Alain Bensoussan
On June 15, 2011, Peter Hustinx, European Data Protection Supervisor (EDPS), and Giovanni Buttarelli, Assistant Supervisor, presented their Annual Report of activities for 2010 (read full report here). This Report covers the sixth full year of activity of the EDPS as a new, independent supervisory body. Peter Hustinx, the EDPS, said it “is fully in line with the need to increase our efforts to ensure a more effective protection of privacy and personal data in a changing world which is increasingly global, Internet driven and dependent on the wide spread use of ICTs in all areas of life.”
This report is a good opportunity to get to know the European guardian of personal data protection. Do you know that you can lodge a complaint to the EDPS?
What is the EDPS?
The European Data Protection Supervisor (EDPS) is an independent supervisory authority devoted to:
(i) protecting personal data and privacy; and
(ii) promoting good practice in the EU institutions and bodies.
The EDPS’ general objective is to ensure that the European institutions and bodies respect the right to privacy when they process personal data and develop new policies.
What can you complain about?
You can lodge a complaint with the EDPS if you consider that your rights have been infringed when a European Union institution or body has processed data relating to you.
The following complaints are not admissible:
(1) Complaints not related to the processing of personal data by EU institutions and bodies. If you want to complain about processing of personal data by individuals, private companies and national authorities in the EU Member States, contact your national data protection authority. In particular, the EDPS is not an appeal authority against the decisions of the national data protection authorities;
(2) Complaints not related to the processing of personal data. If you want to complain about other actions of the EU administration, such as maladministration, you should contact either the European Ombudsman or the competent court;
(3) Complaints about a violation of the rights of a third party.
Before you submit a complaint
(1) You are recommended to contact the EDPS only after having first contacted the people responsible for the processing (controller and/or the Data Protection Officer) of the institution or body concerned.
(2) Gather any evidence supporting your allegations to be sure to provide all relevant information and avoid unnecessary delay when the EDPS addresses your complaint.
How to submit a complaint?
You can use the electronic form accessible on the EDPS website (Complaint Submission Form). This form can be completed and sent electronically.
What happens after you file a complaint?
If your complaint is found admissible after preliminary examination, the EDPS will carry out an inquiry.
The EDPS may order the rectification, blocking, erasure or destruction of data or even impose a ban on a particular data processing. It may also decide to refer the matter to the Court of Justice.
The EDPS has no power to compensate the person concerned by the violation of data protection rules.
If you are not satisfied with the outcome and disagree with the decision of the EDPS, you can ask the EDPS to review his decision within one month of the decision date. You may also appeal directly against the decision to the Court of Justice.