What is the European Data Protection Supervisor ?

The European Data Protection Supervisor (EDPS) is the EU’s independent data protection authority, with the
task of ensuring that the fundamental rights and freedoms of natural persons, and in particular their privacy, with regard to the processing of personal data are respected by the EU institutions and bodies.

Regulation (EC) 45/2001 establishes the EDPS responsible for monitoring the processing of personal data by EU institutions and bodies. Each institution has a Data Protection Officer (DPO) who cooperates with the EDPS. The European Commission adopted a proposal on 10 January 2017 which repeals Regulation (EC) 45/2001 and brings it into line with the General Data Protection Regulation. The proposal is currently under discussion in the European Parliament and the Council of the European Union.

When to file a complaint to the EDPS ?

If some rights have been infringed by an EU institution processing personal data and if the data subject has not been able to settle this with the institution concerned or its DPO, he can lodge a complaint with the European Data Protection Supervisor to investigate by using the online complaint form. The first step is therefore to contact the institution or its DPO to resolve the problem amicably. For instance, if the data subject wants to exercise his right of rectification, he should first request the institution to rectify his personal data. If not, the reasons for that will be properly explained in the complaint form.

In practice, data protection rights may have been infringed by the EU administration when excessive amounts of personal data is being collected or personal data has been shared with third parties without data subject’s consent.

It is also important to keep in mind that a complaint must be made within two years of the date the data subject became aware of the facts on which his complaint is based.

What are the inadmissible complaints ?

Let us underline that if data protection rights have not been infringed by one of the EU institutions, the complaint will be inadmissible. The EDPS has indeed no supervisory powers for dealing with complaints on the processing of personal data by national authorities, private companies or organisations, or not-for-profit organisations.

Moreover, the EDPS does not supervise the judicial activities of the Court of Justice of the European Union (CJUE). However, it is of course possible for the EDPS to handle complaints against the CJUE in its processing of personal data as an administration.