EU provisional agreement on cross-border GDPR enforcement reform

The Council of the EU and the European Parliament have reached a provisional agreement to strengthen the enforcement of cross-border cases. This reform addresses long-standing inefficiencies in handling complaints and aims to make the process faster, more transparent, and more effective for individuals.

💡 Key highlights:

🔹 Admissibility: All data protection authorities (DPAs) will assess complaints using harmonized criteria, avoiding inconsistent decisions between Member States.

🔹 Rights of complainants and parties under investigation: If a complaint is rejected, there is a requirement for the complainant to be heard. Moreover, the complainant and the parties under investigation will be informed of preliminary findings and allowed to submit their comments.

🔹 Early resolution mechanism: If the party under investigation remedies the issue and the complainant agrees, the case can be closed early without a full formal process.

🔹 Simple cooperation procedure: To streamline the GDPR enforcement, the new reform promotes early consensus by requiring the lead DPA to share a summary of key issues with their counterparts in the EU. This procedure also enables faster resolution by avoiding the application of the additional rules in straightforward cases and reducing administrative burdens.

🔹 Clear deadlines:

• Overall investigation deadline of 15 months, with a 12-month extension for the most complex cases
• The simple cooperation procedure must be completed within 12 months.

🧬 Potential Impact on the Life Sciences Sector: For the Life Sciences sector, this reform represents a major shift in the handling of cross-border data protection complaints. Companies in this field, often engaged in complex processing of sensitive health data across the EU, will benefit from clearer and faster procedures, reducing the risk of prolonged legal uncertainty. Strengthened cooperation between supervisory authorities and the introduction of defined deadlines could also support better planning of corrective actions and help mitigate reputational and operational impacts in the event of an investigation.

At MyData-TRUST, we are closely monitoring this reform and its practical implications for stakeholders in healthcare, clinical research, and biotechnology. If you have any questions about what this means for your organization or cross-border Data Privacy activities, our team is here to support you.

PS: The new rules will enter into force following final adoption by the Council of the EU and the European Parliament.

Source: The Council of EU Press Release