The Council of the European Union has published a working document, dated 20 November 2024, reporting provisional agreements at the technical level on key issues for a legislative proposal to establish additional procedural rules for enforcing the General Data Protection Regulation (GDPR). The document outlines progress on defining the scope of the new rules, complaint admissibility criteria, and investigation procedures, all aimed at streamlining cross-border data protection enforcement.
Scope and procedural harmonisation
The working document indicates that negotiators have agreed that the new procedural regulation will apply to cross-border processing activities, directly supplementing Regulation (EU) 2016/679. Provisional consensus has been reached on criteria for complaint admissibility, designed to help data protection authorities (DPAs) handle complaints more efficiently. Agreement has also been achieved on investigation procedures, including timelines and rights of the parties involved. These elements aim to reduce fragmentation in GDPR enforcement across member states and speed up resolution of cross-border disputes.
Impact on stakeholders
The proposed rules will primarily affect EU data protection authorities, which will gain clearer procedures for cooperation and dispute resolution. For businesses operating across multiple EU member states, the harmonised rules could reduce compliance costs and legal uncertainty by providing a more predictable enforcement environment. EU consumers and data subjects may benefit from faster and more consistent handling of their complaints. However, some DPAs may face administrative adjustments to align with the new procedures, and businesses could incur initial costs to adapt to revised investigation timelines and admissibility criteria.
Next steps
The working document will inform further discussions within the Council and with the European Parliament. The provisional agreements at the technical level will need to be formally endorsed by the Council and the Parliament before the regulation can be adopted. Once adopted, the regulation will directly apply in all member states, supplementing the GDPR's existing enforcement framework.