The complaint to the European Commission

1. On 20 August 2018, the complainant sent an infringement complaint to the European Commission alleging that the Health Service Executive (HSE) of Ireland had violated her right to the protection of her personal data.

2. In the complaint and subsequent letters to the Commission, the complainant stated that the HSE and the body responsible for regulating health and social care professionals (CORU) had illegally processed her personal data, in breach of the EU General Data Protection Regulation (GDPR)[1].  She also referred to a complaint that she had lodged against the Office of the Data Protection Commissioner (ODPC) for failing to investigate her complaint against CORU. She further noted that the ODPC had been unable to provide her with a timeline for completing its investigation of two other complaints that she had submitted to it against the Irish Child and Family Agency (Tusla).

The European Commission’s response to the complainant

3.  On 21 September 2018, the Commission sent a letter to the complainant explaining that it was for national authorities to deal with the matters she had complained about and that it would be for the complainant to pursue the matters before the relevant national court.

4. The complainant was not satisfied with the Commission’s response and complained to the Ombudsman about the Commission’s refusal to open infringement proceedings against Ireland concerning the GDPR. She also raised the Commission’s failure to reply to her latest correspondence, including her request for information on how to appeal against its pre-closure letter on her infringement complaint[2].

The European Ombudsman's findings

5. After the complainant turned to the Ombudsman, the Commission replied to her latest correspondence, providing her with a more comprehensive explanation for why it cannot monitor compliance by Member States with the General Data Protection Regulation (GDPR) in individual cases.

6. In its reply, the Commission was right to point out that Member States “have the primary responsibility for transposing, implementing and applying EU law correctly” and that in this case, the “monitoring and enforcement of the application of the GDPR falls within the competence of the data protection supervisory authorities (in the case of Ireland, the ODPC) and courts (...).”

7. The complainant had also noted that by failing to deal with her complaint and provide her with information on the progress and outcome of its investigation, the ODPC had deprived her of the possibility of appealing its decision before the competent Irish courts. Again, the Commission was right to point out that, as laid down in Article 78(2) GDPR, “if the ODPC does not handle the complaint or does not inform you within three months on the progress or outcome of the complaint, you are entitled to take the matter to the competent national court”.

8. As regards possibilities of appeal, as outlined by the Commission in its pre-closure letter, should the complainant have any new information that might be relevant for the re-assessment of her case, she should contact the Commission within four weeks of receiving the letter. Beyond this option, the Ombudsman notes that there are no possibilities of appeal.

9. Based on the information provided by the complainant, the Ombudsman finds no maladministration in this case[3].

 

Lambros Papadias

Head of Inquiries - Unit 3

Strasbourg, 23/11/2018

 

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), http://data.europa.eu/eli/reg/2016/679/2016-05-04

[2] Where the Commission envisages taking no further action on a complaint, it normally gives a complainant prior notice, in a so-called ‘pre-closure letter’..

[3] This complaint has been dealt with under delegated case handling, in accordance with Article 11 of the Decision of the European Ombudsman adopting Implementing Provisions