Complaint to the European Data Protection Supervisor

The EU institutions and bodies also process the personal data of EU citizens in their work. The basic regulatory framework governing the protection of personal data is enshrined in the Charter of Fundamental Rights of the European Union (Article 8 (1)) and the Treaty on the Functioning of the EU (Article 16 (1)), and the main regulations governing this area are what:
 
- General Data Protection Regulation - GDPR (General Regulation 2016/679), and
 
- Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data.

Personal data is any information related to an identified or identifiable individual. An identifiable individual (natural person) is an individual who can be identified directly or indirectly on the basis of an identifier (name, location data, physical, physiological, genetic, mental, economic, cultural or social identity, etc.) (Article 3 (1) of Regulation 2018/1725).
 
The processing of personal data, which must be lawful (Article 5 of Regulation 2018/1725), fair and transparent, includes automated or non-automated electronic, written or visual collection, recording, editing, structuring, storing, adapting and modifying, retrieving, viewing, using , disclosure through mediation, dissemination or otherwise making available, adapting and combining, restricting, deleting and destroying (Article 3 (3) of Regulation 2018/1725).
 

Regulation 2018/1725 distinguishes between:
 
- to processors
(usually someone third party, someone outside the organization who processes personal data for the controller; Article 3, paragraph 12, Article 29),
 
- the controller
(the one who determines the purposes of personal data processing - why and the means for their processing - how; Article 3, paragraph 8),
 
- joint controllers
(those who, on the basis of an agreement, jointly decide on the purpose and means of data processing; Article 28),
 
- recipients of personal data
(those to whom personal data have been disclosed; Article 3, paragraph 13).
 

Regulation 2018/1725 prohibits the processing of t. i. specific types of personal data, ie data revealing:
- racial or ethnic origin,
- political opinion,
- religious or philosophical beliefs
- trade union membership,
- and the processing of genetic data, biometric data for the purpose of unique identification of an individual,
- health data,
- data relating to the individual's sexual life or sexual orientation,
 
unless:
- the individual (natural person) has given his or her explicit consent to the processing of specific types of personal data for a specific purpose (s),
- it concerns the fulfillment of obligations and the exercise of rights in the field of labor law, social security law and social security,
- it is a matter of protecting the interests of life,
- they are published by the individual (but can be processed according to the rules of the GDPR),
- these are needs for legal claims or the exercise of jurisdiction of courts,
- it is in the public interest, based on the principle of proportionality,
- for medical purposes (taking into account professional secrecy),
- it is a matter of public interest in the field of public health,
- or in other purposes specified in Article 10 of Regulation 2018/1725.

The data subject has the right to request confirmation from the controller or to which personal data are processed in relation to him. An individual's right relates to obtaining information on:
- the purpose of processing his personal data,
- the type of personal data concerned,
- the user to whom personal data will be or have already been disclosed,
- the envisaged retention period of his personal data
- and other information provided for in Article 15 of Regulation 2018/1725.
 
In the event of a breach related to the protection of personal data during processing and transmission, the person concerned may first:
 
1. warn the staff responsible for processing data in the EU institution or body where the breach occurred. In the event of an inappropriate or unsatisfactory response from the offender, it may proceed
 
2. contact the Data Protection Officer of the EU institution or body concerned. In case of dissatisfaction or failure, you can
 
3. lodge a complaint with the European Data Protection Supervisor using the online form available on the official website.


Who can complain to the European Data Protection Supervisor and how?
I. in accordance with Article 63 of Regulation 2018/1725, any data subject processed by an EU institution, body or agency if he considers that the processing is inconsistent with the Regulation, via an online form,
 
II. in accordance with Article 68 of Regulation 2018/1725, any staff member or staff of an EU institution, body or agency, even if there are no breaches related to the staff member's personal data and direct involvement of the staff member, but perceived breaches of the rules of the Regulation institution, body or agency via an online form.
Conditions for lodging a complaint with the Complaint to European Data Protection Supervisor:
- there is an infringement of Regulation 2018/1725 exclusively by the EU institutions, bodies and agencies, ie:
               * European Parlament,
               * European Commission,
               * Council of the European Union,
               * European Central Bank,
               * EU agencies,
               * EFTA Surveillance Authority, etc.
- it is a factual and not merely hypothetical breach of the rules on the processing of personal data,
- it has not been more than two years since the person concerned (the complainant) became aware of the facts,
- non-anonymity of the application and non-anonymity of the person whose rights have been violated during the processing of personal data,
- power of attorney to represent the complainant (if the complainant has a representative),
- these are not matters pending before the European Ombudsman,
- these are not matters which the European Ombudsman has already inquired about, except in the case of new facts and new evidence,
- these are not cases pending before a court,
        - these are not cases which have already been decided by a court,
        - it is not a national public authority (police, public school, court, etc.),
        - it is not an organization of private law, ie it is not a company, a non-governmental organization, a church, a trade union and the like,
        - it is not an international organization.
 
The European Data Protection Supervisor may:
 
- order the controller or processor to comply with your request regarding the exercise of rights in the processing and transmission of personal data, insofar as it has not been properly addressed,
- inform and warn the controller and the processor of the breach of Regulation 2018/1725,
- order controllers to inform data subjects and personal data breaches,
- impose a temporary restriction or permanent ban on a particular data processing operation,
- order the controllers and processors to harmonize the processing of personal data with the applicable regulations, otherwise it may impose a fine,
- refer the case to the Court of Justice of the EU,
- and perform other tasks for which he is authorized, in accordance with Article 58 of Regulation 2018/1725.
 
In the event of breaches in the processing and transmission of personal data to international institutions, the affected person may contact the competent person of the international organization: