During its last plenary session of 20 June 2023, the European Data Protection Board (“EDPB”) adopted a data subject template complaint form.

This complaint form is to facilitate the submission of complaints by individuals and the subsequent handling of complaints by Data Protection Authorities (DPAs) throughout the European Union in cross-border cases.

In March 2022, various civil society organizations sent a letter to the European Commissioner for Justice, the EDPB and Members of the Civil Liberties, Justice and Home Affairs (LIBE) Committee of the European Parliament with a call on DPAs to make better use of existing tools for enforcement and cooperation under the GDPR. One such example was that DPAs should be required to perform joint investigations and coordinate their action through task forces where a data controller is subject to complaints in more than one Member State raising similar compliance issues.

During a high-level meeting in April 2022 in Vienna, the EDPB made a commitment to address this. After this meeting, members of the EDPB stressed that its duty is to ensure that the General Data Protection Regulation (“GDPR”) is enforced effectively and consistently; for this, the EDPB would collect best practices regarding the interpretation of national procedural law. Furthermore, DPAs reiterated their commitment to close cross-border cooperation and agreed to various measures to ensure enhanced cooperation.

The complaint form takes into account the existing differences between national laws and practices and it will be used on a voluntary basis by DPAs. DPAs can also adapt the complaint form to their respective national requirements.

It can also be used for cases where the complaint is filed by the individual personally and for cases where the complaint is filed by someone else, such as a legal representative, an entity acting on behalf of the individual or an entity acting on its own initiative.

The EDPB has also developed a template response acknowledging receipt, which aims to provide the complainant with general information on the next steps following the submission of their complaint and highlights the right to an effective judicial remedy against a legally binding decision of a DPA.

While awaiting the data subjects’ complaint form to be published by the EDPB, it is imperative that your organization attends to data subjects’ requests and complaints in accordance with the GDPR as not complying with data subjects’ requests or complaints is a short route to fines.

Does your organization have questions about data subjects’ requests or complaints? Contact us, the Experts in Data Privacy at info@dpoconsultancy.nl for assistance.