Right to lodge a complaint with a supervisory authority
(7) Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market. Natural persons should have control of their own personal data. Legal and practical certainty for natural persons, economic operators and public authorities should be enhanced.
(141) Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.
(142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject's mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate.
(143) Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU. As addressees of such decisions, the supervisory authorities concerned which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU. Without prejudice to this right under Article 263 TFEU, each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them.
Where a complaint has been rejected or dismissed by a supervisory authority, the complainant may bring proceedings before the courts in the same Member State. In the context of judicial remedies relating to the application of this Regulation, national courts which consider a decision on the question necessary to enable them to give judgment, may, or in the case provided for in Article 267 TFEU, must, request the Court of Justice to give a preliminary ruling on the interpretation of Union law, including this Regulation. Furthermore, where a decision of a supervisory authority implementing a decision of the Board is challenged before a national court and the validity of the decision of the Board is at issue, that national court does not have the power to declare the Board's decision invalid but must refer the question of validity to the Court of Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice, where it considers the decision invalid. However, a national court may not refer a question on the validity of the decision of the Board at the request of a natural or legal person which had the opportunity to bring an action for annulment of that decision, in particular if it was directly and individually concerned by that decision, but had not done so within the period laid down in Article 263 TFEU.
(144) Where a court seized of proceedings against a decision by a supervisory authority has reason to believe that proceedings concerning the same processing, such as the same subject matter as regards processing by the same controller or processor, or the same cause of action, are brought before a competent court in another Member State, it should contact that court in order to confirm the existence of such related proceedings. If related proceedings are pending before a court in another Member State, any court other than the court first seized may stay its proceedings or may, on request of one of the parties, decline jurisdiction in favour of the court first seized if that court has jurisdiction over the proceedings in question and its law permits the consolidation of such related proceedings. Proceedings are deemed to be related where they are so closely connected that it is expedient to hear and determine them together in order to avoid the risk of irreconcilable judgments resulting from separate proceedings.
(145) For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.
There is no recital in the Directive related to article 77.
Like the Directive, Article 77 of the Regulation enables any person concerned by data processing to lodge a complaint with a supervising authority if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. Any infringement of the Regulation may therefore justify such a complaint.
In its first draft, the second paragraph of Article 77 specified also the organizations entitled to lodge a complaint on behalf of the data subject, even irrespective of any claim of the data subject, in case of personal data breach. However, this element was not retained in the final version of the text.
Which supervisory authority a data subject may report to for determination is not strictly specified. According to paragraph 1, data subject shall have the right to lodge a complaint with a supervisory authority competent of his or her habitual residence, place of work or place of the alleged infringement.
The supervisory authority receiving the lodged complaint shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the Regulation (paragraph 2).
The Directive already required Member States to implement a procedure for lodging a complaint with the supervisory authority. Thus any person or an association representing that person may lodge a complaint concerning the protection of his or her rights and freedoms in regard to the processing of personal data. This may in particular consist of a request for verification of the lawfulness of processing. Pursuant to Article 28 (4), the person concerned shall be informed of the outcome of the claim or that a check has taken place.
In countries where the authority had no decision-making power, an increase in complaints may be expected, as this situation will lead to a decision likely to be appealed. The problem is then to determine what will be the procedure before the national authority which should not be overly complicated and/or costly as this may discourage the data subject from pursuing a complaint.
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.
1st proposal close
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority in any Member State if they consider that the processing of personal data relating to them does not comply with this Regulation.
2. Any body, organisation or association which aims to protect data subjects’ rights and interests concerning the protection of their personal data and has been properly constituted according to the law of a Member State shall have the right to lodge a complaint with a supervisory authority in any Member State on behalf of one or more data subjects if it considers that a data subject’s rights under this Regulation have been infringed as a result of the processing of personal data.
3. Independently of a data subject's complaint, any body, organisation or association referred to in paragraph 2 shall have the right to lodge a complaint with a supervisory authority in any Member State, if it considers that a personal data breach has occurred.
2nd proposal close
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if the data subject considers that the processing of personal data relating to him or her does not comply with this Regulation.
5. The supervisory authority to which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 74 (…).
4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.
Art. 47 WBP
1. De belanghebbende kan zich ook binnen de termijn bepaald voor het beroep op grond van de Algemene wet bestuursrecht, dan wel die, bedoeld in artikel 46, tweede lid, tot het College wenden met het verzoek te bemiddelen of te adviseren in zijn geschil met de verantwoordelijke, dan wel gebruik maken van een geschillenbeslechtingsregeling op grond van een gedragscode ten aanzien waarvan een verklaring is afgegeven als bedoeld in artikel 25, eerste lid. In dat geval kan in afwijking van artikel 6:7 van de Algemene wet bestuursrecht het beroep nog worden ingesteld, dan wel de procedure ingevolge artikel 46 nog aanhangig worden gemaakt nadat de belanghebbende van het College of ingevolge een geschillenbeslechtingsregeling op grond van een gedragscode ten aanzien waarvan een verklaring is afgegeven als bedoeld in artikel 25, eerste lid, bericht heeft ontvangen dat de behandeling van de zaak is beëindigd, doch uiterlijk zes weken na dat tijdstip.
2. Tijdens de behandeling van het beroep en de procedure, bedoeld in het eerste lid, kunnen de instanties die zijn belast met de behandeling van het geschil, het advies van het College inwinnen.
Art. 60 WBP
1. Het College kan ambtshalve of op verzoek van een belanghebbende, een onderzoek instellen naar de wijze waarop ten aanzien van gegevensverwerking toepassing wordt gegeven aan het bepaalde bij of krachtens de wet.
2. Het College brengt zijn voorlopige bevindingen ter kennis van de verantwoordelijke of de groep van verantwoordelijken die bij het onderzoek zijn betrokken en stelt hen in de gelegenheid hun zienswijze daarop te geven. Houden de voorlopige bevindingen verband met de uitvoering van enige wet, dan brengt het College deze tevens ter kennis van Onze Minister die het aangaat.
3. In geval van een onderzoek, ingesteld op verzoek van een belanghebbende, doet het College aan deze mededeling van zijn bevindingen, tenzij zodanige mededeling onverenigbaar is met het doel van de gegevensverwerking of de aard van de persoonsgegevens, dan wel gewichtige belangen van anderen dan de verzoeker, de verantwoordelijke daaronder begrepen, daardoor onevenredig zouden worden geschaad. Indien het mededeling van zijn bevindingen achterwege laat, zendt het de belanghebbende zodanig bericht als hem geraden voorkomt.
1. The interested party may also file a request with the Authority, within the time limit stipulated for the appeal under the General Administrative Law Act, to mediate in or advise on his dispute with the controller or to use a dispute resolution scheme under a code of conduct which has already been issued with a declaration as referred to in Section 25 (1). In that case, by way of derogation from Section 6:7 of the General Administrative Law Act, the appeal may still be filed or proceedings as referred to in Section 46 may still be issued after the interested party has received a notification from the Authority or pursuant to a dispute resolution scheme under a code of conduct which has already been issued with a declaration as referred to in Section 25 (1), that the case has been closed, but not more than six weeks after such date.
2. During the appeal hearing and the proceedings, referred to in subsection 1, the bodies charged with resolving the dispute may request the Authority to give an opinion.
1. The Authority may, on its own initiative or at the request of an interested party, conduct an audit of the manner in which provisions established by or pursuant to the law are implemented in respect of data processing.
2. The Authority will notify the controller or group of controllers involved in the audit of its preliminary findings and allow them to put their point of view forward. If these preliminary findings relate to the implementation of any law, the Authority will also notify the Minister concerned.
3. Where an audit has been initiated at the request of an interested party, the Authority will notify that party of its findings, unless such notification is incompatible with the purposes of the data processing or the nature of the personal data, or compelling interests of parties other than the applicant, including the controller, would be harmed disproportionally as a result. If the Authority fails to notify its findings to the interested party, it will send him such message as it deems appropriate.