Data Protection Complaints (2018)
Individuals (or a body or organisation on behalf of the individual) have the right to lodge a complaint with the Commissioner. (Article 77 Applied GDPR and Regulation 122 of the Implementing Regulations)
It is the Commissioner’s task to handle such complaints and the subject matter of complaints must be investigated to the extent appropriate. (Article 57(1)(f) Applied GDPR and Regulation 77 of the Implementing Regulations)
The Commissioner has a range of investigative powers that can be used to handle complaints and will decide on the most appropriate manner in which to investigate the complaint.
This can depend on the extent to which, among other things, the complaint raises a matter of substance, the damage that is likely to be caused to an individual(s), any undue delay in making the complaint, and whether the complainant has exercised, or tried to exercise, their rights already.
Progress and outcome of complaint
The Commissioner will consider all the evidence and information provided by the complainant, the controller, processor and any obtained, or observations made, through other means to decide whether any infringement has occurred. Information obtained by the Commissioner in the exercise of tasks is confidential.
Having taken into account any infringements of the data protection law, the Commissioner will use the corrective powers considered necessary in the circumstances.
The Commissioner must inform the complainant of the progress or the outcome of the investigation into the complaint within a 'reasonable period', generally within three months, in particular if further investigation or coordination with a supervisory authority outside the Island is required.
The outcome, including any corrective action, will be communicated to the complainant and the controller or processor.
Information about the Commissioner's investigative powers and corrective powers can be found on the website at: https://www.inforights.im/information-centre/data-protection-law-2018/powers-of-the-commissioner/
Remedies of the individual
If the Commissioner does not handle the complaint or inform the individual about the progress or outcome of the complaint within three months, the individual can make an application to the Data Protection Tribunal for an order to progress the complaint. (Regulation 123 of the Implementing Regulations)
An individual may, at any time, apply directly to court for a compliance order against the controller. (Article 79 Applied GDPR and Regulation 124 of the Implementing Regulations)
The Commissioner cannot award compensation; however, individuals have the right to seek compensation for damage from the controller through the court. (Article 82 of the Applied GDPR and Regulation 125 of the Implementing Regulations)
More information about the remedies for individuals is available on the website at: https://www.inforights.im/information-centre/data-protection-law-2018/remedies-for-individuals/
Appeals against notices issued by the Commissioner
Legally binding notices issued by the Commissioner in respect of corrective actions can be appealed to the Data Protection Tribunal. (Article 78(1) of the Applied GDPR and Regulation 120 of the Implementing Regulations)
More information about appeals to the Data Protection Tribunal is available on the website at: https://www.inforights.im/complaint-handling/data-protection-tribunal/