Proceedings on the protection of personal data

If you suspect that there was or that there is an infringement of your rights when your personal data were or are processed or if there was a violation of Act No. 18/2018 Coll. on personal data protection and amending and supplementing certain Acts (herein after only the “Act. No. 18/2018 Coll.”) or the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter only “the Regulation 2016/679”) you may submit a complaint to the Office to initiate personal data protection proceedings.

The complaint to initiate proceeding

The complaint shall be submitted:

• in writing, i.e. in a paper form
• electronically with authorization under a special regulation on electronic exercise of public authority; complaint made electronically without the authorization under the special regulation on the electronic exercise of the public authority (i.e. an ordinary email without the electronic signature) shall be completed within three working days in writing or electronically authorized under a special regulation on electronic exercise of public authority or personally at the Office – verbally into minutes.
• personally at the Office, i.e. verbally into minutes.

According to the sec. 100 para. 3 of Act. No. 18/2018 Coll. the complaint to initiate proceeding shall contain:

• the name, surname, correspondence address and signature of the complainant,
• identification of the entity against which the complaint is addressed, name, surname, permanent residency or organization name, headquarters and identification number if such number was assigned,
• the subject of the complaint, identifying the rights that might have been infringed during personal data processing,
• evidence supporting the arguments stated in the complaint,
• copy of a documentor other type of evidence demonstrating the exercise of a right pursuant to second title of second chapter of the Act. No. 18/2018 Coll. or the Regulation 2016/679 if you have exercised such right, or the reasons worth special consideration if you have not exercise such right

The complaint shall be submitted in Slovak language (official translation is not required). In accordance with Act No. 270/1995 Coll. on the State Language of the Slovak Republic the public authorities and the natural persons are obliged to use the state language – Slovak in the official communication. The proceeding is performed and the decisions are issued exclusively in Slovak language.

The template of the complaint can be found here

Discontinuing the complaint

According to the sec. 100 para 5 of Act. No. 18/2018 Coll. the Office shall discontinue the complaint if

• the complaint is manifestly unfounded,
• the subject of the complaint is being reviewed by a court or a law enforcement authority
• the complainant has not provided necessary cooperation upon the Office’s request, while without his or her active participation the complaint cannot be resolved; the Office shall notify the complainant about the possibility of discontinuing the complaint,
• more than three years have passed from the event that is the subject of the complaint as of the day when the complaint was delivered.

Petition

If the complaint is delivered to the Office by a person other than the data subject, the complaint is considered as a petition to initiate the proceedings without a complaint and the natural or legal person which has submitted the petition is not considered to be party to the proceeding. The Office shall notify the complainant about how the petition proceeds within 30 days from the date the petition is delivered to the Office. The Office shall review the petition within 30 days from the date of its delivery. If the petition is not postponed pursuant to the reasons stated in sec. 100 para 5, the Office shall initiate the proceeding.

Proceedings based on the result of inspection and own initiative

The Office can initiate proceedings upon its own initiative based on the results of the inspection according to sec. 97 para. 2 in connection with sec. 100 para. 2 of Act. No. 18/2018 Coll. which has identified any shortcomings; or based on its own findings during supervision carried out over compliance with the obligations laid down by Act. No. 18/2018 Coll. or Regulation 2016/679.

Decision

If the Office finds that the rights of the data subject have been violated or that obligations relating to the processing of personal data have not been fulfilled, the Office shall, in particular, order remedial measures and set a deadline for their implementation. The Office may also impose a fine in its decision. If the violation of rights or failure to fulfil obligations is not established, the Office shall discontinue the proceedings.

Periods for the decision

The Office shall issue a decision within 90 days from the day the proceeding is initiated. In reasonable cases this period is extended by the Office, to a maximum of 180 days. The Office shall notify parties to the proceeding about the extension in writing.

Appeal against the decision

A party to the proceeding can lodge an appeal against the decision that has not entered into force within the period of 15 days following the day of its delivery. The appeal can be lodged to the Office in the same form as complaint may be submitted.