On April 24, 2024, the European Data Protection Board (EDPB) published Rules of Procedure and Information Note on the Data Protection Framework redress mechanism for national security purposes (the Rules of Procedure), as well as a Template Complaint Form to the U.S. Office of the Director of National Intelligence's Civil Liberties Protection Officer (CLPO) (the Template).

Filing a complaint

The EDPB invites EU/EEA individuals alleging violations of US law concerning their data collected by US authorities competent for national security to submit their complaints to their EU/EEA data protection authorities (DPA) and to use a prepared Template. The Template includes the following information, necessary for the DPA to verify the complaint:

• identification information of the complainant; and
• outline of the complaint, in particular, the EDPB highlights that the complaint does not need to demonstrate that the complainants' data has, in fact, been subject to US signals intelligence activities but must include information such as personal data that may have been accessed.

The EDPB outlined in the Information Note:

• the process to lodge a complaint;
• how the DPA will handle the complaint;
• the role of the CPLO, the process, and the corresponding deadline to appeal the CPLO's decision; and
• the role of the U.S. Department of Commerce (DoC) in relation to declassified information.

Tasks and Rules of Procedure of the EDPB Secretariat and the SAs

The Rules of Procedure of procedure provide guidance on:

• tasks and responsibilities of the supervisory authorities (SAs), which include:
  • verification of the identity of the complainant, the completeness of the complaint, and its admissibility;
  • transmission of the complaint (including its translation, if necessary) and any subsequent appeals to the EDPB Secretariat;
  • transmission of the CLPO's replies to the complaint or the appeal to the complainant; and
  • transmission of any appeal of the complainant to the EDPB Secretariat;
• tasks and responsibilities of the EDPB Secretariat, which include:
  • transmission of the complaint and any subsequent appeals to CPLO;
  • transmission of the CPLO's replies to the complaint or the appeal to the SAs; and
  • transmission to the SA, information provided by the DoC on the declassification of a complaint; 
• cooperation and communication between the EDPB Secretariat and the SAs via electronic means.

You can read the Rules of Procedure here, the Information Note here, and the Template here.