New Regulation to Strengthen GDPR Enforcement and Cross-Border Cooperation
The Council of the European Union and the European Parliament have reached a provisional agreement on a new regulation designed to strengthen the enforcement of the General Data Protection Regulation (GDPR). This Draft Regulation aims to improve cooperation between national data protection authorities (DPAs) to accelerate the handling of cross-border GDPR complaints and investigations. It introduces clearer rules for when DPAs must accept complaints and investigates cases more efficiently, benefiting businesses operating across the EU, especially those with activities spanning multiple member states.
The Draft Regulation maintains the GDPR’s one-stop-shop mechanism but adds new requirements to enhance collaboration between DPAs in cross-border cases. It proposes a fast-track process that allows for early resolution of complaints when the company has already addressed the issue and the complainant agrees to resolve the matter quickly. This aims to reduce delays and administrative burdens, allowing DPAs to focus resources on more complex or contentious cases.
To address concerns about slow enforcement, the Draft Regulation sets investigation deadlines of 15 months, with a possible 12-month extension for complex cases. For straightforward matters, a simplified cooperation procedure is proposed, with investigations expected to conclude within 12 months. These measures are intended to speed up decision-making and ensure more consistent enforcement across the EU. The Draft Regulation also clarifies the rights of complainants and entities under investigation, ensuring transparency and fairness during the process.
The agreement still requires formal approval by both the Council and the European Parliament before becoming law. Once adopted, the new rules will introduce significant procedural changes affecting all organizations handling personal data of EU citizens. Companies should monitor these developments closely and prepare for potential impacts on their data protection compliance and enforcement risks.
