Personal data protection proceeding

If you suspect that there was or that there is an infringement of your rights when your personal data were or are processed or if there was a violation to the Act No. 18/2018 Coll. on personal data protection and amending and supplementing certain Acts (herein after only the “Act. No. 18/2018 Coll.”) or the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter only “the Regulation 2016/679”) you may submit a complaint to the Office to initiate the personal data protection proceeding.

The complaint to initiate proceeding

The complaint shall be submitted:

• in writing, i.e. in a paper form
• electronically with authorization under a special regulation on electronic exercise of public authority; complaint made electronically without the authorization under the special regulation on the electronic exercise of the public authority (i.e. an ordinary email without the electronic signature) shall be completed within three working days in writing or electronically authorized under a special regulation on electronic exercise of public authority or personally at the Office – verbally into minutes .
• personally at the Office, i.e. verbally into minutes.

According to the sec. 100 para. 3 of the Act. No. 18/2018 Coll. the complaint to initiate proceeding shall contain:

• the name, surname, correspondence address and signature of the complainant,
• identification of the entity against which the complaint is addressed, name, surname, permanent residency or organization name, headquarter and identification number if such number was assigned,
• the subject of the complaint, identifying the rights that might have been infringed during personal data processing,
• evidence supporting the arguments stated in the complaint,
• copy of document or other type of evidence demonstrating the exercise of a right pursuant to second title of second chapter of the Act. No. 18/2018 Coll. or the Regulation 2016/679 if you have exercised such right, or the reasons worth special consideration if you have not exercise such right

The complaint shall be submitted in Slovak language (the official translation is not required). In accordance with the Act No. 270/1995 Coll. on the State Language of the Slovak Republic the public authorities and the natural persons are obliged to use the state language – Slovak in the official communication. The proceeding is performed and the decisions are issued exclusively in Slovak language.

The template of the complaint can be found here.

Postponing of the complaint

According to the sec. 100 para 5 of the Act. No. 18/2018 Coll. the Office shall postpone the complaint if

• the complaint is manifestly unfounded,
• the subject of the complaint is reviewed by a court or law enforcement authority,
• the complainant has not provided necessary cooperation upon the Office’s request, while without his or her active participation the complaint cannot be resolved; the Office shall notify the complainant about the possibility of postponing the complaint,
• more than three years have passed from the event that is subject of the complaint as of the day when the complaint was delivered.

Petition

If the complaint is delivered to the Office by a person other than the data subject, the complaint is considered as a petition to initiate the proceedings without a complaint and the natural or legal person which has submitted the petition is not considered as a party to the proceeding. The Office shall notify the complainant about how the petition proceeds within 30 days from the date the petition is delivered to the Office. The Office shall review the petition within 30 days from the date of its delivery. If the petition is not postponed pursuant to the reasons stated in the sec. 100 para 5, the Office shall initiate the proceeding.

Proceeding based on the result of inspection and own initiative

The Office can initiate the proceedings upon its own initiative based on the results of the inspection according to the sec. 97 para. 2 in connection with sec. 100 para. 2 of the Act. No. 18/2018 Coll. which has identified any shortcomings; or based on its own findings during the supervision carried out over the compliance with the obligations laid down by the Act. No. 18/2018 Coll. or Regulation 2016/679.

Decision

If the Office identifies that rights of data subject were infringed or the failure to comply with obligations when processing personal data, in decision the Office particularly imposes the corrective measures and the period within which the corrective measures should be carried out. In decision the Office also imposes fines. If the infringement or the failure are not proven the Office shall suspend the proceedings.

Periods for the decision

The Office shall decide in the proceeding within 90 days from the day proceeding is initiated. In the reasonable cases this period is extended by Office, to a maximum of 180 days. The Office shall notify the parties of the proceeding about the extension in writing.

Appeal against the decision

The party to proceeding can lodge an appeal against the decision that has not entered into the force within the period of 15 days following the day of its delivery to the party. The appeal can be lodged to the Office in the same form as the complaint could be submitted.