The right to lodge a data protection complaint : ok, but then what? : an empirical study of current practices under the GDPR

Abstract

Access to data protection remedies constitutes a core element of the enforcement of the General Data Protection Regulation (GDPR). Individuals confronted with a data protection infringement have the right to turn directly to the judiciary (Article 79 of the GDPR), but they have also the right to lodge a complaint with a Data Protection Authority (DPA) (Article 77 of the GDPR). They can lodge a complaint at the Member State of their habitual residence, of their place of work, or of the Member State of the place of the alleged data protection infringement. Data subjects also have the right to an effective judicial remedy against the decisions of DPAs, as well as in case of lack of action or lack of information about the outcome or progress of their complaint (Article 78 of the GDPR). Individuals can decide to mandate certain civil society organisations to represent them in front of DPAs, or in front of courts (Article 80 of the GDPR). This study examines current DPA practices related to their obligation to facilitate the submission of complaints, granting special attention to the connection between this obligation and the right to an effective judicial remedy against DPAs. It combines legal analysis and the observation of DPA websites, together with insights obtained from the online public register of decisions adopted under the ‘one-stop-shop’ mechanism.