Remedy against SA for not handling complaints with due care

Article(s) involved (national, EU, or other): Articles 77 and 78 GDPR

Problem

SAs sometimes render a decision by which they close a case because they were unable to identify or contact the controller, or because they could not find any evidence of a violation. In some other cases, SAs do find a violation but do not adopt any corrective measures (e.g. injunctions). In other words, even when a complaint is being handled, the concrete actions of SAs are sometimes very disappointing (i.e. no use of their investigative or corrective powers, although this would be necessary to establish the existence of a violation and/or put an end to it).

Ideal Solution

SAs should be subject to an obligation of due care, according to which they should justify why they did not use their investigative or corrective powers. The provision should also specify what can be asked to the court in the event an SA wrongfully decided not to use its investigative or corrective powers, in breach of its obligation of due care, e.g. forcing the SA to take action, to open an investigation, to issue an injunction, etc.

The provision should also specify that a breach of the due care obligation gives rise to damages.

Proposed Solution

Concepts 9 and 14 should properly define the complaints procedure and deadlines. Concept 5 shoudl be sufficient to ensure that LSAs comply with their duties.