Legal provisions of COM(2023)348 - Additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier COM(2023)348 - Additional procedural rules relating to the enforcement of Regulation (EU) 2016/679.
document COM(2023)348
date July  4, 2023


Chapter I

General provisions

Article 1

Subject matter

This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the cross-border enforcement of Regulation (EU) 2016/679.

Article 2

Definitions

For the purposes of this Regulation the definitions in Article 4 of Regulation (EU) 2016/679 shall apply.

The following definitions shall also apply:

(1) ‘parties under investigation’ means the controller(s) and/or processor(s) investigated for alleged infringement of Regulation (EU) 2016/679 related to cross-border processing;

(2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned identifying the main relevant facts and the lead supervisory authority’s views on the case;

(3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties under investigation setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

(4) ‘retained relevant and reasoned objections’ means the objections which have been determined by the Board to be relevant and reasoned within the meaning of Article 4(24) of Regulation (EU) 2016/679.

Chapter II

Submission and handling of complaints

Article 3

Cross-border complaints

1. A complaint on the basis of Regulation (EU) 2016/679 that relates to cross-border processing shall provide the information required in the Form, as set out in the Annex. No additional information shall be required in order for the complaint to be admissible.

2. The supervisory authority with which the complaint was lodged shall establish whether the complaint relates to cross-border processing.

3. The supervisory authority with which the complaint was lodged shall determine the completeness of the information required by the Form within one month.

4. Upon assessment of the completeness of the information required by the Form, the supervisory authority with which the complaint was lodged shall transmit the complaint to the lead supervisory authority.

5. Where the complainant claims confidentiality when submitting a complaint, the complainant shall also submit a non-confidential version of the complaint.

6. The supervisory authority with which a complaint was lodged shall acknowledge receipt of the complaint within one week. This acknowledgement shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 3.

Article 4

Investigation of complaints

While assessing the extent appropriate to which a complaint should be investigated in each case the supervisory authority shall take into account all relevant circumstances, including all of the following:

(a) the expediency of delivering an effective and timely remedy to the complainant;

(b) the gravity of the alleged infringement;

(c) the systemic or repetitive nature of the alleged infringement.

Article 5

Amicable settlement

A complaint may be resolved by amicable settlement between the complainant and the parties under investigation. Where the supervisory authority considers that an amicable settlement to the complaint has been found, it shall communicate the proposed settlement to the complainant. If the complainant does not object to the amicable settlement proposed by the supervisory authority within one month, the complaint shall be deemed withdrawn.

Article 6

Translations

1. The supervisory authority with which the complaint was lodged shall be responsible for:

(a) translation of complaints and the views of complainants into the language used by the lead supervisory authority for the purposes of the investigation;

(b) translation of documents provided by the lead supervisory authority into the language used for communication with the complainant, where it is necessary to provide such documents to the complainant pursuant to this Regulation or Regulation (EU) 2016/679.

2. In its rules of procedure, the Board shall determine the procedure for the translation of comments or relevant and reasoned objections expressed by supervisory authorities concerned in a language other than the language used by the lead supervisory authority for the purposes of the investigation.

Chapter III

Cooperation under Article 60 of Regulation (EU) 2016/679

Section 1

Reaching consensus within the meaning of Article 60(1) of Regulation (EU) 2016/679

Article 7

Cooperation between supervisory authorities

While cooperating in an endeavour to reach a consensus, as provided for in Article 60(1) of Regulation (EU) 2016/679, supervisory authorities shall use all the means provided for in Regulation (EU) 2016/679, including mutual assistance pursuant to Article 61 and joint operations pursuant to Article 62 of Regulation (EU) 2016/679.

The provisions in this section concern the relations between supervisory authorities and are not intended to confer rights on individuals or the parties under investigation.

Article 8

Relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679

1. The lead supervisory authority shall regularly update the other supervisory authorities concerned about the investigation and provide the other supervisory authorities concerned, at the earliest convenience, with all relevant information once available.

2. Relevant information within the meaning of Article 60(1) and (3) of Regulation (EU) 2016/679 shall include, where applicable:

(a) information on the opening of an investigation of an alleged infringement of Regulation (EU) 2016/679;

(b) requests for information pursuant to Article 58(1), point (e) of Regulation (EU) 2016/679;

(c) information of the use of other investigative powers referred to in Article 58(1) of Regulation (EU) 2016/679;

(d) in the case of envisaged rejection of complaint, the lead supervisory authority’s reasons for rejection of the complaint;

(e) summary of key issues in an investigation in accordance with Article 9;

(f) information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings;

(g) preliminary findings;

(h) the response of the parties under investigation to the preliminary findings;

(i) the views of the complainant on the preliminary findings;

(j) in the case of rejection of a complaint, the written submissions of the complainant;

(k) any relevant steps taken by the lead supervisory authority after receiving the response of the parties under investigation to the preliminary findings and prior to submission of a draft decision in the sense of Article 60(3) of Regulation (EU) 2016/679.

Article 9

Summary of key issues

1. Once the lead supervisory authority has formed a preliminary view on the main issues in an investigation, it shall draft a summary of key issues for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679.

2. The summary of key issues shall include all of the following elements:

(a) the main relevant facts;

(b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which will be investigated;

(c) identification of complex legal and technological assessments which are relevant for preliminary orientation of their assessment;

(d) preliminary identification of potential corrective measure(s).

3. The supervisory authorities concerned may provide comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues.

4. Comments provided pursuant to paragraph 3 shall meet the following requirements:

(a) language used is sufficiently clear and contains precise terms to enable the lead supervisory authority, and, as the case may be, supervisory authorities concerned, to prepare their positions;

(b) legal arguments are set out succinctly and grouped by reference to the part of the summary of key issues to which they relate;

(c) the comments of the supervisory authority concerned may be supported by documents, which may supplement the comments on specific points.

5. The Board may specify in its rules of procedure restrictions on the maximum length of comments submitted by supervisory authorities concerned on the summary of key issues.

6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article shall be considered non-contentious cases. In such cases, the preliminary findings referred to in Article 14 shall be communicated to the parties under investigation within 9 months of the expiry of the deadline provided for in paragraph 3 of this Article.

Article 10

Use of means to reach consensus

1. A supervisory authority concerned shall make a request to the lead supervisory authority under Article 61 of Regulation (EU) 2016/679, Article 62 of Regulation (EU) 2016/679, or both, where, following the comments of supervisory authorities concerned pursuant to Article 9(3), a supervisory authority concerned disagrees with the assessment of the lead supervisory authority on:

(a) the scope of the investigation in complaint-based cases, including the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement which will be investigated;

(b) preliminary orientation in relation to complex legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

(c) preliminary orientation in relation to complex technological assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c).

2. The request under paragraph 1 shall be made within two months of the expiry of the period referred to in Article 9(3).

3. The lead supervisory authority shall engage with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings or, where applicable, provide the supervisory authority with which the complaint was lodged with its reasoning for the purposes of Article 11(2).

4. Where, in a complaint-based investigation, there is no consensus between the lead supervisory authority and one or more concerned supervisory authorities on the matter referred to in Article 9(2), point (b), of this Regulation, the lead supervisory authority shall request an urgent binding decision of the Board under Article 66(3) of Regulation (EU) 2016/679. In that case, the conditions for requesting an urgent binding decision under Article 66(3) of Regulation (EU) 2016/679 shall be presumed to be met.

5. When requesting an urgent binding decision of the Board pursuant to paragraph 4 of this Article, the lead supervisory authority shall provide all of the following:

(a) the documents referred to in Article 9(2), points (a) and (b);

(b) the comments of the supervisory authority concerned that disagrees with the lead supervisory authority’s preliminary identification of the scope of the investigation.

6. The Board shall adopt an urgent binding decision on the scope of the investigation on the basis of the comments of the supervisory authorities concerned and the position of the lead supervisory authority on those comments.

Section 2

Full or partial rejection of complaints

Article 11

Hearing of complainant prior to full or partial rejection of a complaint

1. Following the procedure provided for in Article 9 and 10, the lead supervisory authority shall provide the supervisory authority with which the complaint was lodged with the reasons for its preliminary view that the complaint should be fully or partially rejected.

2. The supervisory authority with which the complaint was lodged shall inform the complainant of the reasons for the intended full or partial rejection of the complaint and set a time-limit within which the complainant may make known her or his views in writing. The time-limit shall be no less than three weeks. The supervisory authority with which the complaint was lodged shall inform the complainant of the consequences of the failure to make her or his views known.

3. If the complainant fails to make known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged, the complaint shall be deemed to have been withdrawn.

4. The complainant may request access to the non-confidential version of the documents on which the proposed rejection of the complaint is based.

5. If the complainant makes known her or his views within the time-limit set by the supervisory authority with which the complaint was lodged and the views do not lead to a change in the preliminary view that the complaint should be fully or partially rejected, the supervisory authority with which the complaint was lodged shall prepare the draft decision under Article 60(3) of Regulation (EU) 2016/679 which shall be submitted to the other supervisory authorities concerned by the lead supervisory authority pursuant to Article 60(3) of Regulation (EU) 2016/679.

Article 12

Revised draft decision fully or partially rejecting a complaint

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the complainant should have the opportunity to make her or his views known, the supervisory authority with which the complaint was lodged shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the complainant with the possibility to make her or his views known on such new elements.

2. The supervisory authority with which the complaint was lodged shall set a time-limit within which the complainant may make known her or his views.

Article 13

Decision fully or partially rejecting a complaint

When adopting a decision fully or partially rejecting a complaint in accordance with Article 60(8) of Regulation (EU) 2016/679, the supervisory authority with which the complaint was lodged shall inform the complainant of the judicial remedy available to him or her in accordance with Article 78 of Regulation (EU) 2016/679.

Section 3

Decisions addressed to controllers and processors

Article 14

Preliminary findings and reply

1. When the lead supervisory authority intends to submit a draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

2. The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they must set out clearly all the facts and the entire legal assessment raised against the parties under investigation, so that they can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

The preliminary findings shall indicate corrective measures the lead supervisory authority intends to use.

Where the lead supervisory authority intends to impose a fine, it shall list in the preliminary findings the relevant elements on which it relies while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation.

4. The lead supervisory authority shall, when notifying the preliminary findings to the parties under investigation, set a time-limit within which these parties may provide their views in writing. The lead supervisory authority shall not be obliged to take into account written views received after the expiry of that time-limit.

5. When notifying the preliminary findings to the parties under investigation, the lead supervisory authority shall provide those parties with access to the administrative file in accordance with Article 20.

6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as proof of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties under investigation have been given the opportunity to comment.

Article 15

Transmission of preliminary findings to complainants

1. Where the lead supervisory authority issues preliminary findings relating to a matter in respect of which it has received a complaint, the supervisory authority with which the complaint was lodged shall provide the complainant with a non-confidential version of the preliminary findings and set a time-limit within which the complainant may make known its views in writing.

2. Paragraph 1 shall apply also when a supervisory authority, where appropriate, treats several complaints jointly, splits the complaints in several parts or in any other way exercises its discretion concerning the scope of the investigation as set out in preliminary findings.

3. Where the lead supervisory authority considers that it is necessary for the complainant to be provided with documents included in the administrative file in order for the complainant to effectively make known her or his views on the preliminary findings, the supervisory authority with which the complaint was lodged shall provide the complainant with the non-confidential version of such documents when providing the preliminary findings pursuant to paragraph 1.

4. The complainant shall be provided with the non-confidential version of the preliminary findings only for the purpose of the concrete investigation in which the preliminary findings were issued.

5. Before receiving the non-confidential version of preliminary findings and any documents provided pursuant to paragraph 3, the complainant shall send to the lead supervisory authority a confidentiality declaration, where the complainant commits himself or herself not to disclose any information or assessment made in the non-confidential version of preliminary findings or to use those findings for purposes other than the concrete investigation in which those findings were issued.

Article 16

Adoption of final decision

After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall adopt and notify its decision under Article 60(7) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Article 17

Right to be heard in relation to revised draft decision

1. Where the lead supervisory authority considers that the revised draft decision within the meaning of Article 60(5) of Regulation (EU) 2016/679 raises elements on which the parties under investigation should have the opportunity to make their views known, the lead supervisory authority shall, prior to the submission of the revised draft decision under Article 60(5) of Regulation (EU) 2016/679, provide the parties under investigation with the possibility to make their views known on such new elements.

2. The lead supervisory authority shall set a time-limit within which the parties under investigation may make known their views.

Section 4

Relevant and reasoned objections

Article 18

Relevant and reasoned objections

1. Relevant and reasoned objections within the meaning of Article 4(24) of Regulation (EU) 2016/679 shall:

(a) be based exclusively on factual elements included in the draft decision; and

(b) not change the scope of the allegations by raising points amounting to identification of additional allegations of infringement of Regulation (EU) 2016/679 or changing the intrinsic nature of the allegations raised.

2. The form and structure of relevant and reasoned objections shall meet all of the following requirements:

(a) the length of each relevant and reasoned objection and the position of the lead supervisory authority on any such objection shall not exceed three pages and shall not include annexes. In cases involving particularly complex legal issues, the maximum length may be increased to six pages, except if specific circumstances justifying a longer length are accepted by the Board;

(b) the disagreement of the supervisory authority concerned with the draft decision shall be stated at the beginning of the relevant and reasoned objection and shall be worded in sufficiently clear, coherent and precise terms to enable the lead supervisory authority, and as the case may be, supervisory authorities concerned, to prepare their positions and to enable the Board to efficiently resolve the dispute;

(c) legal arguments shall be set out and grouped by reference to the operative part of the draft decision to which they relate. Each argument or group of arguments shall generally be preceded by a summary statement.


Chapter IV

Access to the administrative file and treatment of confidential information

Article 19

Content of the administrative file

1. The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 consists of all documents which have been obtained, produced and/or assembled by the lead supervisory authority during the investigation.

2. In the course of investigation of an alleged infringement of Regulation (EU) 2016/679, the lead supervisory authority may return to the party from which they have been obtained documents which following a more detailed examination prove to be unrelated to the subject matter of the investigation. Upon return, these documents shall no longer constitute part of the administrative file.

3. The right of access to the administrative file shall not extend to correspondence and exchange of views between the lead supervisory authority and supervisory authorities concerned. The information exchanged between the supervisory authorities for the purpose of the investigation of an individual case are internal documents and shall not be accessible to the parties under investigation or the complainant.

4. Access to relevant and reasoned objections pursuant to Article 60(4) of Regulation (EU) 2016/679 shall be provided in accordance with Article 24.

Article 20

Access to the administrative file and use of documents

1. The lead supervisory authority shall grant access to the administrative file to the parties under investigation, enabling them to exercise their right to be heard. Access to the administrative file shall be granted after the lead supervisory authority notifies the preliminary findings to the parties under investigation.

2. The administrative file shall include all documents, inculpatory and exculpatory, including facts and documents which are known to the parties under investigation.

3. The conclusions of the lead supervisory authority in the draft decision under Article 60(3) of Regulation (EU) 2016/679 and the final decision under Article 60(7) of Regulation (EU) 2016/679 may only rely on documents cited in the preliminary findings or on which the parties under investigation had the opportunity to make their views known.

4. Documents obtained through access to the administrative file pursuant to this Article shall be used only for the purposes of judicial or administrative proceedings for the application of Regulation (EU) 2016/679 in the specific case for which such documents were provided.

Article 21

Identification and protection of confidential information

1. Unless otherwise provided in this Regulation, information collected or obtained by a supervisory authority in cross-border cases under of Regulation (EU) 2016/679, including any document containing such information, shall not be communicated or made accessible by the supervisory authority in so far as it contains business secrets or other confidential information of any person.

2. Any information collected or obtained by a supervisory authority in cross-border cases under Regulation (EU) 2016/679, including any document containing such information, is excluded from access requests under laws on public access to official documents as long as the proceedings are ongoing.

3. When communicating preliminary findings to parties under investigation and providing for access to the administrative file on the basis of Article 20, the lead supervisory authority shall ensure that the parties under investigation to whom access is being given to information containing business secrets or other confidential information treat such information with utmost respect for its confidentiality and that such information is not used to the detriment of the provider of the information. Depending on the degree of confidentiality of the information, the lead supervisory authority shall adopt appropriate arrangements to give full effect to the rights of defence of the parties under investigation with due regard for the confidentiality of the information.

4. An entity submitting information that it considers to be confidential shall clearly identify the information which it considers to be confidential, giving reasons for the confidentiality claimed. The entity shall provide a separate non-confidential version of the submission.

5. Without prejudice to paragraph 4, the lead supervisory authority may require the parties under investigation, or any other party which produces documents pursuant to Regulation (EU) 2016/679, to identify the documents or parts of documents which they consider to contain business secrets or other confidential information belonging to them and to identify the parties for which these documents are considered to be confidential.

6. The lead supervisory authority may set a time-limit for parties under investigation and any other party raising a confidentiality claim to:

(a) substantiate their claims for business secrets and other confidential information for each individual document or part of document, statement, or part of statement;

(b) provide a non-confidential version of the documents and statements, in which the business secrets and other confidential information are redacted;

(c) provide a concise, non-confidential, description of each piece of redacted information.

7. If the parties under investigation or any other party fails to comply with paragraphs 4 and 5, the lead supervisory authority may assume that the documents or statements concerned do not contain business secrets or other confidential information.

Chapter V

Dispute resolution

Article 22

Referral to dispute resolution under Article 65 of Regulation (EU) 2016/679

1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679.

2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following documents:

(a) the draft decision or revised draft decision subject to the relevant and reasoned objections;

(b) a summary of the relevant facts;

(c) the preliminary findings;

(d) view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;

(e) views made in writing by complainants, as the case may be, pursuant to Articles 11, 12, and 15;

(f) the relevant and reasoned objections which were not followed by the lead supervisory authority;

(g) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or considered the objections not to be relevant or reasoned.

3. The Board shall within four weeks of receiving the documents listed in paragraph 2 identify retained relevant and reasoned objections.

Article 23

Registration in relation to a decision under Article 65(1), point (a), of Regulation (EU) 2016/679

The Chair of the Board shall register the referral of a subject-matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679 no later than one week after having received all of the following documents:

(a) the draft decision or revised draft decision subject to the relevant and reasoned objections;

(b) a summary of the relevant facts;

(c) view made in writing by the parties under investigation, as the case may be, pursuant to Articles 14 and 17;

(d) views made in writing by complainants, as the case may be, pursuant to Articles 11, 12 and 15;

(e) the retained relevant and reasoned objections;

(f) the reasons on the basis of which the lead supervisory authority did not follow the retained relevant and reasoned objections.

Article 24

Statement of reasons prior to adoption of decision under Article 65(1), point (a), of Regulation (EU) 2016/679

1. Prior to adopting the binding decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679, the Chair of the Board shall, through the lead supervisory authority, provide the parties under investigation and/or, in the case of full or partial rejection of a complaint, the complainant, with a statement of reasons explaining the reasoning the Board intends to adopt in its decision. Where the Board intends to adopt a binding decision requiring the lead supervisory authority to amend its draft decision or revised draft decision, the Board shall decide whether such statement of reasons should be accompanied by the retained relevant and reasoned objections on the basis of which the Board intends to adopt its decision.

2. The parties under investigation and/or, in the case of full or partial rejection of a complaint, the complainant, shall have one week from receipt of the statement of reasons referred to in paragraph 1 to make their views known.

3. The deadline in paragraph 2 shall be extended by one week where the Board extends the period for adoption of the binding decision in accordance with Article 65(2) of Regulation (EU) 2016/679.

4. The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall not run during the periods provided for in paragraphs 2 and 3.

Article 25

Procedure in relation to decision under Article 65(1), point (b), of Regulation (EU) 2016/679

1. When referring a subject-matter to the Board under Article 65(1), point (b), of Regulation 2016/679, the supervisory authority referring the subject-matter regarding the competence for the main establishment shall provide the Board with all of the following documents:

(a) a summary of the relevant facts;

(b) the assessment of these facts as far as the conditions of Article 56(1) of Regulation (EU) 2016/679 are concerned;

(c) views made by the controller or processor whose main establishment is the subject of the referral;

(d) the views of other supervisory authorities concerned by the referral;

(e) any other document or information the referring supervisory authority considers relevant and necessary in order to find a resolution on the subject-matter.

2. The Chair of the Board shall register the referral no later than one week after having received the documents referred to in paragraph 1.

Article 26

Procedure in relation to decision under Article 65(1), point (c), of Regulation (EU) 2016/679

1. When referring a subject-matter to the Board under Article 65(1), point (c), of Regulation 2016/679, the supervisory authority referring the subject-matter or the Commission shall provide the Board with all of the following documents:

(a) a summary of the relevant facts;

(b) the opinion, as the case may be, issued by the Board pursuant to Article 64 of Regulation (EU) 2016/679;

(c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679.

2. The Chair of the Board shall request the following documents:

(a) the views of the supervisory authority alleged to have breached the requirement to communicate a draft decision to the Board or to have failed to follow an opinion of the Board;

(b) any other document or information the supervisory authority considers relevant and necessary in order to find a resolution on the subject-matter.

If any supervisory authority declares a need to submit its views on the referred subject-matter, it shall submit those views within two weeks of the referral referred to in paragraph 1.

3. The Chair of the Board shall register the referral no later than one week after having received the documents referred to in paragraphs 1 and 2.

Chapter VI

Urgency procedure

Article 27

Urgent opinions under Article 66(2) of Regulation (EU) 2016/679

1. A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks prior to the expiry of provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679 and shall contain all of the following items:

(a) a summary of the relevant facts;

(b) a description of the provisional measure adopted on its own territory, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(c) a justification of the urgent need for final measures to be adopted on the territory of the Member State of the requesting supervisory authority, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

2. The urgent opinion of the Board shall be addressed to the supervisory authority that submitted the request. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the requesting authority to maintain or amend its provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

Article 28

Urgent decisions under Article 66(2) of Regulation (EU) 2016/679

1. A request for an urgent decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks prior to the expiry of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

(a) a summary of the relevant facts;

(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting the provisional measures, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

(c) information on any investigatory measures taken on its own territory and replies received from the local establishment of the parties under investigation or any other information in the possession of the requesting supervisory authority;

(d) a justification of the urgent need for final measures to be adopted on the territory of the requesting supervisory authority, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to respond to a request under Article 61(3) or 62(2) of Regulation (EU) 2016/679;

(e) where the requesting authority is not the lead supervisory authority, the views of the lead supervisory authority;

(f) where applicable, the views of the local establishment of the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

2. The urgent decision referred to in paragraph 1 shall be addressed to the supervisory authority that submitted the request and shall enable the requesting authority to maintain or amend its provisional measure.

3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

4. The supervisory authority that submitted the request referred to in paragraph 1 shall notify its decision on the final measures to the establishment of the controller or processor on the territory of its Member State and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the lead supervisory authority of the final measure.

5. Where the urgent binding decision indicates that final measures do not urgently need to be adopted, the lead and supervisory authorities concerned shall follow the procedure in Article 60 of Regulation (EU) 2016/679.

Chapter VII

General and final provisions

Article 29

Beginning of time periods and definition of working day

1. Time-limits provided for in or fixed by the supervisory authorities pursuant to Regulation (EU) 2016/679 shall be calculated in accordance with Regulation (EEC, Euratom) No 1182/71 of the Council17.

2. Time periods shall begin on the working day following the event to which the relevant provision of Regulation (EU) 2016/679 or this Regulation refers.

Article 30

Transitional provisions

Chapters III and IV shall apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation.

Chapter V shall apply to all cases submitted to dispute resolution under Article 65 of Regulation (EU) 2016/679 after the entry into force of this Regulation.

Article 31

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.