European Digital Rights

Problems identified Suggested solutions Concrete case – illustration – reference – link Topic 1 - FILING OF A COMPLAINT Lack of harmonised and unique complaint form A common complaint template should be decided for all SAs in all languages used by the SAs. Lack of information on access/ accessibility to the SA and the relevant page to file the complaint (finding the right SA, general lack of awareness) EDPB should make available 1 single online page with practical information for data subjects to know which DPA they can contact, with links to all DPAs and their specific pages for submitting complaints. It could also be an interactive page in which the data subject states where they live/work, where they believe the controller/processor are established, etc, and the page gives the different possibilities.

…where they believe the controller/processor are established, etc, and the page gives the different possibilities. https://www.accessnow.org/cms/ assets/uploads/2022/07/GDPR-C omplaint-study.pdf, page 51 Lack of clarity on the website on where to send a complaint or how Each SA should provide a link to a harmonised form to file a complaint on the first page of their website with a clearly noticeable icon/section called “file a complaint”. https://www.accessnow.org/cms/ assets/uploads/2022/07/GDPR-C omplaint-study.pdf p-39 to 43 Complaint forms do not always provide the possibility to send all attachments and evidence Some SAs do not allow submitting more than a certain amount of attachments or files above a certain size, which limits the complainant who wants to attach evidence or other relevant documents to the complaint.

…a certain size, which limits the complainant who wants to attach evidence or other relevant documents to the complaint. The EDPB should make available one single online page with practical information for data subjects to know which SA they can contact, with links to all SAs and their specific pages for submitting complaints. It could also be an interactive page in which the data subject states where they live/work, where they believe the controller/processor are established, etc, and the page gives the different possibilities. This page could be promoted so data controllers can link to it in their data protection notices.

…possibilities. This page could be promoted so data controllers can link to it in their data protection notices. Not always possible to send complaints or to communicate with the authorities by email NGOs sending complaints usually use the same template or submit multiple complaints and it would be easier to send these complaints to dedicated email addresses where complaints can be sent. SAs should guarantee they facilitate the submission of complaints also by making sure that all relevant documents for the complaint can easily be shared with the SA, for instance by submitting it through different means (e.g. an email address where complaints and attachments can be sent, or a form allowing to attach any electronic format without maximum number of attachments). European Digital Rights | 12 Rue Belliard, 1040 Bruxelles, Belgium | Tel. +32 2 274 25 70 | www.edri.org Ref.

European Digital Rights | 12 Rue Belliard, 1040 Bruxelles, Belgium | Tel. +32 2 274 25 70 | www.edri.org Ref. Ares(2023)2100474 - 23/03/2023 Loss of complaints After having sent a complaint, the complainants do not always receive an acknowledgement of receipt. SAs should always send an acknowledgement of receipt of the complaint with a reference number. In some cases (e.g. Bulgaria), the SA stated that no complaint was received, whereas an email was sent and indicated as “read” by the recipient. Different criteria to file a complaint depending on the country The same complaint filed in different countries can be accepted by some SAs but rejected by others on different grounds (lack of residency in the country of the SA, not sending a prior request to the controller, lack of identification of legal grounds in the complaint).

…of the SA, not sending a prior request to the controller, lack of identification of legal grounds in the complaint). All SAs should apply the EDPB guidelines on admissibility criteria. Besides, existing national rules should be examined by the Commission to make sure that they do not conflict with the GDPR. The complainant should not be required to identify the specific legal grounds in the complaint since this makes it an obstacle to file a complaint for non-lawyers. SAs should have a clear list of minimum elements to be mentioned in the complaint and reflect it in the complaint form (e.g. indicating if the information is necessary or not). In case an SA considers itself not competent to handle a complaint, the legal reasons for that should be expressly mentioned. SAs should investigate GDPR aspects, even if ePrivacy falls within the competence of another authority.

…mentioned. SAs should investigate GDPR aspects, even if ePrivacy falls within the competence of another authority. See: https://www.accessnow.org/cms/ assets/uploads/2022/07/GDPR-C omplaint-study.pdf pages 43 to 48 When the SA is not competent (no territorial jurisdiction or not competent for another reason) the SA does not always refer the complainant to the competent authority In such cases, the complainants might not know where to redirect their complaints. SAs should always send a complaint to the competent authority and inform the complainant about this action so that they do not have to guess what the competent authority is. See case in Spain where the AEPD rejects its competence on the ground of the ePrivacy Directive but does not refer the case to the competent authority, despite a clear obligation to do so under the ePrivacy Directive (noyb’s IDFA case).

…to the competent authority, despite a clear obligation to do so under the ePrivacy Directive (noyb’s IDFA case). European Digital Rights | 12 Rue Belliard, 1040 Bruxelles, Belgium | Tel. +32 2 274 25 70 | www.edri.org Language and administrative barriers to lodge a complaint across the EU - In certain cases, the complaint (including all the attachments) can only be filed in one official language of the SA although the complainant actually has the right to choose a language that the SA understands and could use in the cooperation procedure. - Some SAs require an e-Gov access to file a complaint or even to communicate electronically with the complainant, which does not allow people without such e-Gov access (like NGOs not established in the country) to file the complaint under the same conditions as nationals with an e-Gov access.

NGOs not established in the country) to file the complaint under the same conditions as nationals with an e-Gov access. Additionally, the electronic communication systems using e-Gov often impose a limit on the number of files that can be attached per one message or even on the permitted formats of the attachments. - Not all Member States recognise official electronic signatures of other MS resulting in SAs dismissing the complaint. - There should be a possibility to file a complaint in different languages (English, for example) than just the language used by a SA (usually the official language where the SA is established).

…for example) than just the language used by a SA (usually the official language where the SA is established). Ensure that e-Admin or e-Gov platforms that may be used to send and receive complaints do not limit data subjects’ rights to lodge complaints: data subjects should not need to have an ID card, e-access or registration number from a certain Member State to be able to exercise their rights. The electronic communication system (if it is not e-mail) should allow for multiple attachments in various formats. SAs should accept e-signatures from other Member States in line with the applicable law. SAs should be transparent in their answers to the EDPB regarding this matter (the answers from SAs were redacted in the document received after a request for access to the relevant documents).

(the answers from SAs were redacted in the document received after a request for access to the relevant documents). See https://www.accessnow.org/cms/ assets/uploads/2022/07/GDPR-C omplaint-study.pdf pages 45-49 as well as 59 and 60 See, for example, the situation in Spain where an NGO cannot correspond with the AEPD without an e-certificate. Topic 2 – PROCEDURE AFTER THE COMPLAINT HAS BEEN FILED Update on the progress of the complainant - In most cases, complainants do not receive regular updates from the SAs at all, even several months and sometimes years after filing the complaint, and despite several reminders. - It is further unclear which SA is required to provide an update, since The CSA receiving the complaint should be the one informing the complainant. This information should be done in the language used in the complaint.

…should be the one informing the complainant. This information should be done in the language used in the complaint. The update should not only happen once after 3 months as stated by the EDPB but regularly, as Article 77(2) obliges the SA to inform the complainant on any progress and outcome of the complaint. An update every 3 months (as practiced e.g. by some SAs) would allow a See https://noyb.eu/sites/default/files/ 2022-03/Follow-up%20meeting_ Redacted.pdf, Section 1.1.f European Digital Rights | 12 Rue Belliard, 1040 Bruxelles, Belgium | Tel. +32 2 274 25 70 | www.edri.org Article 77(2) requires the SA “with which the complaint has been lodged” to provide information but Article 78(2) addresses the SA “which is competent pursuant to Articles 55 and 56”.

60 → 12

originalus šaltinis (PDF) ↗