EDPB Rules Standardized Complaints Cannot Be Dismissed as Abuse of Rights
Written by AI from the linked story. Not reviewed by an editor. How this works
The Belgian Data Protection Authority (APD) attempted to dismiss a data protection complaint filed by noyb against VRT by characterizing standardized complaint submissions as an abuse of rights, rather than assessing the complaint on its merits. The EDPB's binding decision clarifies that procedural standardization alone does not invalidate a complaint, forcing the APD to conduct a substantive review. This matters because supervisory authorities cannot use procedural technicalities as a shield against legitimate enforcement, undermining the effectiveness of GDPR rights. Organizations and regulators alike must recognize that citizens' rights to lodge complaints are foundational to GDPR accountability, and attempts to circumvent this erode public trust in data protection frameworks.
Tactical Insight
Immediate actions
- Review all active data subject complaints to ensure none have been dismissed on procedural grounds without substantive merit assessment.
- Establish an internal triage process that separates procedural validity checks from merit-based evaluations of complaints.
Compliance & governance improvements
- Train legal and compliance teams on EDPB binding decisions and guidance to ensure consistent, lawful handling of data subject rights requests.
- Implement a documented complaint-handling policy that explicitly prohibits dismissal of complaints solely based on their standardized or templated format.
- Appoint a Data Protection Officer (DPO) or compliance lead to monitor EDPB decisions and update internal procedures accordingly.
Long-term risk management
- Conduct periodic audits of complaint handling workflows against GDPR Articles 57, 77, and 78 to ensure full compliance.
- Engage proactively with supervisory authorities to align on acceptable complaint processing standards before disputes escalate to binding decisions.