regarding Article 8(2)(i) of the Proposal, the EDPB and EDPS recommend to rather refer to the non - confidential version of the preliminary findings, as according to Article 15 of the Proposal the complainant is not provided with the preliminary findings as such. Article 9 Furthermore, in order to be more consistent with Article 9(3), Article 9(1) of the Proposal should refer to the LSA ‘drafting’ the summary of key issues and ‘providing it to the concerned super visory authorities’. In addition, the EDPB and EDPS recommend making the link between Article 2(2)(b) and Article 2(2) (c) of the Proposal more explicit by clarifying that the summary of key issues shall include ‘a preliminary orientation of the assessment of relevant legal and factual issues within the preliminary scope of investigation’ (this new wording should be inserted under Article 2(2)(c) of the Proposal ). Article 10 Article 10(6) of the Proposal clarifies that the Board shall adopt an urgent bindin g decision on the scope of the investigation on the basis of the comments of the CSAs and the position of the LSA on those comments. The EDPB and EDPS are of the view that such decision shall not be adopted ‘on the basis of the comments of the SA and the p osition of the LSA on those comments’ but rather ‘on the basis of all the documents received’ because a limitation does not seem useful here. In relation to this point, the EDPB and EDPS recommend reformulating the last sentence of Recital 16 , which reads ‘In particular, the Board should not extend the scope of the investigation on its own initiative.’ The EDPB and EDPS consider that in cases where a CSA aims to extend the scope of the investigation and therefore the LSA triggers the urgency procedure, the EDPB shall make a final decision on the scope of the investigation. Therefore, the wording of Recital 16 of the Proposal should Adopted 52 clarify that the EDPB shall be entitled to make such decisions on the scope of the investigation on the request of a CSA. Artic le 11 It has to be noted that the terminology of Articles 11, 12 and 13 of the Proposal referring to the ʽ rejection of the complaint’ differs from the wording used in Article 60(8) GDPR (ʽa complaint is dismissed or rejected’). As the rejection of the complaint could be understood (in certain legal translations) as the termin ation of the proceedings only due to legal formal reasons, the Proposal should adhere to the terminology of the GDPR and include the term ʽdismissal of the complaint’ to not unintentionally exclude such cases (e.g. contrary to the opinion of the complainan t, the data processing in question was carried out lawfully) a priori . With regard to the time limit set in Article 11(2) of the Proposal, the EDPB and EDPS recommend clarifying the starting point of the time limit in the provision itself for reasons of le gal certainty, such as the receipt by the complainant of the reasons for the LSA’s preliminary views. Furthermore the EDPB and EDPS recommend replacing the second sentence of Article 11(2) of the Proposal ‘ The time - limit sha ll be no less than three weeks. ’ with ‘ The time - limit shall be four weeks’ . Article 12 The EDPB and EDPS recommend replacing Article 12(2) of the P roposal with ‘ The supervisory authority with which the co mplaint was lodged shall set a time - limit of four weeks within which the complainan t m ay mak e known her or his views’ . Article 14 The EDPB and EDPS note that adding ‘ following the consultations and procedures under Arti cles 9 and 10 of this Regulation’ at the beginning of Article 14(1) of the Proposal might improve the structure of the Proposal. According to Article 14(4) of the Proposal, the preliminary findings shall be forwarded to the parties under investigation for comments, for which a time - limit shall be set. The EDPB and EDPS no te that uniform time limits might be desirable to ensure consistency throughout the Proposal. The EDPB and EDPS welcome the clarification in Article 14(5) of the Proposal that, when notifying the preliminary findings to the parties under investigation, th e LSA shall provide these parties with access to the administrative file. They note however, that a similar provision is provided for under Article 20(1) with a slightly different wording (‘ after the lead supervisory authority notifies’ instead of ‘when no tifying’ ) which might create confusion. The EDPB and EDPS therefore suggest cross - referencing instead of duplicating with different wording the same provision. Article 18 The terms ‘changing the intrinsic nature of the allegations raised’ in Article 18(1)(b) of the Proposal are unclear and should be clarified. Adopted 53 Article 19 With some national procedural laws establishing a separate investigation phase and the administrative file not just being necessary during the investigation but also in the whole proc edure and following proceedings, the EDPB and EDPS suggest not limit ing the scope of this provision to the phase of the inve stigation and replace the term ‘during the investigation’ with ‘ during the p rocedure before the LSA’ in Article 19(1) of the Proposa l. Article 21 The EDPB and EDPS wonder why Article 21(4) of the Proposal only refers to ‘any entity’ which is a new term not defined in the GDPR and seems to inadvertently exclude natural persons. It is therefore suggested to extend the scope of applicatio n and adhere to the wording used in the GDPR. Article 22 The title of Article 22 of the Proposal seems to be referring to Article 65 GDPR as a whole, while the provision only concerns binding decisions under Article 65(1)(a) GDPR. The title should be modif ied accordingly to only refer to Article 65(1)(a) GDPR. Article 22 (2) (f) of the Pr oposal should read as follows: ‘ the relevant and reasoned objections which were not followed or rejected by the lead supervisory authority and the objections that the lead supervisory authority has rejected as being neither relevant nor reasoned’ to reflect the two scenarios provided for under Article 65(1)(a) GDPR. Under Article 22(2)(g) of the Proposal, the terms ’relevant and reasoned’ should be deleted to read as follows: ‘the reasons on the basis of which the LSA did not follow the objections or [...]’. Finally, to preserve the effe ctiveness of the GDPR consistency mechanism, Article 22 of the Proposal should make it clear that the prohibition provided for in Article 65(4) GDPR for SAs to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) GDPR and Article 65 (3) GDPR also applies during the four weeks provided to the Board to identify the retained RRO s under Article 22(3) of the Proposal and during the one week provided to the Chair to register the referral of the matter under Article 23 of the Proposal. Article 23 Recital 33 of the Proposal makes it clear that the Chair of the EDPB should register the referral of the subject - matter in the sense of Article 65(2) GDPR only after the EDPB is in receipt of all the necessary documen ts listed in Article 23 of the Proposal . The EDPB and EDPS recommend explicitly mentioning this in Article 23 of the Proposal. In Article 23(f) of the Proposal , the LSA needs to provide the reasons on the basis of which the lead supervisory authority did n ot follow the retained relevant and reasoned objections or why it did not consider the objections to be relevant and reasoned. In point (f) of Article 23 of the Proposal, the Commission is assuming that the LSA did not follow the retained RROs, but it is p ossible that it considered them no t to be relevant and reasoned. Adopted 54 Article 25 We recommend including in Article 25(1)(e) of the Proposal a reference to the EDPB too and not only to the referring SA. The referring SA should not have a specific role compared t o the others, as they should all be treated equally. Article 26 Under Article 26(1)(c ) and Article 26(2)(a ) of the Proposal , the wording ‘communicate the draft decision’ should be aligned with the GDPR, i.e. to request the opinion of the Board. Article 28 Article 28(1)(d) of the Proposal refers to requests under Article 61(3) GDPR. Article 61(3) GDPR contains only procedural requirements for the requests of mutual assistance, not the substantive ground for the request itself. It appears that it was intende d to refer to the material ground for requesting mutual assistance. The EDPB and EDPS suggest replacing the reference to Article 61(3) GDPR to a reference to Article 61(5) GDPR. In addition, the last part of Article 28(1)(d) of the Proposal should be align ed with the language of the GDPR for the s ake of consistency and provide ‘[...] or proof that a supervisory authority failed to provide the information requested under Article 61(5) or failed to respond to a request under Article 62(2) of Regulatio n (EU) 2 016/679’ . Article 28(1)(f) of the Proposal should read ‘ where applicable, the views of the local establishment of the parties under investigation regarding which provisional measures were taken pursuant to Article 66(1) [GDPR]’ , to remove the term ‘against ’ . Article 28(2) of the Proposal refers to the urgent decision referred to in paragraph 1, whereas paragraph 1 refers only to the request for such a decision and not to the decision itself. It is suggested to refer to the urgent decision under Article 66(2 ) GDPR. The Dutch translation of Article 28(2) refers to ‘the urgent opinion’ whereas here the urgent decision is referred to and mentioned in the English translation. Annex: Complaints submitted on the basis of Article 3 The EDPB and EDPS recommend to remove in Part A, Section 1 , ‘ Where the complainant is a natural person, submit a form of identifica tion’ and substitute it with ‘ Where the complainant is a natural person, submit full name and surna me’ . The EDPB and EDPS recommend to remove in Part A, Section 2 , ‘Telephone number’ and insert this in Part B of the Annex. In addition, as in some Member States, a complainant may submit a complaint by post but still request electronic notification, the reques ted contact details (email address or postal address) should not be linked to the form of submission of the complaint. It is therefo re suggested to replace by ‘ Where the complaint is submitted electronically, email address. Where the complaint is su bmitted by post, postal address’ by ‘ Alternatively, the email address or postal address’ . The EDPB and EDPS recommend to su pplement the phrase ‘Submit all documentation’ in Part B , with the words ‘and evidence’ . The EDPB a nd EDPS recommend to remove ‘and signatur e’ from Part C , in both title and text.