Complaints handling, Investigations and Enforcement For Organisations
What happens when a concern is raised with the Data Protection Commission against my organisation?
Where an individual is unhappy about the manner in which your organisation has handled their personal data, they have a right to raise a concern with the Data Protection Commission (DPC). For example, an individual may be unhappy with your response to an access request they have submitted to you, or they may be concerned about direct marketing material they have received from you, or they may feel that you have been responsible for a breach of their personal data.
A general guide to the obligations and responsibilities of organisations under data protection legislation is available here.
Where an individual contacts this office for guidance in relation to their concerns, we will generally advise them to contact the organisation directly in the first instance. We would encourage organisations to attempt to resolve the matter with the individual at that stage.
If an individual is dissatisfied with the response they receive, or if they do not receive a response, they may proceed to raise a concern with this office. Please click on/hover your mouse over the relevant section of the diagram below for more information on how a concern raised by an individual against your organisation may progress through this office.
When an individual raises a concern with this office, the matter will be first assessed to ensure the matter falls within our remit to address. We will also require the individual to upload (or otherwise provide to us) evidence to support their case, and in the course of our assessment we may need to contact the individual to obtain further information about the matter they have raised.
Once we are satisfied that the issue(s) raised come within our remit, the case will be progressed through this office as appropriate. Depending on the nature of the concern have raised, there are a number of possible ways in which the DPC may seek to resolve the matter.
The Data Protection Act 2018 (“the Act”) sets down the parameters which determine how the DPC may handle a concern that an individual raises with us. The DPC is empowered under the Act to take such action as we consider appropriate in respect of the concern. In the first instance, we are mandated to facilitate or arrange an amicable resolution of the matter, where there is a reasonable likelihood of this being achieved, within a reasonable time. Where it appears, on an initial examination of the matter, that the concern being raised against your organisation may have a valid basis and may involve a breach of an individual’s data protection rights, we would encourage you to consider making an appropriate gesture by way of amicable resolution. This can result in the timely resolution of the matter and may preclude the need for this office to exercise its formal powers under the Act.
Where an individual has raised a concern about your organisation that cannot be amicably resolved within a reasonable time (for example where the individual does not accept a gesture on the part of your organisation by way of amicable resolution), the Data Protection Act 2018 sets down the various steps that this office may take to resolve the matter. These include:
- rejection of the complaint.
- dismissal of the complaint.
- providing advice in relation to the matter.
- serving on the organisation to which the concern relates an enforcement notice, requiring it to comply with an individual’s request to exercise their data protection rights, or to communicate a personal data breach to an individual.
- causing such inquiry as the DPC thinks fit to be conducted in respect of the matter.
- making such other action in respect of the matter as the DPC considers appropriate.
The majority of cases raised with this office will be resolved either by way of amicable resolution or (where amicable resolution cannot be achieved) at the complaint handling stage. If an individual raises a concern against your organisation, and the concern cannot be amicably resolved, or if the processing of personal data which is the subject matter of the concern of has not been remedied, you may be served with an enforcement notice (as outlined at point (d) above) requiring you to comply with the individual’s request to exercise their data protection rights (e.g. to issue a response to their access request, or to communicate a breach of the individual’s personal data to them).
In addition to handling complaints to the extent appropriate, the DPC has the power to conduct an inquiry (either with or without an accompanying investigation), which may result in your organisation being subject to an administrative fine or other corrective power. An inquiry may result from a concern raised with this office, or may be conducted of the DPC’s own volition.
An inquiry (with or without investigation) may also result in the DPC issuing a formal decision in relation to the matter. Generally speaking, the DPC will only consider commencing an inquiry where the matter raised indicates that the alleged data breach is of an extremely serious nature and/or indicative of a systemic failing within the organisation in question.
Where, on the basis of an inquiry (with or without investigation), the DPC decides that an infringement has occurred, a corrective power may be applied against your organisation. The corrective powers that may be levied by the DPC against an offending organisation include powers to:
When deciding to impose an administrative fine on an organisation, the DPC is required to give due regard to:
An administrative fine levied against an organisation for an infringement may be set at up to €20,000,000, or 4% of the organisation’s total worldwide annual turnover for the preceding financial year (whichever figure is higher).
Where an individual raises a concern with us that relates to your organisation’s processing of their personal data before 25 May 2018 (the date on which the GDPR came into force), the previous legislative regime (primarily the Data Protection Acts 1988 & 2003) may dictate how we handle the case.
Where an individual raises a concern relating to the processing of their personal data by your organisation for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties (including the safeguarding against, and the prevention of, threats to public security), the case may be handled under the provisions of the Law Enforcement Directive (LED). The LED sets out data protection rules specific to organisations which process personal data for law enforcement purposes. More information about the LED is available here.