Effective procedure – transparency : information on the status of the complaint

Article(s) involved (national, EU, or other): Articles 77 and 78 GDPR

Problem

Article 78(2) GDPR provides that SAs must inform the data subject “within three months” on the progress or outcome of the complaint. Often, data subjects do not get any update at all, or only after several months / years, despite asking for such information and sending reminders. The EDPB position according to which it would suffice for SAs to give one single update within three months after the complaint has been filed does not make any sense, since it would allow SAs to simply acknowledge receipt of the complaint and then leave the data subjects in the dark.

Ideal Solution

The text should state that information on the status and progress of the complaint should be provided by the responsible SA to the complainant every 3 month as from the date of the filing, and specify what this update must at least contain (see below).

Proposed Solution

Concepts 2, 7, 8, 9 and 14 could ensure that the CSA has full access to the case file at any time, give updates and that LSAs have clear deadlines to follow.

In all the cases noyb handles, only a few authorities frequently inform the complainant on the status without the complainant repeatedly asking for an update. In cooperation cases, usually neither the CSA nor the LSA provide any updates. Asking the CSA leads to the CSA asking the LSA for an update and – if the complainant is lucky – giving the complainant an update months after the complainant’s request (if at all). Asking the LSA directly for an update may lead to a quicker update, but often the LSA refers the complainant back to the CSA for updates (see noyb cases C007 and C008, email dated 27.11.2020)  or they are even unable to identify the case (happened in various cases of the 101 complaints). The Polish SA responds very randomly to requests for updates sent to them via the eGov system. Sometimes they respond within days, but sometimes they are silent for months. This is the case in all cookie banners complaints filed in Poland and in C029-101, C029-26, C029-27, C029-28, C029-29 (“101 complaints”).