Proposal to initiate proceedings on personal data protection
Name of the end service: Submission of a complaint to initiate proceedings on personal data protection
Description: The service can be used in case of suspicion of unlawful processing of personal data under Act No. 18/2018 Coll. on the Protection of Personal Data. The “Submission of a Complaint” service may be used by anyone who believes that their personal data or the personal data of another data subject have been processed in breach of the Act on the Protection of Personal Data (for example, you have withdrawn your consent to the processing of your personal data, but the company continues to process your personal data), or in breach of the General Data Protection Regulation (“GDPR”). If the Office initiates proceedings concerning on personal data protection, a party to the proceedings is the person who submitted the complaint to initiate the proceedings or a person who claims that their rights have been directly affected. If the person submitting the complaint believes that another person’s personal data have been processed in breach of data protection regulations, they may also use this service. However, in such a case, the Office will treat the proposal as a notification, and since the person submitting it has not been directly affected, they will not be considered a party to the proceedings concerning the protection of personal data.
Conditions
A complaint to initiate a proceeding must contain
a) the name, surname, correspondence address and signature of the complainant,
b) identification of the entity against which the complaint is addressed, their name, surname, permanent residency or organisation name, headquarters and identification number if such number has been assigned,
c) the subject of the complaint, identifying the rights that might have been infringed during personal data processing,
d) evidence supporting the arguments laid down in the complaint,
e) a copy of document or other type of evidence demonstrating the exercise of a right pursuant to second title of second chapter of Act No. 18/2018 Coll. or special regulation, if such right has been exercised by the data subject, or justification of special consideration if such right has not been exercised by the data subject, if the complaint was lodged by a data subject.
The Office shall discontinue the complaint if
a) the complaint is manifestly unfounded,
b) the subject of the complaint is reviewed by a court or law enforcement authority,
c) the complainant has not provided necessary cooperation upon the Office’s request, while without his or her active participation the complaint cannot be resolved; the Office shall notify the complainant about the possibility of discontinuing the complaint,
d) more than three years have passed from the event that is subject of the complaint as of the day when the complaint was delivered.
If the complaint is delivered to the Office by a person other than the data subject, the complaint is considered as a petition to initiate a proceeding without a complaint.
The Office shall review the petition within 30 days from the date of its delivery to the Office, and if it does not discontinue the petition, it shall initiate a proceeding decide on the merits of the case.
The complainant shall be notified about how the petition is being processed within 30 days from the date of the delivery to the Office.
Method of submission
electronically – via the electronic service;
in written form, by post or in person by submitting it to the Office’s filing office, or orally for the record.
An electronic submission must be signed with a qualified electronic signature, and the submitter must also authenticate themselves when making the submission.
Fees
Submitting a complaint to initiate proceedings concerning the protection of personal data is not subject to the payment of an administrative fee.
Outcome
The Office shall decide in the proceeding within 90 days from the day the proceeding is initiated. In reasonable cases this period is extended by the Office, to a maximum of 180 days. The Office notifies the parties to the proceedings about the extension in writing.
If it is necessary to carry out an inspection during the proceedings, the period for issuing a decision does not run, from the day of the inspection is initiated until the inspection is finalised.
If, during the proceedings, the Office finds that the conditions for suspending the proceedings under special regulation have been met, the Office shall suspend the proceedings and inform the parties to the proceedings accordingly.
If the Office identifies that rights of data subject have been infringed or identifies failure to comply with obligations when processing personal data laid down in this Act or special regulation in the area of personal data protection by the party to the proceeding, it can by decision
a) impose corrective measures and a period within which the measures pursuant to paragraph 3 shall be carried out, if reasonable and appropriate,
b) cancel the binding character of an approved Code of Conduct for the controller or processor who have committed themselves to comply with such Code of Conduct,
c) withdraw a certificate,
d) order the certification body to withdraw a certificate,
e) withdraw a declaration on granting accreditation,
f) impose a fine pursuant to section 104
If an infringement of rights of the data subject was not proven or if the obligations lay down by this Act or special regulation related to personal data processing are not proven to have been breached by the party to the proceedings, the Office shall cease the proceeding.
A decision adopted pursuant to section 102 may be appealed, which shall be decided by the president of the Office.
The service is provided electronically via an electronic form via the ÚPVS portal: