Decision of the European Data Protection Supervisor of 18 July 2024 amending the Rules of Procedure of the EDPS of 15 May 2020 [2024/2022]

1 Before adopting a decision: (a) containing finding of an infringement of the Regulation or of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body; or (b) exercising corrective powers pursuant to Article 58(2) of the Regulation; or (c) imposing an administrative fine pursuant to Articles 58(2)(i) and 66 of the Regulation, or pursuant to point (l) of Article 43(3) of Regulation (EU) 2016/794 of the European Parliament and of the Council; or (d) exercising powers against the European Union Agency for Law Enforcement Cooperation (Europol) pursuant to points (b), (c), (d) (e), (f), (g), (j), and (k) of Article 43(3) of Regulation (EU) 2016/794; or (e) exercising powers against the European Public Prosecutor’s Office (EPPO) pursuant to points (b), (d) and (e) of Article 85(3)(b) of Council Regulation (EU) 2017/1939 ; or (f) exercising powers against the European Union Agency for Criminal Justice Cooperation (Eurojust) pursuant to points (b), (d) and (e) of Article 40(3) of Regulation (EU) 2018/1727 of the European Parliament and of the Council; the EDPS shall draft a preliminary assessment and communicate it to the controller or processor which is the subject of the proceedings conducted by the EDPS (“the controller or processor”).

2 Before adopting a decision in cases where the EDPS intends to partially or wholly dismiss a complaint lodged pursuant to: (a) Articles 63 and 68 of the Regulation; or (b) Article 47 of Regulation (EU) 2016/794; or (c) Article 88 of Regulation (EU) 2017/1939; (d) Article 43 of Regulation (EU) 2018/1727; or the EDPS shall draft a preliminary assessment and communicate it to the complainant.

3 The preliminary assessment shall contain: (a) the relevant established facts and references to supporting evidence on which the EDPS intends to rely on to reach its decision; (b) the EDPS’ initial legal assessment of the facts, and any alleged infringement of the applicable data protection rules; and (c) any corrective powers envisaged by the EDPS, having considered aggravating or mitigating factors.

4 By way of derogation from paragraph 3, in cases of application of Article 18(1)(c), the preliminary assessment shall only contain the relevant elements on which the EDPS intends to rely in deciding whether to impose an administrative fine and in deciding on the amount of the administrative fine, having regard to the elements listed in Article 66(1) of the Regulation.

5 The EDPS may restrict the information provided to the complainant in the preliminary assessment referred to in paragraphs 2 and 3, to protect any of the interests referred to in: (a) Article 25(1) of the Regulation; or (b) Articles 79(3), 81(1) or 84(2) of the Regulation; or (c) Articles 58(3), 60(1) and 61(5) of Regulation (EU) 2017/1939; or (d) any other legitimate interests of confidentiality or of professional and business secrecy. In such cases, the EDPS shall inform the complainant at least about the part(s) of the complaint that it intends to dismiss, and of the justification for applying any of the restrictions referred to in the first subparagraph. In cases of restriction of information for interests referred to in points (b) and (c) of the first subparagraph, the EDPS may omit information regarding the justification for applying any of the restrictions where the provision thereof would undermine these interests. In such cases, the EDPS shall inform the complainant in accordance with Article 84(3) of the Regulation and Article 62(3) of Regulation (EU) 2017/1939.

6 The EDPS shall give to the controller or processor and the complainant the opportunity of being heard on the finding of an infringement of the Regulation or of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, and/or the exercise of corrective powers, or the imposition of an administrative fine, or where the EDPS intends to partially or wholly dismiss a complaint, as the case may be. The EDPS shall set a time-limit within which the controller or processor and the complainant may make known their views in writing, taking into account the urgency of the matter.

7 The EDPS may limit access to the file where this is necessary to protect any of the interests referred to in paragraph 5 above.

8 The EDPS shall base his or her decisions only on findings and measures on which the controller or processor or the complainant have been able to comment, except in cases of application of paragraphs 5 and 7.

9 The EDPS shall, in the text of its decision, inform the controller or processor and the complainant of their right to challenge the decision before the Court of Justice of the European Union in accordance with Article 263 of the Treaty on the Functioning of the European Union.

This Decision shall enter into force on the twentieth day following its publication in the Official Journal of the European Union.