MEPs agree their position on strengthening the enforcement of data protection rules 

Press Releases 
  • Lack of cooperation has slowed down cross-border investigations 
  • Harmonised procedural rules to improve handling of cross-border cases 
  • MEPs want stronger rights for complainants including the right to be heard and to access information 

The European Parliament has adopted its position on new procedural rules for the enforcement of the General Data Protection Regulation.

On Wednesday, the European Parliament adopted its negotiating position on additional procedural rules relating to the enforcement of the General Data Protection Regulation (GDPR) with 329 votes in favour, 213 against, and 79 abstentions. The GDPR, which harmonised the data protection rights of EU citizens and ensured the free flow of personal data between the Member States, is enforced by independent national data protection authorities (DPAs), and the current proposal aims to smoothen their co-operation, flesh out dispute resolution mechanisms, and harmonise certain procedural rules and rights.

Complainants’ rights and access to information

In their position on the new law, MEPs emphasise the right of all parties to equal and impartial treatment regardless of where their complaint was lodged; their right to be heard before any measure is taken that would adversely affect them; and their right to procedural transparency, including access to a joint case file.

In order to clarify and streamline cross-border procedures, Parliament wants to strengthen the provisions on joint case files. These would contain all information related to a case, and concerned supervisory authorities should have "instant, unrestricted and continuous" access to the joint case file. Parties to the complaint should also have access to the joint case file except for provisions on internal deliberations.

Clear deadlines to speed up procedures

MEPs also want to standardize procedural deadlines: they propose a time limit of two weeks for a supervisory authority to acknowledge that they have received a complaint and declare it admissible or inadmissible. Then, the authority would have three weeks to determine if the case is a cross-border one, and which authority should be the lead authority. Draft decisions must be delivered within nine months of receiving the complaint, outside of certain exceptional situations.

MEPs want to clarify the rules involving amicable settlements (consensual, negotiated resolutions to disputes) by stating that such settlements should require the explicit consent of the parties. MEPs want to establish that an amicable settlement does not prevent a DPA from starting an own-initiative investigation into the matter, and that other DPAs can request the lead authority to start such an investigation. Finally, the position would also ensure that all parties to complaint procedures have the right to effective judicial remedies, for example when DPAs do not take necessary actions or comply with deadlines.


Rapporteur Sergey Lagodinsky (Greens/EFA, DE) said: “The GDPR Enforcement Procedures Regulation brings more legal certainty for businesses and citizens. The Parliament today strengthens the rights of complainants and gives parties under investigation clarity in the procedure. We strengthen the fundamental right to data protection in the EU.”


Two years after the start of the application of the GDPR, Parliament expressed its concern about “the uneven and sometimes non-existent enforcement of the GDPR by national Data Protection Authorities”. It underlined that lengthy procedures can produce an “adverse effect on effective enforcement and on citizens’ trust”.

In its first evaluation report on the GDPR, the European Commission noted that the handling of cross-border cases should be “more efficient and harmonised across the EU”, leading to the present proposal. According to Article 97 of the GDPR, the next evaluation report of the Commission is due four years after the previous one.

Next steps

The file was referred back to committee for inter-institutional negotiations, and will be followed up by the new Parliament after the European elections of 6-9 June.