Section 4, Article 14 · Council Decision (EU) 2021/1093

Contents

Article 14Investigations#

1.The DPO may on his or her own initiative, or at the request of the delegated controller, the operational controller, the processor, the Staff Committee or any individual, investigate matters and occurrences relating to his or her tasks and report back to the person who commissioned the investigation or to the delegated controller, the operational controller or the processor.

2.Requests for an investigation shall be addressed to the DPO in writing. In the case of obvious misuse of the right to request an investigation, for example where the same individual has made an identical request recently, the DPO is not obliged to report back to the requester.

3.Within 15 days of receipt of a request for investigation, the DPO shall send an acknowledgement of receipt to the person who made the request and verify whether the request is to be treated as confidential.

4.The DPO shall request from the delegated controller who is responsible for the data processing operation that is the subject of the request for investigation to provide a report on the issue. The delegated controller shall provide the response to the DPO within 15 days. The DPO may request complementary information from the delegated controller, the operational controller, the processor or other relevant services of the GSC. If appropriate, he or she may request an opinion on the issue from the Council Legal Service. The DPO shall be provided with the requested information or opinion within 30 days.

5.The DPO shall report back to the person who made the request for investigation no later than three months following its receipt. This period may be suspended until the DPO has obtained all the necessary information that he or she may have requested.

6.No one shall suffer prejudice on account of a matter brought to the attention of the DPO alleging a breach of Regulation (EU) 2018/1725.