Right to lodge a complaint
The right under Art. 77 GDPR allows any data subject to lodge a complaint with a data protection supervisory authority, free of charge and without any formal requirements, if they believe the processing of their personal data infringes the GDPR.
Art. 77 GDPR entitles every data subject to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the Regulation. No particular form is required, the procedure is in principle free of charge under Art. 57(3) GDPR, and the complainant needs neither to contact the controller beforehand nor to demonstrate any damage. The complaint may be filed with the authority in the Member State of the data subject's habitual residence, place of work or place of the alleged infringement; in Germany, competence is further governed by section 19 BDSG and the state data protection acts. The right sits alongside the judicial remedy under Art. 79 GDPR and the claim for compensation under Art. 82 GDPR – a data subject does not have to choose one route over the other.
In practice the authority's procedure follows a recognisable pattern. After receipt it checks its own competence and, where cross-border processing is involved, transfers the case to the lead supervisory authority of the main establishment under Art. 56 and Art. 60 GDPR. It then uses its investigative powers under Art. 58(1) GDPR to ask the controller for a statement, information and evidence – typically the record of processing activities, the legal basis relied on, consent records, the deletion concept or the relevant data processing agreements. If an infringement is confirmed, the corrective powers of Art. 58(2) GDPR apply: a warning, a reprimand, an order to comply with a data subject request, a limitation or ban on processing, and – in addition to or instead of these measures – an administrative fine under Art. 83 GDPR.
Under Art. 77(2) GDPR the authority must inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR. If it fails to act for more than three months, the complainant may bring proceedings under Art. 78(2) GDPR; in Germany section 20 BDSG assigns these cases to the administrative courts. However, there is no entitlement to a specific enforcement measure: in its judgment of 26 September 2024 (Case C-768/21) the CJEU held that a supervisory authority is not obliged to impose a corrective measure – in particular a fine – in every case of an established infringement, provided this is not necessary to remedy the shortcoming. What the complainant can insist on is a diligent examination and a reasoned decision.
Legal Basis
Art. 77 GDPR (right to lodge a complaint), Art. 57(1)(f) and 57(3) GDPR, Art. 58(1) and 58(2) GDPR, Art. 60 GDPR, Art. 78 GDPR, sections 19 and 20 BDSG (German Federal Data Protection Act)
Practical Example
A rejected job applicant asks a mid-sized mechanical engineering company for access to their data under Art. 15 GDPR; the company answers only after four months and only in part. The applicant complains to the data protection authority of their federal state. The authority gives the company two weeks to respond and requests the record of processing activities, the retention periods for applicant data and evidence of the access-request process. The data protection coordinator reconstructs the case, finds that the request was left unattended in the hiring department, supplies the missing information and submits a revised process description with deadline monitoring and a named owner. The authority closes the case with a reprimand under Art. 58(2)(b) GDPR and refrains from imposing a fine because the infringement was remedied and the process demonstrably improved.