1. A complaint on the basis of Regulation (EU) 2016/679 concerning cross-border processing shall be admissible provided that it includes the following information:
|
(a) |
the name and contact details of the person lodging the complaint; |
|
(b) |
where the complaint is lodged by a not-for-profit body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, proof that that body, organisation or association has been properly constituted in accordance with the law of a Member State; |
|
(c) |
where the complaint is lodged on the basis of Article 80(1) of Regulation (EU) 2016/679, the name and contact details of the not-for-profit body, organisation or association lodging that complaint and proof that that body, organisation or association is acting on the basis of a mandate of a data subject; |
|
(d) |
information which facilitates the identification of the controller or processor that is the subject of the complaint; |
|
(e) |
a description of the alleged infringement of Regulation (EU) 2016/679. |
No information additional to that referred to in the first subparagraph shall be required in order for a complaint concerning cross-border processing to be admissible.
Administrative modalities and requirements under the national procedural law of the supervisory authority with which the complaint has been lodged shall continue to apply.
2. Where the supervisory authority with which a complaint has been lodged determines that the complaint does not contain the information referred to in paragraph 1, first subparagraph, it shall, within two weeks of receiving that complaint, declare that complaint inadmissible and inform the complainant of the reasons thereof.
3. The complainant shall not be required to have contacted the party under investigation before lodging a complaint in order for that complaint to be admissible.
Without prejudice to the first subparagraph, where a complaint relates to the exercise of a right of the data subject that relies on the data subject concerned making a request to the controller, that request shall be made to the controller before that complaint is lodged.
4. The supervisory authority with which the complaint has been lodged shall determine, by way of a preliminary conclusion, the following:
|
(a) |
whether the complaint concerns cross-border processing; |
|
(b) |
which supervisory authority it presumes to be competent to act as lead supervisory authority in accordance with Article 56(1) of Regulation (EU) 2016/679; and |
|
(c) |
whether Article 56(2) of Regulation (EU) 2016/679 applies. |
5. Where a complaint that concerns cross-border processing is admissible and in the absence of an early resolution pursuant to Article 5, the supervisory authority with which the complaint has been lodged shall transmit that complaint to the supervisory authority it presumes is competent to act as lead supervisory authority no later than six weeks from the receipt of that complaint and inform the complainant of that transmission.
The determination of admissibility of a complaint by the supervisory authority with which that complaint has been lodged shall be binding on the lead supervisory authority.
6. Within six weeks of the receipt of a complaint, the supervisory authority presumed to be competent to act as lead supervisory authority shall either confirm its competence or, where there are conflicting views on which of the other supervisory authorities concerned is competent for the main establishment, refer the subject matter to the European Data Protection Board (the ‘Board’) for dispute resolution under Article 65(1), point (b), of Regulation (EU) 2016/679.
Where the supervisory authority presumed to be competent to act as lead supervisory authority does not confirm its competence or refer the subject matter to the Board within the time limit referred to in the first subparagraph, the supervisory authority with which the complaint has been lodged shall refer the subject matter to the Board for dispute resolution under Article 65(1), point (b), of Regulation (EU) 2016/679.
7. Without prejudice to its admissibility, the supervisory authority with which a complaint has been lodged or the lead supervisory authority may request the complainant to submit supplementary information in order to facilitate the handling of that complaint and enable its full investigation.
8. The lead supervisory authority shall inform the party under investigation of the lodging of a complaint and of its main elements without delay.
1. A complaint concerning cross-border processing which concerns the exercise of the rights of the data subject under Chapter III of Regulation (EU) 2016/679 may, where appropriate, be resolved through a procedure allowing for its early resolution by:
|
(a) |
the supervisory authority with which the complaint has been lodged, after it has determined by way of preliminary conclusion that the complaint concerns cross-border processing and prior to the possible transmission of the complaint to the supervisory authority presumed to be competent to act as lead supervisory authority; or |
|
(b) |
the lead supervisory authority to which the complaint has been transmitted, at any time before the submission of the preliminary findings to the other supervisory authorities concerned pursuant to Article 19 of this Regulation, or, where the simple cooperation procedure referred to in Article 6 of this Regulation applies, before the submission of the draft decision. |
Supervisory authorities may encourage and facilitate the early resolution of complaints, and communicate with the party under investigation or the complainant for this purpose, as appropriate.
2. For the purpose of early resolution, where the supervisory authority referred to in paragraph 1, first subparagraph, point (a) or (b), establishes, based on supporting evidence, that the alleged infringement has been brought to an end, that supervisory authority shall consider the complaint devoid of purpose.
Where the complaint has been found to be devoid of purpose, the supervisory authority referred to in paragraph 1, first subparagraph, point (a) or (b) shall, using clear and plain language, inform the complainant:
|
(a) |
that the alleged infringement has been brought to an end and that it considers the complaint devoid of purpose; |
|
(b) |
of the consequences of the early resolution; and |
|
(c) |
of the possibility for the complainant to submit an objection to the early resolution within four weeks of receiving such information. |
3. In a procedure before the supervisory authority with which a complaint has been lodged, where the complainant does not submit an objection within the time limit set out in paragraph 2, second subparagraph, point (c), that supervisory authority shall, within two weeks of the expiry of that time limit, establish that the complaint has been resolved and inform the complainant, the party under investigation, and, where applicable, the lead supervisory authority of that resolution.
4. In a procedure before the lead supervisory authority to which the complaint has been transmitted, where the complainant does not submit an objection within the time limit set out in paragraph 2, second subparagraph, point (c), of this Article, that lead supervisory authority shall submit a draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 within four weeks of the expiry of that time limit, with a view to adopting a final decision in accordance with Article 60(7) of Regulation (EU) 2016/679 establishing that the complaint has been resolved.
5. The early resolution of a complaint shall be without prejudice to the exercise by the lead supervisory authority of the powers set out in Article 58 of Regulation (EU) 2016/679 with regard to the same subject matter.
6. Articles 10 to 20 do not apply to complaints resolved pursuant to this Article.