Article 77
Right to lodge a complaint with a supervisory authority
Chapter 8
|
Remedies, Liability and Penalties
|
📖 2 min read
1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.
Understanding This Article
Article 77 establishes the complaint mechanism as the primary practical avenue for data subjects to enforce their GDPR rights. While data subjects have direct rights (access, rectification, erasure, etc.), exercising them often requires supervisory authority intervention when controllers don't comply. Article 77 makes that intervention accessible.
Paragraph 1's broad jurisdiction gives data subjects choice about where to complain. They can complain in their habitual residence (where they normally live), place of work (where they're employed), or place of the alleged infringement (where the controller is established or the violation occurred). This flexibility ensures accessibility—a French citizen living in Germany who works in Belgium and whose data is processed by an Irish company can complain to German, Belgian, French, or Irish authorities, choosing whichever is most accessible or convenient.
"Without prejudice to any other administrative or judicial remedy" preserves all other enforcement avenues. Lodging a complaint doesn't preclude also suing the controller (Article 79), nor does pursuing judicial remedies prevent filing complaints. Data subjects can pursue multiple remedies simultaneously or sequentially. This redundancy ensures violations can be addressed even if one remedy fails.
The threshold for complaints is low: data subjects need only "consider" that processing infringes GDPR. Authorities can't reject complaints for being unmeritorious without investigation—if a data subject believes there's a violation, the authority must examine it. This prevents authorities from gatekeeping by dismissing complaints as obviously meritless.
Paragraph 2's information requirement ensures accountability. Authorities must keep complainants informed about progress (investigation status, information gathered, timeline) and outcome (findings, enforcement actions taken, reasons for decisions). If complaints are dismissed, authorities must explain why. This transparency enables complainants to assess whether the authority addressed their concerns adequately.
The requirement to inform complainants about judicial remedy possibilities (Article 78) is crucial. If complainants disagree with the authority's handling or outcome, they can challenge it in court. Without knowing this right, many complainants might accept inadequate responses. Affirmative notice ensures they can exercise judicial remedies.
In practice, supervisory authorities receive thousands of complaints annually—about employer surveillance, marketing practices, data breaches, account deletion difficulties, access request denials, etc. Authorities must process these complaints, conduct investigations, issue findings, and take enforcement action when appropriate. Article 77 makes this complaint mechanism a fundamental right, not a discretionary government service.