(crossposted from !gdpr)
Where should an Article 77 GDPR complaint be sent when a cross-border scenario involves a data subject outside of Germany?
Do data subjects have a choice between the federal agency and the regional?
I could not find any PDF forms for art.77 complaints in Germany. Do they exist?
The list of agencies is on this page:
https://www.datenschutzkonferenz-online.de/datenschutzaufsichtsbehoerden.html
7 Comments
Scipitie@lemmy.dbzer0.com · 2 pts · 189d
I think you are mixing up two concepts: One is the generic European data protection act(s) and another is the German specific implementation, the DSGVO. (Edit: mixed up my laws)
The EU is quite awesome in that regard: You send complaints to your countries data protection agency.
Article 77 is just making this explicit: You complain where you are living (even cross country!), where you work or where the suspected violation took place. It doesn't say anything more.
Because of this there is no standard form to fill out: it depends on the agency itself where you choose to enter your complaint.
That's the huge downside in the German system then: in the worst case they enter a game of responsibility ping pong.
A_norny_mousse@piefed.zip · 2 pts · 188d
No, the GDPR is the European one. G=General, not Germany.
Scipitie@lemmy.dbzer0.com · 2 pts · 188d
Thanks for he correction, I became confused because of the paragraph 77 part and my brain went full LLM :/
Corrected!
ciferecaNinjo@fedia.io · 2 pts · 189d
Indeed I am exploiting that option. I have lost confidence in my country of residence. The EDPB reports show that most DPAs are understaffed and up to their necks in work. Germany was an exception. Germany has far more resources for GDPR complaints than most of Europe.
So Germany does not have a nationwide form? Each of the 17 agencies have their own? I guess I have to work out which region I am dealing with first.
But before that, I need to know if the federal agency is who I am working with. The data controller referred me to the Federal agency, but that seems off.. from what I have read, the Federal agency is just a single point of contact for the EDPB. I see nothing about the fed handling GDPR complaints.
(edit) I found the relevent region. I think I’ll distrust the controller’s referral to the federal office and use the regional. Which has its own form.
Scipitie@lemmy.dbzer0.com · 2 pts · 189d
The good news is: you can just try! Even the federal one I'd guess would just forward you to the appropriate one.
Good luck!
A_norny_mousse@piefed.zip · 1 pts · 188d
Art. 77 says:
You need a "Aufsichtsbehörde". And it says that it doesn't matter if it's it's where you live, work, or where the bad thing happened.
BTW, the word "Staat" does NOT refer to one of Germany's regions but to the whole country. So, a "staatliche (federal) Aufsichtsbehörde" would be best I guess.
Art 78 is short, you should read it, and further Art 78 I guess.
Scipitie@lemmy.dbzer0.com · 1 pts · 189d
The good news is: you can just try! Even the federal one I'd guess would just forward you to the appropriate one.
Good luck!