It is the duty of the EDPS to handle complaints on how Union institutions and bodies process personal data. Such complaints may be lodged by the data subject or by a body, an organisation or association. The EDPS shall investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period. Personal data will be used for examining and investigating complaints and for deciding on their outcome as well as ensuring their implementation.
The EDPS handles complaints confidentially (without prejudice to Regulation (EC) 1049/2001 regarding public access to documents).
We process your personal data based on Regulation (EC) 2018/1725 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions and bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC. Complaints against Europol will be investigated in accordance with Regulation (EU) 2016/794.
The following information is provided as established in Articles 15 and 16 of Regulation (EC) 2018/1725 (“the Regulation”).
Who is the controller?
The controller is the European Data Protection Supervisor (EDPS).
For more information on the EDPS please consult our website.
What personal data do we process and who can access it?
Categories of personal data:
The personal data processed are submitted by the complainant or obtained by the EDPS from other sources during the investigation of your complaint. The categories of data contained in documents may vary depending on the subject matter of the complaint and can in some cases include sensitive data.
Who can access your personal data:
For the EDPS, case handlers, administrative staff and hierarchy involved in the complaints handling will have access to the case file containing your personal data on a need-to-know basis. All access to case files is logged. Your data will be transferred to other EU institutions and bodies or to any third parties only where necessary to ensure the appropriate investigation or follow-up of your complaint. This implies that the complaint and related documents are shared with the Union institution or body concerned, with the DPO in copy. Decisions, including review decisions, are also shared with the Union institution or body.
Where appropriate and in accordance with the Memorandum of understanding between the EDPS and the European Ombudsman, certain complaints may be transferred to the European Ombudsman. The EDPS may also transfer certain complaints falling outside of its competences to other relevant EU institutions or bodies, such as the European Commission, the European Parliament and OLAF.
In cases where the EDPS is not competent to investigate the subject matter, the EDPS may transfer your complaint to the relevant national supervisory authority or international organisation, in the framework of the cooperation between the EDPS and national supervisory authorities or international organisations (see Articles 61 and 62, as well as Article 51(b) of the Regulation).
The EDPS handles complaints confidentially. During and after the end of the inquiry, no documents related to the complaint, including the final decision, are proactively disclosed by the EDPS to the public. However, access to such documents might be requested on the basis of Regulation (EC) 1049/2001 regarding public access to documents. In such a case, the EDPS might grant access to the documents on a case-by-case basis, in whole or in part, in accordance with the relevant rules. The EDPS may publish anonymised summaries of cases, for example on our website or in annual reports. The EDPS may also decide to publish the final decision in its entirety in important cases. This would be done in a form which takes into account any request for confidentiality and therefore does not allow the complainant or other parties to be identified.
Why do we process your personal data and under what legal basis?
Your personal data are processed by the EDPS, when proportionate and necessary, for the purpose of investigating your complaint and for the follow up of that complaint. As the supervisory authority responsible for monitoring the processing of personal data by the Union institutions and bodies, the EDPS has the task to handle complaints lodged by a data subject, a body, an organisation or association, and investigate, to the extent appropriate, the subject matter of the complaint. The EDPS shall inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary (see Article 57(1)(e) of the Regulation).
How long do we keep your personal data?
The case file of our investigation - including your personal data - will be stored for up to ten years (five years for prima facie inadmissible complaints) after the closure of the case, unless legal proceedings require keeping them for a longer period.
What are your rights regarding your personal data?
You have the right of access to your personal data and to relevant information concerning how we use it. You have the right to rectify your personal data. Under certain conditions, you have the right to ask that we delete your personal data or restrict its use. You have the right to object to our processing of your personal data, on grounds relating to your particular situation, at any time. We will consider your request, take a decision and communicate it to you without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary.
For more information, please see Articles 14 to 21, 23 and 24 of the Regulation. Please note that in some cases restrictions under Article 25 of the Regulation may apply.
You can send your request to the EDPS by post in a sealed envelope or use our contact form on the EDPS website (see section on contact details below ).
You have the right to lodge a complaint
If you have any remarks or complaints regarding the way we process your personal data, we invite you to contact the EDPS DPO (see section on contact details below). Please mention the case number of your complaint.
Contact details for enquiries regarding your personal data
We encourage you to contact us using the EDPS contact form, selecting ‘My personal data’ as the relevant subject.
To contact the EDPS DPO personally and confidentially, we suggest that you send an e-mail to DPO@edps.europa.eu or a letter to the EDPS postal address marked for the attention of the EDPS DPO.
You can reach the EDPS in the following ways:
E-mail: edps@edps.europa.eu
EDPS postal address: European Data Protection Supervisor, Rue Wiertz 60, B-1047 Brussels, Belgium
You can find complete contact information on the EDPS website. For more information about the EDPS DPO, please go to our Data Protection Officer at the EDPS page.
Where can I find out more?