Effective procedure – transparency : information on the status of the complaint
Article(s) involved (national, EU, or other): Articles 77 and 78 GDPR
Article 78(2) GDPR provides that SAs must inform the data subject “within three months” on the progress or outcome of the complaint. Often, data subjects do not get any update at all, or only after several months / years, despite asking for such information and sending reminders. The EDPB position according to which it would suffice for SAs to give one single update within three months after the complaint has been filed does not make any sense, since it would allow SAs to simply acknowledge receipt of the complaint and then leave the data subjects in the dark.
The text should state that information on the status and progress of the complaint should be provided by the responsible SA to the complainant every 3 month as from the date of the filing, and specify what this update must at least contain (see below).
In all the cases noyb handles, only a few authorities frequently inform the complainant on the status without the complainant repeatedly asking for an update. In cooperation cases, usually neither the CSA nor the LSA provide any updates. Asking the CSA leads to the CSA asking the LSA for an update and – if the complainant is lucky – giving the complainant an update months after the complainant’s request (if at all). Asking the LSA directly for an update may lead to a quicker update, but often the LSA refers the complainant back to the CSA for updates (see noyb cases C007 and C008, email dated 27.11.2020) or they are even unable to identify the case (happened in various cases of the 101 complaints). The Polish SA responds very randomly to requests for updates sent to them via the eGov system. Sometimes they respond within days, but sometimes they are silent for months. This is the case in all cookie banners complaints filed in Poland and in C029-101, C029-26, C029-27, C029-28, C029-29 (“101 complaints”).