Procedural rights – effects of amicable settlements on the rights of the complainants

Article(s) involved (national, EU, or other): Recital 131 GDPR

Problem

Recital 131 GDPR mentions the possibility for SAs to reach an amicable settlement ; some SAs (and the Irish SA in particular) systematically uses this to “handle” complaints. Once a complaint has been ‘settled’, the complaint is considered as closed or withdrawn. This can have an adverse effect on the procedural rights of the data subjects.

Ideal Solution

The text should provide a legal basis and harmonise the definition, the conditions and the procedural elements for the amicable resolution of complaints:

• definition: an amicable settlement should be defined as a process where the controller/processor and the complainant reach an amicable solution, and where the SAs act as a mediator;
  
  
• legal basis: the text of the GDPR itself should provide the legal basis for amicable settlements. ;
  
  
• conditions: the text should clarify when and how amicable settlements can take place (e.g. upon proposition of the data subject, the controller, and/or the SA), as well as a maximum timeframe for the negotiations. In no circumstances should the amicable settlement be possible without the prior agreement of the complainant (otherwise, amicable settlement can become an exit door for controllers).

Proposed Solution

Concepts 9 and 14 should take care of these issues. A general definition of “amicable resolutions”, highlighting that they must be based on a withdrawl of the complaint by the data subject and must be somewhat formal would be useful.

Reference to specific noyb cases:

See cookie banners cases: C-037-10028; C-037-10319; C-037-10445; C-037-10517; C-037-10753; C-037-
11008; C-037-11143; C-037-11200; C-037-11432; C-037-12140; C-037-602; C-037-224; C-037-
312; C-037-208; C-037-213; C-037-106; C-037-306; C-037-210

Reference to EDPB documents/table:

Inspiration can be drawn from EDPB internal document 06/2021 on amicable settlements.

For the Irish DPC, trying to reach an amicable settlement first is the default mode of action.

With regard to the process for the handling of complaints, Section 109(2) of the Irish Data Protection Act 2018 provides that the DPC, where it considers that there is a reasonable likelihood of the parties concerned reaching, within a reasonable time, an amicable resolution of the subject matter of the complaint, may take such steps as it considers appropriate to arrange or facilitate such an amicable resolution.

The DPC has therefore taken an approach that it “must first examine the possibility of arranging an amicable resolution of complaints”.

In situations where complaints are amicably resolved, they are deemed to have been withdrawn by the complainant.