Regulation (EU) 2016/679 — Article 57

Article total: 7 parts · 4 Council drafts · 8 Parliament amendments

Tracked part

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to GDPR

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 4 May 2016, with the Commission proposal change affecting this article applied.

Removed by the proposal: Article 57(1)(k).

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  ~~establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);~~
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Commission source wording and instructions

Article 57(1)(k)

Commission proposal

11. In Article 57(1) is amended as follows: (a) point (k) is deleted;

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

Council document

View full Council comparison →

Article in May Presidency compromise Council text

Comparison basis: Existing law (4 May 2016) compared with May Presidency compromise (21 May 2026)

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  ~~establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);~~
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those requests can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Article 57(1)(k)

May Presidency compromise

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows:

(a)

in paragraph 1, point (k) is deleted;

(ab)

paragraph 4 is replaced by the following;

'4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those requests can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.'

View full Council comparison →

Article in June Presidency compromise · 10 June Council text

Comparison basis: Existing law (4 May 2016) compared with June Presidency compromise · 10 June (10 June 2026)

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  ~~establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);~~
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Article 57(1)(k)

June Presidency compromise · 10 June

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows:

(a)

in paragraph 1, point (k) is deleted;

(ab)

paragraph 4 is replaced by the following;

'4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.'

View full Council comparison →

Article in June Presidency compromise · 18 June Council text

Comparison basis: Existing law (4 May 2016) compared with June Presidency compromise · 18 June (18 June 2026)

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  ~~establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);~~
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Article 57(1)(k)

June Presidency compromise · 18 June

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows:

(a)

in paragraph 1, point (k) is deleted;

(ab)

paragraph 4 is replaced by the following;

'4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.'

View full Council comparison →

Article in September Presidency compromise Council text

Comparison basis: Existing law (4 May 2016) compared with September Presidency compromise (3 September 2026)

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  ~~establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);~~
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Article 57(1)(k)

September Presidency compromise

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows: (a) in paragraph 1, point (k) is deleted; (ab) paragraph 4 is replaced by the following; '4. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Article 57(1)(k) 4 Council drafts

Article 57(1)(k)

21 May 2026 · May Presidency compromise

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows:

(a)

in paragraph 1, point (k) is deleted;

(ab)

paragraph 4 is replaced by the following;

'4.

Article 57(1)(k)

10 June 2026 · June Presidency compromise · 10 June

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows:

(a)

in paragraph 1, point (k) is deleted;

(ab)

paragraph 4 is replaced by the following;

'4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.'

Article 57(1)(k)

18 June 2026 · June Presidency compromise · 18 June

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

11. Article 57 is amended as follows:

(a)

in paragraph 1, point (k) is deleted;

(ab)

paragraph 4 is replaced by the following;

'4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character or where an abusive intention on the part of the data subject submitting those request can be demonstrated, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall, in the light of all the relevant circumstances of the case, bear the burden of demonstrating the manifestly unfounded or excessive character of the request.'

Article 57(1)(k)

3 September 2026 · September Presidency compromise

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

Search amendments

Remove proposed wording Amendment 400 IMCO

~~11. In Article 57(1) is amended as follows: (a) point (k) is deleted;~~

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Remove proposed wording Amendment 1310 ITRE · LIBE

~~11. In Article 57(1) is amended as follows: (a) point (k) is deleted;~~

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (k)
  
  establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Additional proposed wording Amendment 1312 ITRE · LIBE

(aa) In Article 57, paragraph 1, the following point aa is inserted

(aa)

handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (aa)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80 and investigate, in the case of a complaint by a data subject at its discretion, to the extent approriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisor authority is necessary;'
3. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
4. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
5. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
6. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
7. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
8. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
9. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
10. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
11. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
12. (l)
  
  give advice on the processing operations referred to in Article 36(2);
13. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
14. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
15. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
16. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
18. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
19. (s)
  
  approve binding corporate rules pursuant to Article 47;
20. (t)
  
  contribute to the activities of the Board;
21. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
22. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Alternative wording Amendment 1313 ITRE · LIBE

(aa) In Article 57, paragraph 1, point d is amended as follows:

(d) promote the awareness of controllers and processors of their obligations under this Regulation;, and in doing so due regard is given to the principle of proportionality, taking into account the nature, scope, context, risk, and purposes of the processing, while coordinating, where applicable, with the relevant competent sectoral authorities."

Justification

INNOVATION PACKAGE #2: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;, and in doing so due regard is given to the principle of proportionality, taking into account the nature, scope, context, risk, and purposes of the processing, while coordinating, where applicable, with the relevant competent sectoral authorities."
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (l)
  
  give advice on the processing operations referred to in Article 36(2);
12. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
13. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
14. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
15. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
16. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
18. (s)
  
  approve binding corporate rules pursuant to Article 47;
19. (t)
  
  contribute to the activities of the Board;
20. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
21. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Additional proposed wording Amendment 1314 ITRE · LIBE

(ab) In Article 57, paragraph 1, the following point va is added

(va)

set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (l)
  
  give advice on the processing operations referred to in Article 36(2);
12. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
13. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
14. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
15. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
16. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
18. (s)
  
  approve binding corporate rules pursuant to Article 47;
19. (t)
  
  contribute to the activities of the Board;
20. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
21. (v)
  
  fulfil any other tasks related to the protection of personal data.
22. (va)
  
  set up regulatory sandboxes to facilitate testing the compliance of specific techniques or technological solutions to be used for the data processing activities with the obligations under this Regulation or whether the data processing results in data that would be exempt from this Regulation.'
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Alternative wording Amendment 1315 ITRE · LIBE

~~handle~~(ab) ~~complaints~~In ~~lodged~~Article ~~by a data subject~~57, orparagraph ~~by a body~~1, ~~organisation~~point orf ~~association~~is amended:

(f) in ~~accordance~~handling ~~with Article 80~~complaints, ~~and~~the ~~investigate,~~supervisory authority may determine the order of priority according to the ~~extent appropriate, the subject matter~~seriousness of the ~~complaint~~alleged infringement and ~~inform~~its impact on the ~~complainant~~rights of ~~the~~data ~~progress~~subjects, and ~~the~~may ~~outcome~~allocate ofits ~~the~~investigative ~~investigation~~resources ~~within a reasonable period~~accordingly, inprovided ~~particular~~that ifeach ~~further~~complaint ~~investigation~~is ~~or coordination~~handled with ~~another~~due ~~supervisory authority is necessary~~diligence;"

Justification

INNOVATION PACKAGE #3: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  ~~handle~~in handling complaints ~~lodged by a data subject~~, orthe bysupervisory aauthority ~~body,~~may ~~organisation~~determine orthe ~~association~~order inof ~~accordance~~priority ~~with Article 80, and investigate,~~according to the ~~extent appropriate, the subject matter~~seriousness of the ~~complaint~~alleged infringement and ~~inform~~its impact on the ~~complainant~~rights of ~~the~~data ~~progress~~subjects, and ~~the~~may ~~outcome~~allocate ofits ~~the~~investigative ~~investigation~~resources ~~within a reasonable period~~accordingly, inprovided ~~particular~~that ifeach ~~further~~complaint ~~investigation~~is ~~or coordination~~handled with ~~another~~due ~~supervisory authority is necessary~~diligence;"
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (l)
  
  give advice on the processing operations referred to in Article 36(2);
12. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
13. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
14. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
15. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
16. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
18. (s)
  
  approve binding corporate rules pursuant to Article 47;
19. (t)
  
  contribute to the activities of the Board;
20. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
21. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Alternative wording Amendment 1316 ITRE · LIBE

11a. In Article 57, paragraph 2 is amended as follows:

2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form. ~~which~~Supervisory ~~can~~authority ~~also~~may beestablish ~~completed~~the ~~electronically,~~mandatory ~~without~~use ~~excluding~~of electronical forms and set up conditions for other means of communication in exceptional cases."

Justification

INNOVATION PACKAGE #4: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (l)
  
  give advice on the processing operations referred to in Article 36(2);
12. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
13. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
14. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
15. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
16. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
18. (s)
  
  approve binding corporate rules pursuant to Article 47;
19. (t)
  
  contribute to the activities of the Board;
20. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
21. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form. ~~which~~Supervisory ~~can~~authority ~~also~~may beestablish ~~completed~~the ~~electronically,~~mandatory ~~without~~use ~~excluding~~of electronical forms and set up conditions for other means of communication in exceptional cases."
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Additional proposed wording Amendment 1317 ITRE · LIBE

11b.

In Article 57, the following paragraphs are added:

4a.

In fullfilling their tasks supervisory authorities shall take into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. They must have inter alia regard of the following as far as relevant in the specific circumstances:

(a)

the desirability of promoting innovation;

(b)

the desirability of promoting competition;

(c)

the importance of the prevention, investigation, detection and prosecution of criminal offences;

(d)

the need to safeguard public security and national security;

(e)

the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.

4b.

Supervisory authorities shall, where appropriate, consult and cooperate on national and Union as well as in appropriate cross-border procedures with other regulatory bodies, whose regulatory tasks and powers might are related to the protection of personal data and the free flow of personal data within the Union. When consulting those and cooperating with those other regualtory bodies supervisory authorities praticularly shall take into account the matters according to paragraph 5. The Commission may adopt, by means of an implementing act, procedural rules for the sharing of personal data, business secrets, purpose limititation and other procedural aspects necessary to ensure professional secrecy.

4c.

Supervisory authority shall establish a permanent panel of stakeholder representatives to ensure that they fulfill their tasks, especially regarding the matters described in paragraph 4 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal data, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency.

Justification

INNOVATION PACKAGE #5: Makes the GDPR’s broad protection more proportionate in practice. It clarifies that principles, guidance, complaints and enforcement must reflect actual risk, legal certainty and the balance required by Recital 4. Supervisory authorities and the EDPB should prioritise serious infringements, coordinate with sectoral regulators, involve stakeholders and avoid guidance that creates new obligations. A Data Protection Data Space improves transparency, evidence-based supervision and consistent application across the Union.

Preview
against:

Article 57

Tasks

1.
Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:
1. (a)
  
  monitor and enforce the application of this Regulation;
2. (b)
  
  promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
3. (c)
  
  advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;
4. (d)
  
  promote the awareness of controllers and processors of their obligations under this Regulation;
5. (e)
  
  upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;
6. (f)
  
  handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
7. (g)
  
  cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;
8. (h)
  
  conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
9. (i)
  
  monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;
10. (j)
  
  adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);
11. (l)
  
  give advice on the processing operations referred to in Article 36(2);
12. (m)
  
  encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);
13. (n)
  
  encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);
14. (o)
  
  where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);
15. (p)
  
  draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
16. (q)
  
  conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;
17. (r)
  
  authorise contractual clauses and provisions referred to in Article 46(3);
18. (s)
  
  approve binding corporate rules pursuant to Article 47;
19. (t)
  
  contribute to the activities of the Board;
20. (u)
  
  keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and
21. (v)
  
  fulfil any other tasks related to the protection of personal data.
2.

Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.
3.

The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
4.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the supervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
4a.
In fullfilling their tasks supervisory authorities shall take into account that the right to the protection of personal data is not an absolute right and must be considered in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality. They must have inter alia regard of the following as far as relevant in the specific circumstances:
1. (a)
  
  the desirability of promoting innovation;
2. (b)
  
  the desirability of promoting competition;
3. (c)
  
  the importance of the prevention, investigation, detection and prosecution of criminal offences;
4. (d)
  
  the need to safeguard public security and national security;
5. (e)
  
  the fact that children merit specific protection with regard to their personal data because they may be less aware of the risks and consequences associated with processing of personal data and of their rights in relation to such processing.
4b.

Supervisory authorities shall, where appropriate, consult and cooperate on national and Union as well as in appropriate cross-border procedures with other regulatory bodies, whose regulatory tasks and powers might are related to the protection of personal data and the free flow of personal data within the Union. When consulting those and cooperating with those other regualtory bodies supervisory authorities praticularly shall take into account the matters according to paragraph 5. The Commission may adopt, by means of an implementing act, procedural rules for the sharing of personal data, business secrets, purpose limititation and other procedural aspects necessary to ensure professional secrecy.
4c.

Supervisory authority shall establish a permanent panel of stakeholder representatives to ensure that they fulfill their tasks, especially regarding the matters described in paragraph 4 duely and monitor relevant developments, insofar as they have an impact on the protection of personal data and the free flow of personal data, in particular the development of information and communication technologies and commercial practices. The Commission may adopt, by means of an implementing act, rules for the appointement and the statue oft he members oft he panel and procedural requirements which ensure professional secrecy and transparency.

Article in May Presidency compromise Council text

Article in June Presidency compromise · 10 June Council text

Article in June Presidency compromise · 18 June Council text

Article in September Presidency compromise Council text

Changes in context

Wording reproduced in the amendment

Amendment 1310 · ITRE–LIBE amendments 1261–1564 to the draft report: removal

Changes in context

Wording reproduced in the amendment

Amendment 400 · IMCO amendments 329–532 to the draft opinion: removal

Changes in context

Wording reproduced in the amendment

Amendment 1313 · ITRE–LIBE amendments 1261–1564 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 1315 · ITRE–LIBE amendments 1261–1564 to the draft report

Changes in context

Wording reproduced in the amendment

Amendment 1316 · ITRE–LIBE amendments 1261–1564 to the draft report