Article 32eb

Article 32eb

Collective negotiation in good faith

1.Where a data expert representative recognised approaches a data controller to negotiate the terms under which personal data shall be processed for a defined or ascertainable group of data holders, the data controller is under an obligation to engage in good faith upon being notified of the mandate to negotiate.

2.The obligation to negotiate in good faith does not impose a legal obligation upon the data controller to reach an agreement, and is without prejudice to its freedom to determine the terms, scope or other essential parameters of the services that it provides. It does, however, require the data controller to respond in good faith to proposals advanced by the data expert representative, to make available the information reasonably necessary to permit an informed negotiation, subject to the protection of trade secrets in accordance with Directive (EU) 2016/943 and Articles 4(8) and 5(11) of this Regulation, and to refrain from engaging in conduct that would subvert the course of those negotiations.

3.Where negotiations have been ongoing for a period of four months and have not resulted in an agreement, either party may refer the matter to non-binding mediation before the competent authority designated under Article 32b or before a body designated by it for this purpose. Where mediation has not resulted in agreement within a further period of two months, either party may refer the matter to binding arbitration, which shall be conducted on a ‘final-offer’ basis unless the parties agree otherwise.

4.This Article does not apply to micro-enterprises or small enterprises within the meaning of Article 2 of the Annex to Recommendation 2003/361/EC.

5.Member States shall ensure that breaches of the obligation in paragraph 1 are subject to effective, proportionate and dissuasive sanctions, in accordance with Article 40 of this Regulation.

6.Where terms have been negotiated between a data controller and an data expert representative acting pursuant to a valid mandate, those terms shall give rise to a rebuttable presumption that the best interests of the data holders represented have been respected in the processing of their personal and shall be made available by the data controller as machine-readable negotiated terms.