Procedure

A letter from the supervisory authority has arrived

The scope of the reply follows from the reason the letter gives, not from the length of the questionnaire. A complaint under Art. 77 GDPR obliges the authority to investigate to the extent appropriate and to inform the complainant, but not to impose a fine. Under the Court of Justice there is no individual right to one.

A letter from the authority, with a deadline

In the inbox sits a letter from the state data protection authority, with a list of questions and a two-week deadline. Who complained is not stated. In the meeting the talk turns at once to how much has to be said, and in what tone.

The scope follows from the reason, not from the questionnaire

How full a reply has to be is decided by what the matter is actually about. Art. 31 GDPR requires cooperation on request, and section 40(4), first sentence, BDSG requires information in so far as it is necessary for the authority’s tasks. The yardstick is therefore necessity and not the length of the list.

What a usable reply contains

The facts in the order in which they happened, with dates and responsibilities
The legal basis of the processing complained of, named rather than hinted at
The documents the text relies on, as attachments rather than as an offer
What has already been changed, with the date, and what will be changed by when
A named contact with a direct line

The tone follows from that. An authority establishing the facts needs particulars, not a view on whether its questions are admissible. A delivery of files without any structure is conversely not cooperation, because it shifts the work.

The reason says more about the course than the tone of the letter

What the reason says about the procedure often cannot be read off a standard letter, and its sharpness regularly leads to the wrong inference. Where a complaint under Art. 77 GDPR lies behind it, the authority has to investigate and inform under Art. 57(1)(f) GDPR, and under Art. 78(2) GDPR the complainant may go to court after three months without word. The short deadline in the letter often comes from that clock and not from a view on the merits.

Four reasons and what they lead you to expect

A complaint by a data subject

The subject matter is narrow and follows from what the complainant says. The investigation has to be to the extent appropriate under Art. 57(1)(f) GDPR, so not exhaustive, and it ends with the complainant being informed.

Our own notification under Art. 33 GDPR

The facts are already settled, namely by your own notification. Follow-up questions typically concern the measures under Art. 32 GDPR and the communication to the data subjects.

An own-initiative inspection

Often a sweep on one topic, such as consent banners or employee data. The questionnaire is then the same for many addressees, and the reply may confine itself to your own situation.

A tip-off from the surroundings

A tip-off from the press, a competitor or the workforce. The subject matter is open, and it is therefore worth asking about the reason before writing up the facts.

What stands at the end is rarely what is feared. Under the judgment of 26 September 2024, a finding of an infringement carries no obligation to take a corrective measure and in particular none to impose a fine. The complainant has no individual right to one. What is owed is an appropriate response, and Art. 58(2) GDPR ranges from a warning to a ban on processing.

How we support you with the response to the authority

The reply comes together in three steps. First the reason is established, if need be by asking the authority. Then the facts are written up, with dates, responsibilities and documents. The legal analysis comes last, and only on the points the letter raises. In that order the work typically takes two to three days.

Frequently asked questions

Do we have to answer everything?

The duty to give information under section 40(4), first sentence, BDSG extends as far as the information is necessary for the authority to perform its tasks. The second sentence grants a right to refuse where the answer would expose the person to the risk of criminal prosecution or administrative fine proceedings, and the third sentence requires them to be told so. Where that case is in play, legal advice belongs with it.

Can the deadline be extended?

As a rule, yes. A reasoned request before the deadline expires, naming a specific new date, is often granted. Letting it pass without word is treated as a failure to cooperate, and cooperation is a factor in setting a fine under Art. 83(2)(f) GDPR.

Should we point out our own shortcomings?

Often yes. A shortcoming named together with a plan to remedy it stands differently from one the authority finds. Art. 83(2) GDPR expressly names cooperation as a factor. The limit is drawn by the right to refuse under section 40(4), second sentence, BDSG.

Does a complaint end in a fine?

Rarely. Under the judgment of the Court of Justice of 26 September 2024 in Case C-768/21, a finding of an infringement carries no obligation to take a corrective measure, still less to impose a fine. The authority has to respond appropriately, and Art. 58(2) GDPR gives it a range of means from a warning to a ban on processing.

Get in touch!

Have we sparked your interest? Do you have questions? Would you like a quote without obligation? We look forward to hearing from you!

Alternatively you can request a call back.