Here are a few things to consider in a cross border complaint, according to the International Association of Privacy Professionals’ Data Protection Congress panel with Isabelle Vereecken of the European Data Protection Board, Cedric Burton of Wilson Sonsini Goodrich & Rosati, Romain Robert, a former NOYB program director, and Antonio Caselli of The Italian Data Protection Authority.
- The new regulations will have required minimum provisions to make sure that the complaint is admissible despite the different state law formalities to figure out who is the lead supervisory authority.
- If you receive an RFI from the DPA you must reply. It’s not a formal investigation, but cooperation is important.
- You may receive multiple RFIs from different DPAs until the LSA is chosen.
- There are now going to be rules regarding selecting the LSA.
- If possible, it’s important to determine the main establishment of the party sued. That obviously impacts the determination of the LSA.
- After a formal complaint is filed, informal consultation may happen.
- The preliminary comments don’t have to be circulated for comments. But in the proposed regulations, more collaboration at an earlier stage is contemplated and leading to better harmonization. Also, deadlines are proposed to be added. Mostly for the CSAs.
- The draft regulations do not add additional rights to the complainant and by harmonizing, it actually decreases the rights sometimes. (For example, in Belgium, the complainant has right regarding access and expressing opinions that are on par with the controller.)
- The CSA objections should relate to the objections regarding violations of GDPR and that the proposed decision constitutes a breach of fundamental human rights.
- Of 900 OSS cases, the EDPB took action only in 11 cases.
- Where there is an unresolved objection, the EDPB gets involved. The EDPB is not an appeal body. It just assesses the objections.
- First, there is a process to make sure the file is complete.
- The EDPB secretariat conducts a legal analysis and then brings it to the members.
- Sometimes, EDPB decides an objection is not reasoned or relevant enough. It’s a majority decision.