Procedure

A letter from the supervisory authority has arrived

The scope of the reply follows from the reason the letter gives, not from the length of the questionnaire. A complaint under Art. 77 GDPR obliges the authority to investigate to the extent appropriate and to inform the complainant, but not to impose a fine. Under the Court of Justice there is no individual right to one.

A letter from the authority, with a deadline

In the inbox sits a letter from the state data protection authority, with a list of questions and a two-week deadline. Who complained is not stated. In the meeting the talk turns at once to how much has to be said, and in what tone.

The scope follows from the reason, not from the questionnaire

How full a reply has to be is decided by what the matter is actually about. Art. 31 GDPR requires cooperation on request, and section 40(4), first sentence, BDSG requires information in so far as it is necessary for the authority’s tasks. The yardstick is therefore necessity and not the length of the list.

What a usable reply contains

The facts in the order in which they happened, with dates and responsibilities
The legal basis of the processing complained of, named rather than hinted at
The documents the text relies on, as attachments rather than as an offer
What has already been changed, with the date, and what will be changed by when
A named contact with a direct line

The tone of the reply follows from that as well. An authority establishing the facts needs facts, not submissions on why its questions are held to be inadmissible. Conversely, an unordered delivery of files does not discharge the duty to cooperate either, because it shifts the analysis onto the authority.

The reason says more about the course than the tone of the letter

The reason behind a procedure can rarely be read off an official standard letter. A standard letter is therefore often over-interpreted. Where a complaint under Art. 77 GDPR lies behind it, the authority is obliged to investigate and inform under Art. 57(1)(f) GDPR. At the same time the period under Art. 78(2) GDPR is running. If the complainant receives no word on the progress or the outcome within three months, they may seek judicial redress. The short deadline for a reply therefore often follows from procedural law and not from a preliminary view on the case.

Why the deadline in the letter is short

The complaint arrives
A data subject turns to the supervisory authority under Art. 77 GDPR.
The authority investigates
Art. 57(1)(f) GDPR obliges it to investigate to the extent appropriate and to inform the complainant.
after three months
The court route opens
Without word on the progress or the outcome, the complainant may seek judicial redress under Art. 78(2) GDPR.

Four reasons and what they lead you to expect

A complaint by a data subject

The subject matter is narrow and follows from what the complainant says. The investigation has to be to the extent appropriate under Art. 57(1)(f) GDPR, so not exhaustive, and it ends with the complainant being informed.

Our own notification under Art. 33 GDPR

The facts are already settled, namely by your own notification. Follow-up questions typically concern the measures under Art. 32 GDPR and the communication to the data subjects.

An own-initiative inspection

Often a sweep on one topic, such as consent banners or employee data. The questionnaire is then the same for many addressees, and the reply may confine itself to your own situation.

A tip-off from the surroundings

A tip-off from the press, a competitor or the workforce. The subject matter is open, and it is therefore worth asking about the reason before writing up the facts.

A finding of an infringement does not automatically lead to the next level of escalation. Under the judgment of the Court of Justice of 26 September 2024 it gives rise neither to an obligation to take a corrective measure nor to an obligation to impose a fine. The complainant has no individual right to any particular supervisory action. What the authority owes is an appropriate response. Art. 58(2) GDPR opens up a range for that, reaching from a warning to a ban on processing.

How we support you with the response to the authority

The reply comes together in three steps. First the reason is established, if need be by asking the authority. Then the facts are written up, with dates, responsibilities and documents. The legal analysis comes last, and only on the points the letter raises. In that order a supervisory authority’s enquiry can be dealt with most efficiently.

Frequently asked questions

Do we have to answer everything?

The duty to give information under section 40(4), first sentence, BDSG extends as far as the information is necessary for the authority to perform its tasks. The second sentence grants a right to refuse where the answer would expose the person to the risk of criminal prosecution or administrative fine proceedings, and the third sentence requires them to be told so. Where that case is in play, legal advice belongs with it.

Can the deadline be extended?

As a rule, yes. A reasoned request before the deadline expires, naming a specific new date, is often granted. Letting it pass without word is treated as a failure to cooperate, and cooperation is a factor in setting a fine under Art. 83(2)(f) GDPR.

Should we point out our own shortcomings?

Often yes. A shortcoming named together with a plan to remedy it stands differently from one the authority finds. Art. 83(2) GDPR expressly names cooperation as a factor. The limit is drawn by the right to refuse under section 40(4), second sentence, BDSG.

Does a complaint end in a fine?

Rarely. Under the judgment of the Court of Justice of 26 September 2024 in Case C-768/21, a finding of an infringement carries no obligation to take a corrective measure, still less to impose a fine. The authority has to respond appropriately, and Art. 58(2) GDPR gives it a range of means from a warning to a ban on processing.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.