Overview on resources made available by Member States to the Data Protection Authorities and on enforcement actions by the Data Protection Authorities

1 Overview on resources made available by Member States to the Data Protection Authorities and on enforcement actions by the Data Protection Authorities 05 August 2021 2 Table of co n tent Background ................................ ................................ ......... 3 Introduction ................................ ................................ ........ 3 I. Resources made avai lable by Member States to Authorities ................................ 4 1. Financial Resources ................................ ................................ 4 2. Human resources ................................ ................................ 5 II. Enforcement ................................ ................................ .... 8 1. Total number of enforcement cases (national and cross - border cases) ................................ 8 2. Complaints ................................ ................................

10 3. Ex officio Investigations ................................ ................................ 12 4. D ata breach Notifications ................................ ................................ 13 5. Exercise of SA's corrective powers on national and cross - border cases (from 25/05/2018 to 31/05/2021) 14 3. Judicial appeal of the cases with a fine (from 25 May 2018 to 31 May 2021) ................................ 20 4. Timeframe to decide ................................ ................................ 21 5. The pro cedural rights of a complainant and a controller ................................ ..... 23 3 Background The European Data Protection Board (EDPB) received a request from the Committee on Civil Liberties, Justice and Home Affairs (LIBE Committee) of the European Parliament to share some statistics on resources made available by Member States to the supervisor y authorities (SA) from the European Economic Area (EEA) and on enforcement actions by the SAs.

The EDPB already gathered in the past similar information in the context of a Report in 2019 about the GDPR implementation made at the request of the LIBE Committee 1 and the contribution of the GDPR evaluation made in 2020 at the request of the European Commission 2 . Introduction The protection of personal data is a fundamental right in the EU, as laid down in the Charter of Fundamental Rights of the EU. If that fundamental right is to have real meaning and effect in the lives of EU citizens, robust supervision is needed. That robu st supervision can only exist where the supervisory authorities are appropriately equipped with staff and resources, in order to supervise compliance with the GDPR and to enforce if needed. In order to keep up with the high pace of technological developmen ts and digitisation , supervision should moreover not only be robust for today, but also for tomorrow and for the years to come.

In order to ensure that supervision has impact where it matters most, supervisory authorities need to be able to call to account even the largest players on the market. That requires that supervisory authorities have the means and expertise to do so. Because of the cooperation and consistency mechanism laid down in the GDPR, supervisory authorities have become interdependent. By a pplying the one - stop - shop mechanism, supervisory authorities are able to organise robust supervision across the EU. The effective application of the one - stop - shop mechanism requires inter alia however that all supervisory authorities as well as the EDPB ar e equipped appropriately – a lack of resources in a supervisory authority competent to handle cross - border cases, can after all have tangible consequences for citizens across the EU. Finally, it should be noted that - in addition to complaint handling an d carrying out investigations - the GDPR provides for a myriad of other tasks and instruments to promote and supervise compliance, which contribute in equal shares to the protection of the fundamental right of data protection in the EU.

These instruments a nd tasks of SA’s include – amongst others - the assessment of data protection impact assessments, the assessment of codes of conduct, issuing instruments for certification and accreditation, the assessment of BCRs and of course contributing to the work of the EDPB to ensure the consistent application and interpretation of the GDPR across the EU. For all these tasks and instruments, appropriate equipment of supervisory authorities is of equal significant importance. pdf 4 I. Resources made available by Member States to Authorities 1. Financial Resources The graphics below provide information about the budget made available to the EEA SAs in 2020 and 2021 3 . The budgets of SAs have to be interpreted in light of possible differences in the scope of competences, activities, and financial responsibilities at national level 4 . 000 million (situation as of mid - July 2021).

DE: Budget for all of the 18 supervisory authorities in Germany. LT: T here are 2 GDPR supervisory authorities in Lit huania, one of which is authoris ed to supervise the application of GDPR only insofar as it concerns the processing of personal data for journalistic purposes and academic, artistic or literary expression (The Offi ce of the Inspectorate of Journalist Ethics). pdf , p. 28 - 29. 4 For example, the Slovenian SA is competent to oversee the rules on data protection as well as access to public information. The represented budge t covers both areas of competence where roughly one third of the budget is not related to data protection activities. 000 AT BG CY EE FI GR HR IS LI LT LV MT RO SI SK 2021 2020 5 Vast majority of SAs expli citly state s that they do not have enough resources while there are some SAs who do not see a need for further financial resources at this stage. SI: no reply.

2. Human resources General overview The graphics below provide information about the human resources made available to the EEA SAs in 2020 and 2021 5 . These resources have to be interpreted in light of possible differences in the scope of competences, activities, and financial responsibilities at national level. *DK 2021 (until 1 July) LT: There are 2 GDPR supervisory authorities in Lithuania. 5 posts and plus an Inspector, only a small number of earlier mentioned posts are responsible for monitoring compliance with GDPR (2020 – 6 persons, 2021 - 9 persons). The State Data Protection Inspectorate, as the main GDPR supervisory authority, has 38 posts. SI: The SA is competent for data protection and access to public information. In 2021, 36 FTE are dedicated to data protection. pdf , p. 26 - 27. No 82% Yes 18% Is the allocated budget sufficient to carry out the SA's activitivies? AT BG, CZ HU DE, EE LI FI, FR LU GR, HR CY IS, LV MT, PL RO, SK SI, LT BE, SE IE, NL IT,ES CZ DE ES FR HU IE IT NL PL 2020 115 1004 189 225 114 145 134 180 243 2021 112 1083 189 245 117 175 133 175 271 0 200 400 600 800 1000 1200 FTE NBR OF EMPLOYEES - FOR SAs ABOVE 100 FTE AT BE BG CY DK* EE FI GR HR IS LI LT LU LV MT NO RO SE SI SK 2020 40 67 81 19 60 19 48 42 37 18 7 62 53 30 15 60 29 91 48 49 2021 45 67 81 18 60 19 53 42 35 19 7 62 54 32 15 62 29 95 49 45 0 10 20 30 40 50 60 70 80 90 100 FTE NBR OF EMPLOYEES - FOR SAs BELOW 100 FTE 6 Vast majority of SA’s have explicitly stated that they do not have enough human resources while there are some SAs who do not see a need for further resources at this stage.

Number of staff working on Complaint, enforcement and sanctions, as well as proportion of them working on cross border and national cases The first graphic below includes the number of staff members working on complaints, enforcement and sanctions on 01/01/2021. In some authorities, all this staff works on national as well on cross border cases, while in others SAs, the division is more e xplicit enabling to identify a proportion for each of the activities 6 . 6 This chart shows different interpretation of the question relating to the reparti tion of activities. No 86% Yes 14% In your view, is the allocated human resources sufficient to carry out your activities? AT BG, CZ HU DE, EE LI FI, FR CY GR, HR IS, LV MT, PL RO, SK SI, LT BE, SE IE, NL IT,ES 27 27 22 8 45 717 46 8 74 63 22 15 43 148 10 62 2 32 22 4 70 33 107 14 33 19 19 AT BE BG CY CZ DE DK EE ES FR GR HR HU IE IS IT LI LT LU LV NL NO PL RO SE SI SK Number of staff working on complaints, Enforcement and Sanctions (FTE) State of play on 01/01/2021 AT BG CY DK EE ES GR HR HU IE IS IT LI LT LU MT NL NO PL RO SE SI Cross-Border cases 85% 100% 100% 77% 55% 12% 5% 67% 17% 46% 10% 35% 20% 72% 100% 20% 20% 24% 5% 50% 50% 20% National cases 100% 100% 100% 77% 100% 88% 53% 100% 83% 54% 100% 100% 80% 100% 100% 67% 80% 76% 95% 100% 100% 80% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% % of staff working on Cross - Border and National case - on 01/01/2021 7 Number of staff by function and educational background *DK figures (until 1 July) The section “General Support” covers Secretariat administrative support, human resources department, budget, and finance, translation, data protection officers and Freedom of Information departments.

The section “Others” can cover for instance directors, staff working for Communication or E ducation department s , Researchers. AT BE BG CY CZ DE DK* EE ES FI FR GR HR HU IE IS IT LI LT LU LV MT NL NO PL RO SE SI SK General support 15 25 19 14 29 195 10 2 82 17 44 16 11 23 22 3 29 1 13 7 5 5 28 7 46 6 16 4 23 Legal 23 28 20 8 5 380 41 0 35 24 53 11 15 76 20 13 88 4 26 23 5 6 52 34 185 6 62 20 20 IT 1 4 7 5 5 103 5 1 25 2 30 12 4 4 5 2 9 2 5 5 1 4 7 14 11 4 2 2 Other 15 0 36 17 4 2 28 3 5 8 128 1 7 4 9 10 11 7 29 3 12 9 100 200 300 400 500 600 700 Number of staff per SA and by function (full - time equivalent, filled positions) on 01/01/2021 8 II. Enforcement 1. Total number of enforcement cases (national and cross - border cases) Number of national enforcement cases (from 25/05/2018 to 31/05/2021) The concept of enforcement cases here has to be understood broadly, as a case in which the SA is questioned about the compliance of data protection law, including the handling of complaints, tips and signals regarding possible non - compliance and cases for which no formal investigation is launched.

* DE records only available for some DE supervisory authorities ** DK 2021(until 1 July) ***NL 2021 (Q1 Only) SE: The SE DPA’s reply referred to the number of cases that involve formal investigations. 000 Number of registered national enforcement cases per year (1/2) AT BE BG CY CZ EE GR HR IS LI LT LU LV MT RO SE SI SK 2018 ( as from 25/05/2018) 537 5 2495 448 672 377 133 48 4842 37 306 17 294 93 806 205 2019 2317 349 811 36 2482 681 1199 475 477 53 7309 42 246 67 527 53 1310 415 2020 1940 783 615 34 1855 1081 1091 477 404 79 8388 13 969 117 296 44 1479 518 2021(up to 31/05/2021) 1370 274 19 916 511 519 174 145 30 3214 18 462 37 288 24 666 352 1000 2000 3000 4000 5000 6000 7000 8000 9000 Number of registered national enforcement cases per year (2/2) 9 Number of cross - border enforcement cases The SAs cooperate which each other under Chapter VII of the GDPR by using the Internal Market Information (IMI) system and some procedures dedicated to cooperation under the GDPR.

Different procedures exist, such as for the identification of the Lead Super visory Authority (LSA) and Concerned Supervisory Authorities (CSAs), for launching a request of Mutual Assistance under Article 61 GDPR or for procedures relating to the One - Stop - Shop. All the cases with a cross - border component are registered in a central database (IMI Case register) from which all cooperation and consistency procedures can be initiated. Not all cases which are registered in Case register concern One - stop - shop procedures. A case in the Case register may:  refer to one complaint and can lead to Article 60 procedure;  refer to several complaints and in consequence can lead to the several Article 60 procedures;  relate to consistency procedures (Articles 64, 65 or 66), Article 61 (Voluntary) Mutual Assistance or Article 62 Joint Operation s which will not necessarily lead to any One Stop Shop Art.

e. for transferring the complaints that do not concern the cross - border processing in accordance to Article 4 (23) GDPR and in conseq uence does not lead to Article 60 procedure . Moreover, r eferences to case register entries in these statistics do not have a 1 - to - 1 correlation to the number of cross - border complaints handled per country as multiple complaints may be bundled in one case r egister entry which therefore can relate to multiple cross - border cases . It should be noted that the IMI case register does not include those cross - border cases that are still in the preliminary phase of identifying the roles of the LSAs and CSAs. In addition, not all cross - border complaints filed at individual SAs may have bee n uploaded onto IMI yet. Therefore the IMI statistics may differ from the national reporting by the SAs as the national case management systems are usually organised around the individual complaints.

In this regard it should be noted that the actual number of cross - border cases opened by SA’s is, in all likelihood, higher than the number of cases currently included in the IMI system. Between 25 May 2018 until 31 May 2021, 1615 cross - border cases have been registered in IMI. The detailed breakdown of numbe r of cases by country as Lead Supervisory Authority (LSA) or Concerned Supervisory Authority (CSA) is available below. AT BE BG HR CY CZ DK EE FI FR DE GR HU IS IE IT LV LI LT LU MT NL NO PL PT RO SK SI ES SE CSA 531 518 256 248 283 306 623 296 454 640 887 279 435 228 348 628 282 225 264 328 244 438 573 486 385 285 396 305 614 498 LSA 35 31 3 2 28 21 31 28 17 127 183 6 20 2 164 31 9 5 15 91 31 108 20 20 9 5 5 0 79 111 0 100 200 300 400 500 600 700 Number of cross - border cases per LSA & CSA 10 2. Complaints Article 77 of the GDPR states that “every data subject shall have the right to lodge a complaint with a supervisory authority (…) if the data subject considers that the processing of personal data relating to him or her infringes this Regulation”.

These type of complaints – referring to a processing of personal data of the complainant – are labelled “Article 77 complaints” and are included in the graphics below. Please note that, in addition to these Article 77 complaints, SA’s may receive significant numbers of other complaints, tips and signals regarding non - compli ance with the GDPR, not included in the graphics below. Number of cases based on c omplaints *NL 2021 (Q1 only) **ES 2021 (up to 31/04/2021) ** * DE: The reported numbers do not include the values of all DE supervisory authorities. DE*** ES** FI FR IE NL* PL RO SE 2018 (as from 25/05/2018) 13525 2776 8049 3000 3916 4550 4822 1417 2019 27474 12380 3343 14137 7672 9167 9304 5808 3292 2020 40309 11108 3612 13585 5014 4723 6442 5082 2484 2021(up to 31/05/2021) 8098 4910 1527 5830 1700 1090 3902 1733 943 0 5000 10000 15000 20000 25000 30000 35000 40000 Number of cases based on complaints received under Art.

( 1/2 ) AT BE BG CY CZ DK EE GR HR HU IS LI LT LU LV MT SI SK 2018 (as from 25/05/2018) 531 5 1871 1478 247 590 356 1578 54 48 559 367 1206 48 648 133 2019 2879 331 1600 12 1862 2416 478 1001 114 2113 145 41 996 365 1236 115 1136 296 2020 1822 668 680 21 1374 2676 779 948 102 2599 130 63 1177 311 941 447 1208 341 2021(up to 31/05/2021) 1368 445 9 687 1328 416 428 50 1220 51 28 555 176 449 229 568 257 500 1000 1500 2000 2500 Number of cases based on complaints received under Art. 77 GDPR ( 2/2 ) 11 Status on 31/05/2021 of cases based on complaints * DE: The reported numbers do not include the values of all DE supervisory authorities. NL: Due to a lack of resources, not all resolved complaints included in this graphic could be dealt with within a reasonable timeframe and/or to a satisfactory standard. BG CZ DE* DK EE FI FR GR HR IE IS IT LI LT LU LV MT NL PL SE SI Complaints Resolved 3335 5632 25849 7256 1717 9155 32009 1632 478 14500 246 4070 169 2920 871 3662 687 16263 11540 7805 2396 Complaints Still pending 871 162 19752 642 203 2103 10103 1334 171 2672 129 2707 11 435 388 170 152 2560 5000 298 1164 0 5000 10000 15000 20000 25000 30000 35000 40000 45000 50000 Number of cases based on complaints per Status 12 3.

Ex officio Investigations Based on the GDPR, all SA’s are competent to initiate ex officio investigations. Statistics on the number of ex officio investigations launched per SA, per year are included in the gr aphic below. Please note however, that concepts of what constitutes an ex officio investigation may vary between the Member States, for instance based on national law. Number of e x officio investigations launched per year * NL: The numbers provid ed in 2021 includ e inform a tio n on Q1 2021 only. Status on 31/05/2021 of the e x officio investigations AT BE BG CY CZ DK EE ES FI FR GR HR HU IE IS IT LI LT LU LV MT NL* PL RO SE SI SK 2018 (as from 25/05/2018) 3 77 1 77 248 137 170 1 11 28 40 7 10 0 25 12 3 20 64 93 90 7 2019 215 18 156 9 95 120 88 15 2 301 66 13 63 20 25 104 12 144 33 5 110 385 53 37 15 2020 337 25 178 2 105 178 164 26 15 247 12 46 52 13 29 15 16 64 7 33 4 48 73 398 44 151 12 2021 (31/05/2021) 2 133 3 45 100 28 2 22 162 6 10 22 5 6 10 2 16 18 15 1 8 31 133 24 37 9 50 100 150 200 250 300 350 400 Number of ex officio investigations launched per year BG CZ DK EE ES FI FR GR HR IE IS IT LI LT LU LV MT NL PL RO SE Closed 505 289 511 414 0 21 416 69 60 12 39 135 23 231 19 27 13 142 41 980 155 Still pending 58 33 135 3 2 9 146 16 20 66 28 4 7 18 51 21 0 72 63 0 46 0 200 400 600 800 1000 1200 Status on 31/05/2021 of the ex officio investigations 13 4.

Data breach Notifications Number of cases based on Data Breach Notifications * NL: The numbers provid ed in 2021 includ e inform atio n on Q1 2021 only. **DK 2021 (until 1 July) DE: The reported numbers do not include the values of all DE supervisory authorities. ** IT: please note that this number refers to 2021 up to 31 March 2021 SE : T he figures refer to data breach notifications that have led to formal investigation – not the total number of received notifications. Status on 31/05/2021 of the cases based on data breach notifications NL : T hese numbers cover the data breach notifications where the NL carried out, or intends to carry out an intervention following a data breach notification. DE DK** FI IE NL* PL 2018 (as from 25/05/2018) 12687 2769 2222 3542 17311 3078 2019 30938 7408 3836 6257 27095 6039 2020 27652 9118 4267 6628 24055 7507 2021(up to 31/05/2021 7894 4298 2128 2854 6617 6684 0 5000 10000 15000 20000 25000 30000 35000 Number of case based on data breach notifcations per year (1/2) AT BE BG CY CZ EE ES FR GR HR HU IS IT** LI LT LU LV MT RO SE 2018 (as from 25/05/2018) 445 33 32 260 64 13 80 48 244 69 630 15 93 172 46 98 312 0 2019 923 877 65 63 416 115 79 29 132 72 506 272 1443 16 175 354 107 126 229 6 2020 860 1097 60 87 292 138 81 12 131 106 781 217 1387 20 181 379 113 95 184 3 2021(up to 31/05/2021 667 41 43 136 67 48 5 85 46 79 413 42 102 162 45 52 84 2 200 400 600 800 1000 1200 1400 1600 Number of case based on data breach notifcations per year (2/2) BG CY CZ DK EE FI FR GR HR IE IS LI LT LU LV MT NL PL SE SI Still pending 19 2 30 469 6 1205 15 39 104 745 118 5 24 19 1 20 95 1860 5 92 Resolved 180 223 1106 23124 378 11248 44 389 168 18536 519 88 527 1048 310 351 3779 21430 6 294 0 5000 10000 15000 20000 25000 Status on 31/05/2021 of the cases based on data breach notifications 14 5.

Exercise of SA's corrective powers on national and cross - border cases (from 25/05/2018 to 31/05/2021) Total n umber of cases where corrective powers were execute d ES: The figures correspond to the period 01/01/2019 to 31/12/2020. Figures for the rest of the requested period is not availa ble. 0 500 1000 1500 2000 2500 3000 3500 4000 SI SE RO PL NL MT LV LU LT LI IT IS IE HU HR GR FR FI ES EE DK CZ CY BG BE SI SE RO PL NL MT LV LU LT LI IT IS IE HU HR GR FR FI ES EE DK CZ CY BG BE Number of cases where SA limited or banned the data processing activities 17 0 176 245 33 5 0 1 7 53 80 0 0 2 112 1 3 4 7 Total number of cases where corrective powers were executed 132 69 359 870 32 238 536 17 777 51 285 74 4086 948 253 66 203 2094 613 631 59 95 483 128 Total number of cases where corrective powers were executed 15 Total amount of fines per year and per SA DE: The reported numbers do not include the values of all DE supervisory authorities.

DK : Please be informed that the legal system of Denmark do not allow for administrative fines as set out in the GDPR. It is the national courts (and not the Danish DPA) whom are competent in this regard. Please see recital 151 GDPR. SI : The legal system in Slovenia does not allow the SA to issue administrative fines as set out in the GDPR. The national law implementing the provisions on fines has not been p assed yet. The SA can only issue fines in relation to the breaches of the national Personal Data Protection Act that is still partially in forc e. S K : The numbers set in the table for 2018 include data from 25/5/2018 to 24/5/2019 and for 2019 data from 25/5/2019 to 3 1/12/2019. 500 CY CZ EE FI HR IS LI LT LU LV MT SK Total amount of fines per year and per SA (3/3) 2018 2019 2020 2021 16 Total number of decisions with a fine per SA DE: The reported numbers do not include the values of all DE supervisory authorities.

124 0 16 52 27 22 15 36 36 6 39 2 228 3 7 170 4 47 26 7 279 33 606 106 25 172 30 90 SK SI SE RO PL NO NL MT LV LU LT LI IT IS IE HU HR GR FR FI ES EE DE CZ CY BG BE AT Number of decisions with a fine per SA 17 Number of decisions with a fine per year and per SA DE: The reported numbers do not include the values of all DE supervisory authorities . 000€ 20 3. Judicial appeal of the cases with a fine (from 25 May 2018 to 31 May 2021) SA Total num ber of Decisions w ith a fine subject to a Court appeal STATUS Decisions by annulled the court Decisions modified by the court Decisions confirmed by the court Decisions subject to an appeal that is still pending AT 14 4 4 6 0 BE 12 8 0 1 3 BG 328 71 24 231 2 CY 0 0 0 / / CZ 3 1 0 1 1 DE 65 8 15 0 42 EE 1 1 0 / 0 ES 266 68 22 178 / FI 4 0 / 1 3 FR 10 0 0 5 5 GR 12 0 0 0 12 HR 2 0 0 0 2 HU / / / / / IE 0 0 0 4 0 IS 0 0 0 0 0 IT 233 25 14 50 144 LT 1 1 0 0 0 LT 13 0 2 2 9 LU 0 0 0 0 0 LV 12 1 3 5 3 MT 3 0 0 0 3 NL 4 1 1 0 2 NO 3 / / / 3 PL 23 1 1 7 14 RO 29 0 0 0 / SE / / / / / SI 0 0 0 0 0 SK 6 0 0 0 6 IE: N o IE SA’s decisions have been appealed.

The four decisions confirmed by the Irish courts refers to the process set out in the Data Protection Act 2018 whereby decisions of the IE SA to impose a fine must be “confirmed” by the courts. NL: the case annulled by the Court is currently under appeal. 21 4. g. internal procedures) Country Legal deadline to handle a complaint Deadline based on law or internal procedure AT 6 months Law BE - None BG 3 months Law HR 2 months (1 month +1 month extension) Law CY - None CZ 2 months (1 month + 1 month extension) Law DK 6 months Internal procedure EE 2 months Law ES 6 months/9months 7 Law FI - None FR - None DE - None GR - None HU 2 months Law IS - None IE - None IT 12 months (9 months + further extension) Law LT 6 months (4 months + 2 months extension) Law LI 3 months Law LV 2 years (6 months+ further extension up to 2 years) 4 months (1 month + further extension - for administrative offence cases) Law LU - None MT - None NL 3 months Law 8 NO 1 month Law PL - None RO 1,5 months Law SI 2 months Law SK 6 months (3 months + 3 months extension) Law SE 3 months Internal procedure 7 ES: the 6 months deadline is applicable to “the lack of attention to the exercise of rights”.

In case a decision is not issue d before the expiry of this period, the claimant may consider that the complaint has been resolved favorably . For other type of complaints, the legal deadline is 9 months. In both cases the respective terms will be suspended in cases where the Agency has to request the opinion or the intervention of organs or bodies of the EU or of other supervisory authorities. 8 While NL national law does not provide for a specific timeframe to adopt a decision (either 3 months for an update and a deci sion within a “reasonable timeframe”), a decision should be adopted within 3 months. If this is not possible, an update should b e provided within that timeframe. In the latter case, a decision must be adopted within a reasonable timeframe, depending on the nature of the case. 23 5. The procedural rights of a complainant and a controller Brief description of the rights (In particular the right to be heard) Austria a) right to be heard b) right to inspection of file c) right to timely decision Belgium After the investigation phase, the file is transmitted to the litigation chamber which will hear the parties and decide on possible sanctions.

Both parties to the proceedings (complainant and controller) will be invited to expose their point of view on the findings made by the inspection service. They have the opportunity to react to each others arguments and can also be invited to an oral hearing (many of these oral hearings were organized digitally during the COVID - 19 crisis) Bulgaria Under the specific Bulgarian legislation regulating the complaints and signals handling, both sides in the proceeding ha ve the right to be informed about the undertaken actions by the CPDP at any time and also about the final decision. The data controllers/processors are obliged to submit information and documents on the relevant case both as a party to the proceeding and under the GDPR and PDPA. The experts, designated on the case might also need to take actions on obtaining additional information or documentation depending on the case. Both sides in the proceedings have also the right to be heard either via sending additional remarks or opinion in writing or orally at the plenary meeting of the CPDP during which their case is examined.

Czech Republic Complainant has a right to make a complaint and has a right to be informed in regards to the complaint made by a comp lainant. Controller’s procedural rights in administrative proceedings mainly consist of a right to be heard (and more specifically for example right to present evidence), right to administrative appeal, right to inspect administrative file. Croatia According to Article 30 of our national Law on general administrative procedure (OG 47/09) in the proceedings, the party must be allowed to state all the facts, circumstances and legal issues important for resolving the administrative matter. Without the prior declaration of the party, the procedure may be conducted only if the request of the party is accepted or if the decision in the procedure does not have a negative effect on the legal interests of the party or when so prescribed by law. Additionally, according to Article 11 of the mentioned Law, public bodies are obliged to provide the parties with access to the necessary data, prescribed forms, the website of the public body and to provide them with other information, advice and professional assistan ce.

e. data secrecy. Cyprus The right to be heard in regulate by section 43 of Law 158(I)/1999 24 Denmark A data subject can fi le a complaint with the Danish DPA in accordance with Article 77. The Danish DPA is subject to the Public Administration Act, which amongst other obligations entail that the DPA must examine a case to the extent appropriate, make sure that the parties’ rig ht to be heard is complied with and further, that the decision of the Danish DPA contains a reasoning for the reached decision. ee/en/eli/527032019002/consolide) paragraph 40 regulates the hearing of opinions and objections of participants in proceedings. ee/en/eli/507062021005/consolide) paragraph 19 regulates the rights and obligations of the person subject to proceedin gs. The Procedures of proceedings by the Estonian Data Protection Inspectorate (document for internal use) also foresees the description of rights, incl.

right to be heard Finland The Section 34 of the Finnish Administrative Procedure states: Hearing the views of parties Before a matter is decided, each party shall be provided with an opportunity to express an opinion on the matter and to submit an explanation of claims and of evidence which may influence the decision. France When a sanction is likely to be imposed against a data controller or processor, the Chair of the CNIL decides to appoint a rapporteur among the members of the CNIL. The rapporteur drafts a report proposing a sanction against the data controller or processor. The report is sent to dat a controller or processor. Once the data controller received it, it has one month to reply. The rapporteur can then reply to the data controller within 15 days. Finally, the data controller also has 15 days to send to the rapporteur its final reply. The d elays can be extended on a case by case basis, for instance due to the complexity of the case.

The data controller and processor are informed that if they don’t respect the delay, the reply will be declared inadmissible, unless the CNIL’s Restricted Committee’s Chair decides to reopen the investigations. Then, a hearing of the data controller or processor is organized before the Restricted Committee who release after its decision in within approximately 4 to 6 weeks. When a complaint was at the origin of the procedure, the complainant is informed of the result of the investigation carried out (the complainant is for example informed that a fine was issued, of its amount and of the nature of the breaches). The complainant is not heard during the s anction procedure. Germany In Germany, disputes under Art. 78 Paragraphs 1 and 2 GDPR are assigned to the administrative courts (cf. Section 20 of the Federal Data Protection Act – BDSG). Subject to area - specific special provisions, the Federal Administra tive Procedure Act (VwVfG) or the Administrative Procedure Acts of the federal states (LVwVfG) apply.

The VwVfG (or the LVwVfG) contain provisions for the implementation of procedural rights. By perceiving them, the person involved can influence the admini strative procedure or the decision of the authority. Noteworthy procedural rights are the right to be heard (Section 28 (1) VwVfG), the access to records (Section 29 (1) VwVfG), the authority’s confidentiality obligation (Section 30 VwVfG), its duty to adv ise, supervise and provide information to the persons involved in the administrative procedure (Section 25 (1) VwVfG) and last but not least its obligation to give reasons for written or electronic as well as written or electronically confirmed administrat ive acts (Section 39 VwVfG). The aforementioned provisions ensure that the procedural requirements established by the GDPR (cf. Art. 58 (4) GDPR and recital 129) are met. Greece In the cases of exercise of the responsibilities provided in articles 57 pa r.

1f and 58 par. 2b and 2i of the GDPR, the decision of the Authority is issued after a public hearing. In case of suspension of public meetings due to an 25 emergency, the Authority meets by teleconference. Cases can be also considered by teleconference if the parties concerned agree. The interested parties may also develop their views without appearing at the meeting by submitting, by the day of the meeting, a memorandum with which a statement is declared before the Authority without attendance at the meet ing. The representation to the Authority is made in person or by a representative of a legal entity in accordance with the relevant statutes or by an attorney. The Data Protection Officer of the Controller or the Processor may be present and make clarific ations but does not in any way represent the Controller or the Processor. The Authority may also hear representatives of interested consumer organizations, associations and other bodies to express views on matters within its competence.

During the hearing of the case, the President may give those present a deadline for submitting a memorandum. The decision - making conference takes place either immediately after the debate or at a time set by the President. Hungary The both parties are constantly informed a bout the progress of their case. They can access the case documents personally on a pre - arranged date. The access has no fee, but if they want a copy of certain documents compensation for the cost of the photocopying has to be paid. Also, both parties hav e right to appeal the Authority’s decision at the Budapest - Capital Administrative and Labour Court. Iceland According to Article 13 of the Icelandic Administrative Procedures Act No 37/1993 a party to a case shall be given the opportunity to express his v iews on the subject - matter of the case before a public authority reaches a decision thereon, unless his reasoned position on the matter already appears in the documentation on the case, or it is clearly unnecessary for him to do so.

Furthermore, Article 10 stipulates that an authority shall ensure that a case is sufficiently investigated before a decision thereon is reached. The DPA notes that the complaints procedure under the Icelandic Data Protection Act No 90/2018 is entirely in written form. Ireland During the course of an inquiry (including during the Article 60 process), the respondent party has the right to fair procedures derived from the principles of natural and constitutional justice under Irish common law. The concept of fair procedures has d eveloped incrementally under Irish law from (i) Irish Constitutional case law, (ii) Irish Administrative case law, and (iii) the obligations arising from Article 6 of the ECHR. In essence, the application of fair procedures seeks to ensure that the respo ndent has a fair hearing. Under Irish law, however, there is no single set of procedures that must be applied in each case; what is required, in any case, must be determined by reference to the circumstances of that particular case.

26 In addition to the procedural rights of the respondent, the right to fair procedures, including the right to be heard also extends to the complainant in complaint based inquiries. Italy With regard to the procedural rights of complainants and controllers we refer to Sections 12 and 13 of t he abovementioned Regulation 1/2019. According to Section 12, where the examination of the complaint does not lead to the outcome set out in Section 11 (1) (see above), the department, service or other organisational unit in charge of the file shall commen ce the procedure for the adoption of the measures referred to in Articles 58 (2) and 83 of the GDPR by notifying this directly to the controller and, where applicable, the processor (Article 11 of Regulation 1/2019). According to Section 13 (Right of defen ce): 1. The addressee of the notification referred to in Section 12 may exercise his/her right of defence through the submission of written pleadings and documents as well as, where so requested, by being heard in person on the facts that are the subject of the said notification.

A summary report of the hearing shall be drawn up by the Bureau. Any waiver of the hea ring shall be notified without delay to the department, service or other competent organisational unit. At the hearing, the applicants shall put forward their counterclaims and avoid repeating or merely referring to what was already represented in their pl eadings. The hearing of the natural persons to whom the notification referred to in Section 12 (2) is addressed shall be of a strictly personal nature; participation with the assistance of a lawyer or other consultant is allowed. 5. Failure to submit writt en pleadings or a request for a hearing shall be without prejudice to the continuation of the proceedings. Latvia When the Inspectorate starts investigation or even receives the complain of the data subject in order to understand practical circumstances, the Inspectorate always asks the opinion of the controller /processor on personal data processing in relation with the circumstances explained at a complain.

So the controller/processor has the possibility to express their opinion in the beginning of the p rocedure as well they have the right to become acquainted with the case during the different stages of the procedure. A participant to administrative proceedings has the right to become acquainted with the case and express his or her opinion at any stage of the proceedings (Article 61 of Administrative Procedure Law). The person to be held liable has the rights to access materials of an administrative offence case, make extracts, transcripts thereof, and prepare copies; to participate in the examination of an administrative offence case; to provide explanations; to use the language in which he or she is able to communicate, as well as to use assistance of an interpreter if this person does not know the language in which the administrative offence proceed ings take place; to know the offence for the committing of which he or she is held liable; to express requests; to submit evidence; to appeal the decision taken in an administrative offence case (Article 41(1) of Law on Administrative Liability).

If the I nspectorate performs the inspection on the place, it shall familiarize the persons who participate in the relevant action with the content of the minutes. Any corrections and supplements suggested by the persons shall be recorded in the minutes of the proc edural action (Article 16 of Personal Data Processing Law). 27 Liechtenstein The right to be heard has to be granted to both the controller as well as the complainant according to national procedural law. Lithuania According to the Law on Legal Protection of Personal Data of the Republic of Lithuania the person to be inspected, the applicant, the person complained against and the person suspected of committing the infringement shall also be entitled: 1) receive expl anations on the subject and basis of investigation and/or inspection or processing of a complaint; 2) provide additional explanations and/or information concerning the conduct of an investigation and/or inspection or examination of a complaint on its own i nitiative; 3) appeal against acts or omissions of the supervisory authority; 4) access the information on the investigation and/or inspection, the processing of the complaint and the imposition of the administrative penalty, except for national, service, p rofessional, commercial or other information containing secret which is protected by law.

Luxemburg When a complaint is lodged, the CNPD has the opportunity to solve it either (i) by taking contact with the controller to find a solution (dispute resolution) or (ii) by launching an official investigation or audit. (i) The CNPD takes contact with the controller and raises the problem encountered by the complainant so that the controller can take a position. The CNPD can invite the controller to take specific corrective measures or to inform the CNPD about the reasons why he does not intend to take such corrective measures. The controller always has the opportunity to take a position on the CNPD requests or position during this process. (ii) The CNPD can also decide to launch an official investigation/audit, following a complaint (or on its own initiative). In such case, the controller can address all the findings of the head of investigation (for example by answering to the statement of objections).

T he restricted panel of the CNPD will take into account every position of the controller. In addition, the controller is invited to provide his observations orally during the final hearing of the restricted panel. The controller may lodge an appeal against the decision of the restricted panel before the Administrative Tribunal . The controller can address all the findings of the head of investigation (for example by answering to the statement of objections). The restricted panel of the CNPD will take into a ccount every position of the controller. In addition, he is invited to provide his observations orally during the final hearing of the restricted panel. The controller may lodge an appeal against the decision of the restricted panel before the Administrat ive Tribunal Malta In line with the right to be heard and the principles of natural justice, both the complainant and the controller are given the opportunity to make their respective submissions during the course of the investigation.

Netherlands The right to be heard is applied at several stages of a procedure. In the first place, a h earing for parties involved I a case takes place in the context of the primary complaint handling by the NL SA . Subsequently, if there is an intention to take an enforce ment decision, the alleged violator will be notified by the NL SA and given the opportunity to express his/her views, both in writing and during a hearing. Once the NL SA has adopted a decision, parties involved in a case (for instant: a complainant or c ontroller) can furthermore object to this decision following a procedure laid down in the Dutch General Administrative Law Act. In these situations, a re - evaluation by a dedicated department of the NL SA will take place. If a complainant objects to a decis ion of the Dutch SA on his /her complaint, both data subject and controller will be heard. If a controller objects to an imposed enforcement decision, the controller will also be heard.

In principle, hearing s take place during a hearing at the office, but c an also be done via (video) calling due to COVID - 19 measures. Following the objection procedure, p arties involved in a case can appeal against a decision on an objection at the Dutch administrative court , after which the cou rt will generally invite the p arties to appear at a hearing. If, however, the judge and the parties agree that an investigation in court can be omitted, then an investigation in court will not 28 take place. g. inadmissible, unfounded). Lastly, a n appeal against the decision of the administrative court can be lodged at the Administrative Jurisdiction Division of the Dutch Council of State . Norway In accordance with Norwegian law, both the complainant and the controller have a right to be heard in the processing of a case that concern them, see the Norwegian Public Administration Act. A party to a case has an extensive right to access to the documents in the case, a right to comment on the documentation of a case before it is final and to receive the grounds for the decision.

A complainant or a controller may appeal a decision of the Norwegian SA to the Norwegian Privacy Appeals Board. A complainant or a controller may bring a decision before the courts. Poland According to the Code of Administrative Proceedings the complainant has the following rights: Art. 10. Principle of hearing of the parties. § 1. Public administration authorities shall ensure that the parties may actively participate in every stag e of the proceedings, and prior to issuing a decision the authorities shall give the parties an opportunity to present their position as to the collected evidence and materials and submitted demands. § 2. Public administration authorities may depart from t he principle specified in Section 1 only if the matter must be decided without delay due to a threat to human life or health or due to threatening irreparable material damage. § 3. Public administration authorities shall record in the case files, by way of annotation, the reasons for departing from the principle specified in par.

1. Art. 73. Rule. § 1. At every stage of the proceedings the public administration authority shall allow the party to review the case files and to make notes and copies. § 2. The p arty may demand that the copies of the case files made by the party be certified to be a true copy or that certified copies from the case files be issued to the party if that is justified by significant interest of the party. § 3. If documents are submitte d to or served by the public administration authority in electronic form, the authority may provide the party with access thereto through its teleinformatic system, after the party has been properly identified in the manner specified in the provisions of t he Act of 17 February 2005 on Informatization of Operation of Entities Performing Public Tasks. Romania Article 24 of Law no. 102/2005, republished: (1) Without prejudice to the possibility of addressing a complaint to the National Supervisory Authority, the data subjects have the right to address the competent court to defend the rights guaranteed by the applicable law, which have been infringed.

(3) Any person who has suffered a damage as a result of processing of personal data, carried out illegally, ca n address the competent court for its repair. Slovakia The procedural rights of a complainant and a controller are provided in Act No. 71/1967 Coll. on Administrative Proceedings (Administrative Code) such as: to access to documentation for the parties an d their representatives, to suggest the evidence, to inquire the witnesses and the experts during the verbal process and the inspection. Right to be heard is expressed within the par. " The party to the proceedi ngs has the right to express their view regarding the supporting evidence for issuing the decision at each stage of the proceedings. If a party to the proceedings exercises his right to object and proposes to supplement the basis for issuing a decision, the administrative authority is obliged to deal with this and, if necessary, to supplement the proceedings at its 29 discretion.

However, the party to the proceedings is not obliged to comment and if he does not use this opportunity, the administrative body will issue a decision. Act no. 18/2018 Coll. (2) The appealing party may extend the scope of the submitted appeal by an additional proposal or other points only within the period lay down for filing the appeal. Slovenia Complaint procedures related to implementation of individuals' rights based on Articles 15 - 21 of GDPR are processed in line with the General Administrative procedure act. In these procedures therefore the complainant has the position of a party to the procedure and has the right to give his views and expr ess himself with regard to all the facts and circumstances which will affect the decision of the DPA. e. controller) does not enjoy such procedural guarantees in accordance with the General Administrative procedure act. Both the f irst - degree body as well as the complainant can challenge the DPA's decision in administrative dispute (in front of the Administrative Court).

According to Inspection Act the applicant does not have the position of a party to the procedure as any inspection procedure is initiated in the public interest if there is a suspected breach of the law. The complainant may request to be granted the position of a party under the provisions of the General Administrative Procedures Act, in order to be able to defend his/her rights. The controller is the party to the procedure, and must be heard on the facts and circumstances of the case in accordance with the Inspections Act and the General Administrative Procedures Act and can challenge the decision of the SA before the competent court. S pain Once the enforcement procedure is finished, and before the drafting of the proposal for a final decision, interested parties will be granted the right to be heard. Complainants are not considered as interested parties ex cept if the envisaged decision may adversely affect them.

This is the case in all complaints related to the exerc ise of data protection rights, b ut the fact that the complaint is dismissed or rejected in other cases does not imply that the decision adverse ly affect the complainant. This is decided on a case - by - case basis taking into account the impact that the decision may have on the rights of the complainant. In any case, the right to be heard is not necessary when facts or other allegations and evidence other than those submitted by the interested party are not included in the procedure or taken into account in the proposed decision. Sweden The complainant is not a party to the investigation. The complainant does therefore not have a right to be heard in that procedure. The controller has a right to be heard. 78 Country Existing costs to appeal a decision under Art. 78 AT 30 EUR BE Requesting party:  Submission of the application: €20 contribution to the budgetary fund  Any attorney fees if they use a lawyer The final costs depend on the Court's judgement.

440 (but can be higher in some cases)  The register fees on appeal: €400 to the Belgian state  Payment of the €20 "budgetary fund" contribution to the requesting party (if they are the winning party) These costs may vary. BG Average annual costs: 3 768, 58 EUR HR In accordance with Article 79, paragraph 3 of the Administrative Disputes Act (Official Gazette 20/10, 143/12, 152/14, 94/16, 29/17) each party previously pays the expenses caused by its actions, unless otherwise provided by law, and in accordance with paragr aph 4 of the same article, the party who loses the dispute shall bear all expenses of the dispute, unless otherwise provided by law. If the party succeeds in part in the dispute, the court may, in the light of the success achieved, order that each party be ar its own expenses or that the expenses be apportioned to the success of the dispute. CY Cannot provide an answer. CZ 120 EUR.

DK No information available. EE State fee for an appeal to court is 15 €. Representative fee in court cases are approx. 120 € per hour (average). FI The Administrativ e Court fee is 250 euros plus any legal fees a party may have. However, the Court does not require the use of an attorney. If the complainant wins the case, a fee of 250 euros will not be charged. FR Access to j ustice is in principle free of charge in France. However, filing an application before the administrative court may incur some costs, in particular lawyers' fees. Lawyer is compulsory in some cases before the Conseil d'État – the French administrative supr eme court, competent in case of judicial remedy against decisions taken by the CNIL. If his / her income is low, the applicant can ask to benefit from legal aid, which will allow the State to pay all or part of the legal fees. If the applicant has incurr ed costs, including attorney's fees, as a result of his / her action, he / she may ask the Conseil d'État to order his / her opponent to reimburse him / her for these costs, quantifying his / her claim.

500 €  In case of complaints against warnings or final messages (to the complainant) the fees depend on the value in dispute. 000 € for a proceeding in first instance. GR 2000€ According to par. 1 of article 20 o f Law 4624/2019: Regulatory decisions and individual administrative acts issued by the Authority, including decisions imposing penalties, shall be challenged by way of action for annulment before the Council of State. HU The appeal fee is usually 6% of the proceeding subject’s value at the time of initiation, but minimum 28 €, maximum 2537 €. 31 IS Act No 90/2018 does not provide for an appeals procedure. However any party has the right to bring their case before national courts. IE This information is not available to the DPC in circumstances where appeals against any decisions of the DPC must be brought before the Irish national Courts; the costs associated with any such appeals are not determined by, or within the control of, the DPC.

If a party to a decision wishes to appeal that decision, the party concerned can expect to incur standard Courts Service fees in respect of the filing/ lodging in Court of any required papers. These filing/lodging costs, however, are relatively low. While it is a matte r for the party concerned to decide if it wishes to instruct a legal advisor in the context of an appeal, there is no requirement for the party to do so and the party may, if he/she/it wishes, conduct the appeal before the Courts as a litigant - in - person i. e. as a self - represented litigant. IT Information is not available. Please note that the cost of an appeal against a decision of the Garante cannot be established a priori. Generally speaking, the value of a case is determined by the petitum (Article 10 o f the Code of Civil Procedure). If there is a sanction it depends on its amount, otherwise it is of indeterminate value.

LU No information available yet. MT There are no fees to appeal a legally - binding decision before the T ribunal - the parties may choose not to be represented by a lawyer. Appeals filed before the Court of Appeal are subject to general court registry fees. NL 2021 court fees District Courts, Administrative law sector :  for private individuals (natural persons): € 181  for organizations (legal entities): € 360 2021 court fees Administrative Jurisdiction Division of the Dutch Council of State :  for private individuals (natural persons): € 270  for organ izations (legal entities): € 541. NO If a decision is a mended in favor of a party, the party shall be awarded coverage for significant costs necessary to have the decision amended, see the Public Administration Act §36. A party that has submitted a claim for amendment of the decision, but has not been successf ul in any questions of significance, may be ordered to pay in full or in part the legal costs that the claim has entailed.

Whether a party shall be awarded coverage for legal costs, is decided by the appellate body. a. 44 EUR) RO Article 24 of Law no. 102/2005, republished: (4) The competent court is the one of the data controller’s or processor’s office or from the habitual residence of the data subject. The application is exempt from stamp duty. SK Regulated by Act no. 71/1992 Coll. on Court Fees - 70€ If the acts and procedures are performed on the basis of a submission submitted by electronic means in the prescribed manner, the rate may be reduced by 50% SI The cost to file an administrative dispute against the DPA's decision is approx. 148 EUR (defined by Court fees act). SE No costs.