Art. 4 NL accreditation requirements for GDPR code of conduct monitoring bodies — Transparent complaints handling

Explanatory note: Transparent and publicly available procedures and structures to handle complaints in relation to code members from different sources are an essential element for code monitoring. This process will be sufficiently resourced and managed and personnel will demonstrate adequate (sufficient to the need) knowledge and impartiality. In order to meet these requirements the monitoring body will need to provide evidence of a documented, independent, and transparent complaints handling process to receive, evaluate, track, record and resolve complaints within a reasonable time frame. Where appropriate, information concerning the monitoring body’s decision will be provided to all concerned within a period not exceeding three months. Requirements: The monitoring body shall provide evidence of a clear framework for a publicly available, accessible and easily understood complaints handling and decision-making process. ‘This may be demonstrated for example by an outline of the procedure to receive, manage and process complaints, which in turn shall be publicly available and easily accessible.’ This procedure specifies for example; how the complainant is informed; the consequences should the complaint be rejected; the consequences should the complaint be considered justified’ The monitoring body shall acknowledge receipt of the complaint and the complainant shall be notified on the progress or outcome of the complaint without undue delay and at the latest within three months from the receipt of the complaint. The period to resolve the complaint may be extended by a reasonable period where necessary, taking into account the complexity of the complaint. The monitoring body shall inform the complainant of any such extension within three months of receipt of the complaint, together with the reasons for the delay. The monitoring body shall provide evidence of suitable corrective measures, as defined in the code of conduct, in cases of infringement with the code to stop the infringement and avoid future re-occurrence. Such sanctions could also include, training, issuing a warning, report to the board of the member, formal notice requiring action, suspension or exclusion from the code. The monitoring body shall provide evidence of their process for notifying the AP, code members and the code owner, immediately and without undue delay about the measures taken and justification of any infringements leading to code member suspension or exclusion. The monitoring body shall maintain a record of all complaints and actions which the AP can access at any time. In accordance with the EDPB guidelines; decisions of the monitoring body shall be made publicly available in line with its complaints handling procedure. Decisions are published when they relate to repeated and/or serious violations, such as the ones that could lead to the suspension or exclusion of the controller or processor concerned from the code. Otherwise publication of summaries of decisions or statistical data should be considered adequate.

Rechtspraak bij dit artikel