In which Cases?

If you are not satisfied with the outcome of your misprocessing report with respect to the processing of your personal data, you can lodge a complaint with the Data Protection Commission (DPC).

This requires that you have received the evaluation report issued by the ODP and that you can prove that your personal data was subject to the reported misprocessing. Please mind that a complaint is not possible for misprocessings that did not personally impact you, that means where your own personal data was not affected.

Submitting a Complaint

You have 60 days from the receipt of the evaluation report to lodge the complaint.

If you decide to do this, please contact the ODP who will explain you the formalities and provide you with the standard complaint form to be completed with the following details, in addition to your identity:

• A detailed statement of the facts
• The impact of the impugned processing on you
• Any other relevant documentation

Handling of your Complaint

1) Assessment of receivability

The DPC has 30 days to carry out an initial assessment to decide whether the complaint is receivable. A complaint is receivable if the 60 days time limit for its submission is respected, the form contains the required information and is accompanied with the evaluation report.
Please mind that only if your own personal data is or was affected by the processing, a complaint is possible and thus receivable.

The DPC will inform you and the Director General about its decision.

2) Investigation

In case your complaint is receivable, the DPC will the carry out its investigations by

1. Reviewing your initial misprocessing report and the evaluation of the ODP
2. Collecting the observations of the Organization on the complaint, and
3. Review the complaint and the observations of the Organization

In this context, the DPC is free to

• request additional written statements and/or documentation;
• interview you, representatives of the Organization and any pertinent witnesses, if required;
• obtain expert input from any relevant CERN service; and,
• gather any other information needed to perform its investigation.

At the interviews with the DPC you can be accompanied by a member of former member of the personnel who is not otherwise involved in the process. In the event of force majeure, this person can also represent you during the interview.
If you do not work at CERN and would like to be accompanied, you can contact the ODP, which will find a volunteer for you.

Once the Organization has provided its observations to the DPC (point c) above), the DPC must complete the investigations within 60 calendar day by issuing a written investigation report. In exceptional circumstances, this delay can be extended once, upon written notification to you and the Director General.

3) Opinion and recommendation

The investigation report will be presented to the Director General and must set out

• the statement of the procedure followed;
• the persons interviewed;
• the documentation and any additional information considered in the course of the investigation;
• the facts established;
• the DPC’s opinion(s) as to whether the facts establish that the Data Subject’s Personal Data has been processed in a manner that is not compliant with this Circular; and
• possible recommendations with follow-up measures.
  These recommendations can cover the award of appropriate remedies including reimbursement of reasonable costs upon submission of appropriate supporting documents and, where the circumstances justify, up to a maximum of 5,000 Swiss Francs in moral compensation. In exceptional and well-justified situations, the DPC may recommend moral compensation up to 10,000 Swiss Francs.

Decision

The Director-General has 30 days to decide whether to accept the opinion and recommendations of the DPC, and another 5 days to notify you the final decision.

Together with the decision, you will be informed about the facts established in the course of the investigation and the opinions set out in the investigation report, and, where appropriate, the reasons for not following the recommendation of the DPC.

Appeal

If you believe that the decision of the Director-General adversely affects you, you may contest it:

• In case you are a member of the personnel of CERN, you may file a complaint with the Administrative Tribunal of the International Labour Organization (the ILOAT).
• Else, may challenge the decision via arbitration in accordance with Section II of Annex 2 of OC 11.