When filing a complaint in an agency of a government or ombudsman/mediator, the traditional workplace where everyone is on-site yielded more privacy for complainants because there were more meetings and verbal discussions over the processing. So fewer records were made about complaint processing and decision making.
Now with all the post-pandemic teleworking, most office workers collaborate on cases remotely. Thus more personal data ends up in internal email between case workers. Superficially that’s a detriment to data subjects. Most agencies are Microsoft boot-lickers so MS is needlessly in the loop on your sensitive data. Yikes!
To reduce exposure to MS, I only submit complaints offline on paper. In some cases, MS is at least out of the loop on correspondence to and from me. In other cases, MS sees it anyway because some receptionists are tasked with scanning postal mail then emailing it (indeed, we are fucked in this regard because there is no MS opt-out in those situations).
The advantage we can exploit
There is one little known advantage to this shitshow: when your case or complaint yields an unsatisfying result without rationale or with clumbsy/broken rationale, you can do a GDPR access request for all records. This includes all internal email among case workers and their advisors. It’s a way to gain powerful insight into the REAL reason your case was treated adversely. And that can be used against them.
Snag 1
Privacy policies sometimes give an email address for the DPO but either no offline contact information or the general mailing address for the whole agency. This means your snail mail letter could be internally delivered to your case worker based on your return address. Thus, the staff who fucked you over to begin with sees your request first, which triggers them to delete all email that embarrasses them about the case. Their CMY¹ move likely works. By the time the DPO gets the request on their desk, they have no incentive to assume malice and try to dig up deleted messages (assuming that’s even possible).
¹ CMY: cover my ass
Snag 2
Some orgs wildly interpret what “personal data” is. I’ve known a data controller to deny a GDPR request on the basis that “someone’s email address is not personal data”. So there is not much to stop them from claiming information about a case is not the personal data of the complainant.
It last worked in 2024. Throughout 2025 it presents the forms, accepts the document, then gives an instant permission denied when sending. Tried creating a new acct and same problem.