Background to the complaint

1. The complainant is a former EU staff member. In December 2017, she submitted a complaint to the European Data Protection Supervisor (EDPS) about the processing of her personal data by the European External Action Service (EEAS). She requested access to and rectification of several documents, which she claimed contain her personal data, including documents related to an administrative inquiry.

2. In April and June 2018, the EEAS was in touch with the complainant on the matter and provided some access to some personal data. However, it did not grant access to the remainder of the personal data while the administrative inquiry was ongoing. In June and October 2018, the complainant informed the EDPS that she was not satisfied with how the EEAS was handling the matter.

3. In December 2018, the EDPS contacted the EEAS for clarifications and comments on the complainant’s allegations.

4. In April 2019, the EDPS suspended[1] its handling of the complaint, as the complainant had launched judicial proceedings about the matter. This was in line with the rules governing the EDPS’s work.[2]

5. In the meantime, the EEAS informed the EDPS that it had granted the complainant access to all the documents that she was entitled to receive in relation to the administrative inquiry.

6. In March 2020, following the closure of some judicial proceedings, the complainant informed the EDPS that she was not satisfied with the documents and the personal data that she had received. She requested access to other documents that she claimed contain her personal data.

7. In June 2020, the EDPS contacted the EEAS again and asked it to clarify if the documents mentioned by the complainant contained her personal data. The EEAS replied that the complainant’s request for access to personal data was not sufficiently clear. The EEAS also said that some of the documents either did not exist or did not contain the complainant’s personal data. The EDPS forwarded the EEAS’s reply to the complainant. She reiterated her claim to the EDPS that she should be granted access to more documents containing her personal data.

8. In December 2020, the EDPS again suspended its handling of the complaint as the complainant had appealed some of the court judgments.[3] The EDPS re-opened the case in March 2022.

9. In July 2022, the EDPS informed the complainant that it would not be in a position to take a decision on her complaint before November 2022,[4] for human resources reasons.

10. In June 2023, following the Ombudsman’s intervention,[5] the EDPS took contact with the complainant to clarify certain issues. 

11. Dissatisfied with how the EDPS handled the matter, the complainant turned to the Ombudsman again in September 2023.

The inquiry

12. The Ombudsman opened an inquiry into the time taken by the EDPS to decide on the complaint.

13. In the course of the inquiry, the Ombudsman received the EDPS’s reply outlining its inquiry steps for the period since June 2023.[6] The Ombudsman inquiry team also met with relevant representatives from the EDPS to obtain further information on the case. The complainant provided comments on the meeting report.

Arguments presented

14. The complainant claimed that the EDPS took an excessively long time to deal with her complaint. She argued that the complexity and circumstances of the case could not justify the delay of more than six years to take a decision.

15. The EDPS acknowledged that six years is a long time to handle a complaint. However, it argued that the specific circumstances of the case justified the delay. In particular, the EDPS referred to the need to suspend its handling of the case on different occasions while different judicial proceedings were pending in line with the applicable rules governing its work. The EDPS also referred to the fact that it was active on the case outside the period where the court proceedings were ongoing, and mentioned the various contacts with the complainant and the EEAS set out above. During the meeting, the EDPS also clarified that one case was still pending before the General Court.[7]  However, the EDPS also acknowledged that internal reorganisation and lack of human resources might have contributed to the delay in handling the complaint.

16. During the inquiry, in May 2024, the EDPS took a decision partially closing the case.[8] 

The Ombudsman's assessment

17. The principles of good administration require EU bodies to take decisions within a reasonable time frame. This is particularly important when the procedure relates to the effective exercise of the fundamental right to protection of personal data.

18. What is a ‘reasonable time’ depends on the circumstances of each case. Factors to be considered include the complexity of the case, the conduct of the parties, the various procedural steps followed by the administration and the context of the case.^[9] Each procedural step should be taken within a reasonable period following the previous step.^[10] Moreover, if the duration exceeds what is a reasonable time, it is for the administration to prove the existence of special circumstances such as to justify the delay^[11] and to proactively inform the complainant about the progress of the case.

19.  The Ombudsman agrees that the EDPS acted in accordance with the rules governing its work[12] and was justified to suspend its handling of the case while different judicial proceedings were ongoing. However, this concerned a period of slightly more than two out of the six years to take a decision.

20. The Ombudsman also notes that the EDPS sought clarifications from the complainant at various stages, and that the complainant also sent additional material or submissions regularly. This might have contributed to the delay.

21. While the EDPS was certainly not inactive throughout the period of four years (when the handling of the case was not suspended due to court proceedings), the Ombudsman’s inquiry showed that there were nevertheless periods in which no activity appeared to take place. For example, no action appears to have taken place for a period of more than one year between April 2022 and June 2023 at a point in time when the EDPS should have been particularly vigilant, as the case had been ongoing since December 2017.  

22. The EDPS explained that this was partly due to reduced administrative capacity. However, EU bodies have an obligation to organise their services in a manner that can enable them to fulfil their duties. As such, human resource shortages in themselves cannot justify such a long delay. Given how long the case was open, the EDPS should have ensured that its available human resources were devoted to ensuring it could be prioritised and closed.

23. It is clear that the case was complex, and exacerbated by different, sometimes overlapping, administrative and judicial proceedings. However, in its decision of May 2024, the EDPS essentially took the view that the complainant could not rely on the ‘right to rectification’ to achieve her desired outcome in this specific case - essentially, changing the content of some of the documents concerned - as the right to rectification concerns ‘objective personal data’ only. The EDPS’s position on this matter seems well established, and it is therefore difficult to understand how it took so long to issue such a conclusion in this case.[13]

24.  Finally, the EDPS should have proactively informed the complainant about the progress of the case. Instead, the EDPS was rather reactive and would reply to the complainant following the Ombudsman’s intervention only.[14] The EDPS should consider apologising to the complainant for the delay that occurred and for its failure to keep her informed on the progress of the case.  

25. In light of the above, the Ombudsman considers that the failure by the EDPS to complete its assessment of the complainant’s complaint of December 2017 within a reasonable timeframe constitutes maladministration.

Conclusion

Based on the inquiry, the Ombudsman closes this case with the following conclusion:

The failure by the European Data Protection Supervisor to complete its assessment of the complaint within a reasonable timeframe constitutes maladministration.

The complainant and the EDPS will be informed of this decision.

Emily O'Reilly
European Ombudsman

Strasbourg, 07/11/2024

 

[1] The suspension covers the period from April 2019 to March 2020 (11 months). 

[2] The EDPS referred to Article 57(1)(e) of Regulation 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and to Article 16(6) of the EDPS’s Rules of Procedure, available respectively at: https://eur-lex.europa.eu/eli/reg/2018/1725/oj and https://www.edps.europa.eu/about/office-edps/edps-rules-procedure_en. 

[3] The suspension covers the period from December 2020 to March 2022 (16 months).

[4] The EDPS did so after the Ombudsman had opened an inquiry, following a complaint from the complainant (case 33/2023/FA).

[5] Case 768/2023/TM concerning the EDPS’s failure to update the complainant on the progress of her complaint of December 2017.

[6] Following the closure of complaint 768/2023/TM.

[7] Case T-371/21. The General Court issued its judgment on 24 January 2024, the day the meeting with the EDPS representatives took place. Subsequently, the complainant appealed the decision of the General Court (case C-243/24 P). 

[8] The complainant raised two issues, related, on one hand, to the right of access and, on the other, to the right to rectification of her personal data. In its decision, the EDPS took a position on the complainant’s allegation as regards the right to rectification only. The EDPS suspended the handling of the issue of the right of access as the case C-243/24 P was still ongoing at the time.

[9] See for instance judgment of the Court of Justice of 17 December 1998, Baustahlgewebe v

Commission, case C-185/95 P, paragraph 29, available at

http://curia.europa.eu/juris/showPdf.jsf;jsessionid=8F1C0778C9B8C96192ACB213E890C455?text=&doci

d=43779&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=4441718 and the

Ombudsman’s decision in case 484/2015/DR, paragraph 28, available at

https://www.ombudsman.europa.eu/en/decision/en/90382.

[10] See for instance judgment of the Court of Justice of 2 June 1994, De Compte v Parliament, case C-

326/91 P, paragraph 21, available at

http://curia.europa.eu/juris/showPdf.jsf?text=&docid=98282&pageIndex=0&doclang=EN&mode=lst&dir=&

occ=first&part=1&cid=4442402.

[11] See for instance judgment of the Court of Justice of 5 May 1983, Ditterich v Commission, case 207/81,

paragraph 26, available at

http://curia.europa.eu/juris/showPdf.jsf?text=&docid=91654&pageIndex=0&doclang=EN&mode=lst&dir=&

occ=first&part=1&cid=4443230.

[12] See footnote 2 above.

[13] The EDPS referred to its 2011 Guidelines concerning the processing of personal data in the area of staff evaluation and its 2016 Guidelines on processing personal information in administrative inquiries and disciplinary proceedings, paragraph 50 See for example https://www.edps.europa.eu/sites/default/files/publication/16-11-18_guidelines_administrative_inquiries_en.pdf.

See also 2014 Guidelines on the Rights of Individuals with regard to the Processing of Personal Data:  https://www.edps.europa.eu/sites/default/files/publication/14-02-25_gl_ds_rights_en.pdf#page=18 

[14] Cases 176/2019/JAP, 1658/2020/LM and 33/2023/FA.