In which Cases?

If you are not satisfied with the outcome of your grievance report, you can lodge a complaint with the Data Protection Commission (DPC) according to the provisions in section XII of OC 11.
This requires that you have received the evaluation report issued by the ODP.

Please mind that a complaint is not possible for misprocessings that did not personally impact you, that means where your own personal data was not affected.

Submitting a Complaint

You have 60 days from the receipt of the evaluation report to lodge the complaint.

If you decide to do this, please contact the ODP who will explain you the formalities and provide you with the standard complaint form to be completed with the following details, in addition to your identity:

• A detailed statement of the facts
• The impact of the impugned processing on you
• Any other relevant documentation

Handling of your Complaint

1) Assessment of receivability

The DPC has 30 days to carry out an initial assessment to decide whether the complaint is receivable. A complaint is receivable if the 60 days time limit for its submission is respected, the form contains the required information and is accompanied with the evaluation report.
Please mind that only if you reported a grievance that was evaluated by the ODP, a complaint is possible and thus receivable.

The DPC will inform you and the Director General about its decision.

2) Investigation

Once your complaint reaches the investigation stage, the DPC takes a closer look at your case.

• First, they review what you initially submitted, along with the evaluation by the ODP.
• They then ask the Organisation - represented by the HR department - to respond to your complaint and share its side of the story.
• After that, they give you a chance to react to what the Organisation said.

The DPC will consider all of this before moving forward. If needed, the DPC can dig deeper. For example, they might:

• ask for more documents or written explanations,
• invite you, the Organisation, or relevant witnesses for an interview,
• consult experts within CERN, or
• gather any other information they find useful.

If you’re invited to an interview, you don’t have to go alone—you can bring a member of former member of the personnel who is not otherwise involved in the process. In the event of force majeure, this person can also represent you during the interview.
If you do not work at CERN and would like to be accompanied, you can contact the ODP, which will find a volunteer for you.

There are also some timelines to keep things moving:

• The Organisation usually has up to 60 days to respond (with a possible extension of up to 30 more days in exceptional cases).
• Once you receive their response, you have 14 days to send your comments (this can be extended in small increments if needed).
• After that, the DPC will aim to finish its investigation within 60 days, although this can be extended once (by another 60 days) if the case is particularly complex.

In short, the DPC will gather all relevant information from both sides, give you a chance to be heard throughout the process, and then complete its investigation within a defined timeframe.

3) Opinion and recommendation

Once the investigation is finished, the DPC puts everything together into a written report for the Director-General. In this report, they explain:

• how the investigation was carried out,
• who they spoke to,
• what documents and information they reviewed,
• what facts they established, and
• whether they think your personal data was handled in a way that does not comply with the rules.

They may also include recommendations on what should happen next.

If the DPC finds that your complaint is justified, they can suggest remedies.
This may include reimbursing reasonable costs you’ve incurred (as long as you provide supporting documents).
In some cases, they may also recommend financial compensation for non-material harm (for example, distress), normally up to CHF 5,000, and in exceptional cases up to CHF 10,000.

Decision

The Director-General has 30 days to decide whether to accept the opinion and recommendations of the DPC, and another 5 days to notify you the final decision.

Together with the decision, you will be informed about the facts established in the course of the investigation and the opinions set out in the investigation report, and, where appropriate, the reasons for not following the recommendation of the DPC.

Appeal

If you believe that the decision of the Director-General adversely affects you, you may contest it:

• In case you are a member of the personnel of CERN, you may file a complaint with the Administrative Tribunal of the International Labour Organization (the ILOAT).
• Else, may challenge the decision via arbitration in accordance with Section XII of OC 11.