Publication of the final decisions

Article(s) involved (national, EU, or other):

Problem

The SAs have different approaches regarding the publication of their decisions.

• Some SAs publish as a general rule every outcome of a complaint (like the Belgian SA), including the rejection of the complaint.
  
  
• Some SAs seem to publish some decisions on a case-by-case basis without a consistent approach (like the EDPS or the Lux SA).
  
  
• Some SAs refuse to publish or even to share the final decision with the complainant (like the Lux SA in the case of Amazon).

This limitation of access to the decisions of the SAs makes it difficult for the complainants, the controllers, processors, academia and the civil society to follow the actions of the SAs, to understand the underlying legal motivation of their decisions and therefore to access knowledge and guidance about how to comply with the GDPR. It also negatively impacts the accountability of SAs.

Ideal Solution

The text should provide for harmonised rules :

• All SAs should publish any outcome of all cases (complaint or ex officio investigation, sanction or dismissal of the case) on their website.
  
  
• Publication of the names of the contrrollers should not be seen as a corrective measure (not mentioned in Article 58 GDPR)
  
  
• The names of legal persons should only be redacted where appropriate and in limited circumstances.
  
  
• The names of complainants should always be redacted or pseudonymised, otherwise this would disincentivise complaints.

Proposed Solution

Concept 15 relates to this issue.