E-12/19 Adpublisher AG v K
EFTA-case
Klik hier voor het dossier van het EVA-hof (voor zover beschikbaar). Deadlines: Motivation ministry: 31 January 2020 Written observations: 17 March 2020 (ultimate deadline)
Keywords : anonymisation, complaint procedure, GDPR
Subject :
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Facts of the case:
On 18-11-2018, the defendant brought a complaint before the Commissioner for Data Protection for Lower Saxony against the applicant, a public limited company under Liechtenstein law, concerning an infringement of Article 15 of the GDPR. In that complaint, the defendant alleges that on 03-11-2018 he requested full information from the applicant in accordance with Article 15 of the GDPR. However, the information provided pursuant to Article 15 of the GDPR in early November by the applicant contained errors. The complaint was uploaded on 24-01-2019 to the IMI system, an electronic system for the exchange of information between the data protection authorities of the Member States. The relevant authority, the Data Protection Authority for the Principality of Liechtenstein accepted on 06-03-2019 in the IMI system that it is competent in the present complaint procedure as the lead supervisory authority pursuant to Article 56(3) of the GDPR and thus affirmed its competence. The relevant authority upheld the defendant’s complaint in part and determined an infringement of Article 15 of the GDPR. The applicant challenged that decision before the Liechtenstein Board of Appeal for Administrative Matters and requested the Board to grant the appeal at hand and to set aside the decision challenged. Since the defendant is anonymous it must be determined whether a complaint procedure during which the complainant remains anonymous is permissible in the first place. The second question is related to the obligation to reimburse the costs of a complaint procedure. If such an obligation is not precluded the question arises as to how the recovery of costs can be enforced against someone who remains anonymous.
Request for an advisory opinion:
1) Does it follow from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) or from another provision of EEA law that an adversarial general procedure to hear a complaint may be carried out under the GDPR without disclosing the name and address of the complainant in the complaint procedure?
If the answer to the question is in the affirmative: Is it necessary in this case that a legitimate reason for the anonymisation is at least prima facie established or are no reasons required for the anonymisation?
2) Must a Member State ensure in its national procedural law that in a procedure to hear a complaint in accordance with Article 77 of the GDPR all further national appellate bodies are free of charge for the data subject and that the data subject may also not be ordered to reimburse the costs?
3) If Question 1 is answered in the affirmative and Question 2 is answered in the negative, in other words, an adversarial general procedure to hear a complaint may be carried out under the GDPR without identifying the name and address of the complainant in the complaint procedure and national procedural law is not required to ensure that in a procedure to hear a complaint in accordance with Article 77 of the GDPR all further national appellate bodies are free of charge for the data subject, the question arises how a decision resulting from a complaint procedure and ordering the data subject – who remains, however, anonymous –can be effected to reimburse the costs?
Cited (recent) case-law: /
Policy area: JenV, BZK
