David vs. Goliath? You have strong allies against big companies!
The right to lodge a complaint in practice: Reporting unfair treatment of you and your data
For weeks now, your social network has been showing you ad banners and posts for expensive products and services: Travel offers, watches, high-end stereos. You have no interest in that whatsoever, though, and you’re wondering why these personalized ads are popping up. Having received access to your data, you find out that the company has created an profile of you for their ad campaigns. In turn, you contact the company because they never told you about creating this profile. You don’t hear anything for months.
If contacting the company is to no avail, you have strong allies on your side: Your right to file a complaint allows you to contact a data protection authority at any time for free.
The complaint as a last resort: If companies don’t act, data protection authorities are your allies
Before involving a data protection authority, you should try to reach out to the data protection officers in the company you have issues with. But if you don’t get anywhere with your feedback there, you have the data protection authorities on your side: This is where you can lodge a complaint if you think the rights you have under the General Data Protection Regulation have been violated. Within three months receiving your complaint, the authority needs to inform you about its progress. In case the authority does detect a violation of your rights, they can impose fines, which have been made much harsher with the new EU privacy rules (read more about possible sanctions here).
Global companies, but local complaints: You can file your complaint anywhere in the EU
You can lodge a complaint with any data protection authority in the EU — fore free. It doesn’t matter where the company you’re complaining about has its headquarters. If the data protection authority you approach isn’t responsible for the company in question, it will automatically forward it to the right authority. All EU member states have data protection authorities, so you could pick the national authority in your country. In Germany, each federal state also has its own data protection authority, which can be contacted as well. At the end of this post, you can find a link to a list of data protection authorities in the EU.
Even more allies: Consumer protection organisations can detect privacy infringements
There are plenty of non-profit organisations working on consumer protection and data protection issues: In Germany, for example, hundreds of “consumer centres” (Verbraucherzentralen) advise citizens on these topics. The General Data Protection Regulation explicitly encourages such consumer protection organisations to detect and report companies’ data protection deficits and consumers’ grievances. Furthermore, you can ask not-for-profit organisations to file a complaint in your name. Under German law, consumer centres and other organisations can also represent you in a number of legal areas.
The dictionary contains more details and has sources regarding your rights to file a complaint, to sue, to have your complaints represented by others and to receive damages.
