What can you do if you as a data subject feel that your data have not been processed in line with data protection laws?

If you feel that a public body has processed your data in a way which is not in line with data protection laws, there are a number of options available to you.

You can, of course, go directly to the public body that you feel has not processed your data correctly. In doing so, you can assert your legal rights:

• the right to access your own personal data to find out whether and which data concerning you are being processed;
• the right to rectification if you believe data concerning you are inaccurate;
• your other rights to injunction/remediation of the consequences of unlawful data processing.

If the public body does not recognize your rights, you can always demand that it issue its decision in the form of a ruling and justify it. You can appeal this ruling; in other words, take legal action. If you appeal the ruling, your case will first go to the next highest authority, potentially to the responsible cantonal department, and thereafter if need be to a judicial authority. At the university this would be the University Appeals Committee; for cantonal and municipal public bodies, the cantonal administrative court.

In the event that you do not want to lodge an appeal, there is also another path you can take. If, for example, the public body infringes your rights and the in-house data protection advisor at the relevant public body is unable to help you, under the revised Information and Data Protection Act of the Canton of Basel-Stadt, you can also contact the cantonal data protection officer: § 28a of the revised IDG gives every individual the right to go to the cantonal data protection officer with a regulatory complaint if they feel that a public body or a contracted data processor is violating the data protection rules when processing personal data concerning them.

In European law this option is called a complaint; in the law of the Canton of Basel-Stadt it is a so-called “regulatory complaint” (“aufsichtsrechtliche Anzeige”). This is not appealing a ruling; rather, you are asserting that an authority which is subject to the supervision of the data protection officer is not performing its task correctly. As the person filing the complaint, you are not involved in this procedure as a party, but the data protection officer must investigate the matter and notify you within three months of the status/outcome of the investigation and how it has been settled.

The investigation could, for example, reveal that the data processing was performed lawfully; you will then be informed of this. Or it may turn out that the public body has processed the data unlawfully, in which case the data protection officer will arrange for this to be rectified and inform you of the result of the investigation at the end of the process. However, if the public body has already issued a ruling, the data protection officer will not take action – partly because the ongoing appeal periods will not be suspended through their actions. At this point, the appeals process described above will be followed.