Right to lodge a complaint
If data subjects suspect that their data have been processed unlawfully, the first point of contact are the controllers. In many cases, these are the data-processing companies themselves (especially their data protection officers), which may have violated data protection rules. However, if consumers do not make progress here, they can complain to any data protection authority in the EU. The supervisory authority must look into the matter and inform the complainants of the status and outcome of the investigation. The data protection authority may impose sanctions on the company where appropriate.
Even before the General Data Protection Regulation came into force, supervisory authorities were already suitable contacts for consumers. However, the data subject used to be required to always contact the authority in country, where the company facing the complaint was registered. This is no longer the case: Consumers in Germany can contact the supervisory authority in their federal state, even if the company is located elsewhere. The European supervisory authorities will then coordinate among themselves which authority will take charge of the complaint. Lodging a complaint with a data protection authority is free of charge.
Article 77 GDPR (Right to lodge a complaint with a supervisory authority)
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.
Source: Regulation (EU) 2016/679 (see also recital 141)
