Germany

184 readers

1 users here now

founded 1 year ago

MODERATORS

Germany has 17 DPAs, each covering a region. Plus there is a federal DPA, apparently. Where do complaints go on cross-border situations? (www.datenschutzkonferenz-online.de)

submitted 2 months ago by ciferecaNinjo@fedia.io to c/Germany@europe.pub

7 comments fedilink hide all child comments

(crossposted from !gdpr)

Where should an Article 77 GDPR complaint be sent when a cross-border scenario involves a data subject outside of Germany?

Do data subjects have a choice between the federal agency and the regional?

I could not find any PDF forms for art.77 complaints in Germany. Do they exist?

The list of agencies is on this page:

https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html

top 7 comments

sorted by: hot top controversial new old

[–] Scipitie@lemmy.dbzer0.com 2 points 2 months ago (2 children)

I think you are mixing up two concepts: One is the generic European data protection act(s) and another is the GDPR, which is German specific implementation.

The EU is quite awesome in that regard: You send complaints to your countries data protection agency.

Article 77 is just making this explicit: You complain where you are living (even cross country!), where you work or where the suspected violation took place. It doesn't say anything more.

Because of this there is no standard form to fill out: it depends on the agency itself where you choose to enter your complaint.

That's the huge downside in the German system then: in the worst case they enter a game of responsibility ping pong.

[–] ciferecaNinjo@fedia.io 2 points 2 months ago (3 children)

Article 77 is just making this explicit: You complain where you are living (even cross country!), where you work or where the suspected violation took place. It doesn't say anything more.

Indeed I am exploiting that option. I have lost confidence in my country of residence. The EDPB reports show that most DPAs are understaffed and up to their necks in work. Germany was an exception. Germany has far more resources for GDPR complaints than most of Europe.

Because of this there is no standard form to fill out: it depends on the agency itself where you choose to enter your complaint.

So Germany does not have a nationwide form? Each of the 17 agencies have their own? I guess I have to work out which region I am dealing with first.

But before that, I need to know if the federal agency is who I am working with. The data controller referred me to the Federal agency, but that seems off.. from what I have read, the Federal agency is just a single point of contact for the EDPB. I see nothing about the fed handling GDPR complaints.

(edit) I found the relevent region. I think I’ll distrust the controller’s referral to the federal office and use the regional. Which has its own form.

[–] Scipitie@lemmy.dbzer0.com 2 points 2 months ago

The good news is: you can just try! Even the federal one I'd guess would just forward you to the appropriate one.

Good luck!

[–] A_norny_mousse@piefed.zip 1 points 2 months ago* (last edited 2 months ago)

Art. 77 says:

Jede betroffene Person hat unbeschadet eines anderweitigen verwaltungsrechtlichen oder gerichtlichen Rechtsbehelfs das Recht auf Beschwerde bei einer Aufsichtsbehörde, insbesondere in dem Mitgliedstaat ihres gewöhnlichen Aufenthaltsorts, ihres Arbeitsplatzes oder des Orts des mutmaßlichen Verstoßes

Every person has, without prejudice to any other administrative or judicial remedy, the right to lodge a complaint with a supervisory authority, in particular in the Member country of his or her habitual residence, place of work or the place of the alleged infringement

You need a "Aufsichtsbehörde". And it says that it doesn't matter if it's it's where you live, work, or where the bad thing happened.

BTW, the word "Staat" does NOT refer to one of Germany's regions but to the whole country. So, a "staatliche (federal) Aufsichtsbehörde" would be best I guess.

Art 78 is short, you should read it, and further Art 78 I guess.

[–] Scipitie@lemmy.dbzer0.com 1 points 2 months ago

The good news is: you can just try! Even the federal one I'd guess would just forward you to the appropriate one.

Good luck!

[–] A_norny_mousse@piefed.zip 0 points 2 months ago (1 children)

One is the generic European data protection act(s) and another is the GDPR, which is German specific implementation.

No, the GDPR is the European one. G=General, not Germany.

[–] Scipitie@lemmy.dbzer0.com 2 points 2 months ago

Thanks for he correction, I became confused because of the paragraph 77 part and my brain went full LLM :/

Corrected!