Version 2.0 - Adopted on 12 May 2022

Version history

The European Data Protection Board Having regard to Article 70(1)(e) of the Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, (hereinafter “GDPR”), Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018,

Having regard to Article 12 and Article 22 of its Rules of Procedure, HAS ADOPTED THE FOLLOWING GUIDELINES

1 SCOPE AND AIM

1. Practice has shown that many supervisory authorities (hereinafter “SAs”) apply the instrument of amicable settlement when dealing with complaints. It is as well noticeable that there are diverse variations of amicable settlements and that they are therefore handled differently by SAs due to differing domestic legislations. The GDPR uses the term “amicable settlement” only in Recital 131 GDPR in reference to the handling of local cases under Article 56(2) GDPR, but does not explicitly limit the possibilities to facilitate such local cases. The resulting lacuna in regulation of amicable settlements for non-local cases has been filled in divergent ways, some by way of Member State law, others by way of interpretation. Given these different interpretations and given the differing national laws governing complaint handling and amicable settlements (if at all present), the practical implementation of the instrument of amicable settlements differs considerably among Member States.
2. The powers of the SAs should be exercised in accordance with specific requirements in their Member State procedural law. This applies also to the handling of cases. However, national procedural law must comply with the principles of equivalence and effectiveness and may hence not render excessively difficult or practically impossible the exercise of the rights conferred by EU law (i.e. the GDPR). Through these Guidelines, the EDPB therefore seeks to provide best practices for a consistent application of the GDPR at national and EU level, to the extent appropriate for the application of the instrument of amicable settlement, taking into account the various national procedural legislations – insofar as such an instrument has been implemented explicitly – the procedure of the OSS mechanism under the GDPR, and the technical environment (IMI).
3. Cases handled by SAs can have origins other than complaints, for example cases based on media reports or ex officio investigations. However, the present guidance will address the practical implementation of amicable settlements only for cases that originated as a complaint from a data subject since the possibility of a settlement postulates the existence of a dispute between two entities, in this case the complaint lodged by a data subject against a data controller (see also paragraph 2.1 below). Furthermore, such complaints can be divided into (i) national cases without cross-border character, (ii) cases where the OSS mechanism applies because the case is cross-border in nature, and (iii) cross-border cases that are handled locally pursuant to Article 56(2) GDPR. Again, even though practice shows that amicable settlements are a possible course of action for all situations, the present guidance will mainly address those complaints that are cross-border in nature.

2 DEFINITION OF THE TERM “AMICABLE SETTLEMENT”

2.1 General context

1. The GDPR does not define the meaning of the term “amicable settlement” and only refers to this expression in Recital 131. The most relevant meanings of “settlement” are “an arrangement” and “an official agreement intended to resolve a dispute or conflict”. The Oxford English Dictionary explains the adjective “amicable” as “characterised by friendliness and absence of discord”.
2. The way amicable settlements are defined more generally in the legal profession and throughout other international documents provides some preliminary guidance for determining the definition of amicable settlements. For example, the International Chamber of Commerce (“ICC”) provides a range of dispute resolution procedures that may be considered “amicable settlements”. The principle amicable settlement procedure at the ICC appears to be mediation, which is described as a “flexible and consensual technique in which a neutral facility helps the parties reach a negotiated settlement of their disputes.” According to the ICC, such settlements achieved through mediation are contractually binding and widely enforceable. The World Trade Organization (“WTO”) uses amicable settlements as “mutually agreed solutions”, which constitutes a “negotiated solution” between the involved parties that allows for swift and tailored solution of a dispute. Moreover, the European Union Intellectual Property Office (“EUIPO”) refers to amicable settlements as a “process outside of the court resulting in a solution negotiated between the parties […] through mediation”. The European Consumer Center (“ECC”) also refers to amicable settlements as a form of “alternative dispute resolution procedures”, as laid down in the Directive on alternative dispute resolution for consumer disputes, as procedures that are “provided by neutral out-of-court bodies such as conciliators, mediators, arbitrators, the ombudsman and complaints boards”, and in which “consumers and businesses attempt to resolve a dispute jointly […] by hearing both parties, examining the legal situation, discussing possible solutions and finally making a proposal for arbitration”.
3. All in all, it appears that amicable settlements generally refer to alternative dispute resolutions through proceedings that result in the cordial closure of a case. Whereas a settlement between the parties is the outcome, the proceeding itself follows an amicable approach. The procedures can range from party-to-party negotiations to formal mediations and even facilitated conciliation practices.

2.2 GDPR context

1. In the context of complaint handling by data protection authorities, most Member States see amicable settlements as a process of “alternative dispute resolution”. In most cases, the amicable settlement is facilitated where a complaint is lodged with the SA concerning the alleged violation of the GDPR, in particular concerning data subjects’ rights, to resolve the case in the data subjects’ favour. In such cases, the settlement is to be reached between the controller and the data subject, under the supervision of the SA, which moderates the course of events. Thus, the SA acts as a sort of facilitator of the process aimed at settling the complaint. The SA, unlike an actual “mediator”, takes an active part in the proceeding as it still has to fulfil its obligations as SA and is therefore required to handle the complaint, to investigate the subject matter of the complaint with its specifics to an appropriate extent, and to inform the data subject on the progress or the outcome regarding the complaint.
2. Given the relative silence of the GDPR on amicable settlements, which alternative dispute resolution process is followed and the requirements and conditions that govern that process, will largely depend on each particular Member State’s law and policy. An analysis of standing practice shows that, when dealing with amicable settlements, the majority of the national legal systems include the receiving SA, the controller (or processor) and the data subject in the proceeding, as well as, if applicable, also the Lead Supervisory Authority (LSA).
3. It should be noted that in some Member States, the data subject is not a party to the administrative proceedings against the controller. In such Member States, the SA may use a similar dispute resolution process to what is described in these Guidelines and close a case if it deems that the controller has fulfilled the claims, but without hearing the data subject. Such resolution processes will however not be addressed in these Guidelines.
4. Amicable settlements are mainly regarded to be possible at any stage of a proceeding, even though some SAs indicate that they are only possible in the early stages of case consideration, before any other action has been taken. In some Member States, amicable settlements are only applicable in local cases, due to the fact that the GDPR uses this term only in Recital 131 GDPR, where an approach by the Concerned Supervisory Authority (”CSA”) in local cases is described accordingly. However, the majority of the SAs declare the instrument of an amicable settlement permissible in any kind of cases, regardless of their cross-border or otherwise local nature.
5. Regarding Recital 131 GDPR , the scope for such agreements is limited to cases in which the CSA receiving the complaint finds that the concrete subject matter or the possible infringement concerns only processing activities of the controller or processor in the Member State where the complaint has been lodged, or (likely) does not substantially affect data subjects in other Member States. The choice whether to seek an amicable settlement should then include, as the Recital states, (i) the specific processing carried out in the territory of the Member State or with regard to data subjects on the territory of that Member State, (ii) processing that is carried out in the context of an offer of goods or services specifically aimed at data subjects in the territory of the Member State, or (iii) processing that has to be assessed taking into account relevant legal obligations under Member State law. Legislations explicitly allowing amicable settlements, on the other hand, may not be limited to these requirements.