Article 77 GDPR

From GDPRhub
Article 77 - Right to lodge a complaint with a supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text[edit | edit source]


Article 77 - Right to lodge a complaint with a supervisory authority


1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

Relevant Recitals[edit | edit source]

You can help us fill this section!

Commentary[edit | edit source]

(1) Right to a formal complaint[edit | edit source]

Requirements[edit | edit source]

Article 77(1) only has two requirements: (1) A data subject must consider that (2) his or her personal data was processed in violation of GDPR.

Data subject[edit | edit source]

The complainant must be a data subject within the meaning of Article 4(2) GDPR.

As only an actual investigation can determine if the data of a complainant is or was actually processed, the data subject must de facto only allege that he or she is a data subject.

The requirement to be a data subject makes third party complaints ((actio popularis)) impossible under Article 77.

→ See below for alternative forms of submissions

Alleged processing in violation of the GDPR[edit | edit source]

The data subject must at least allege that his or her data is processed in violation of the GDPR.

National procedural requirements[edit | edit source]

National procedural laws may require further elements in a submission. Any such requirements may however not undermine the effectiveness of Article 77(1) and may not more burdensome than requirements in equivalent national procedures.

Many DPAs provide forms that ensure that a complainant includes all relevant information in a complaint.

Jurisdiction for filing the case[edit | edit source]

A(ny) DPA[edit | edit source]

The GDPR only requires that a supervisory authority (DPA) is addressed by the complaint. This general rule is only expanded by a non-exhaustive (in particular) list of possible DPAs. In summary this means, that a complainant may file a complaint with any DPA in Europe, independent of location.

Habitual residence[edit | edit source]

The most common place to file a complaint is the home jurisdiction of the complainant. The habitual residence is defined in different EU laws and requires a legal right to residence and an objective assessment of the factual residence.

This option allows to file a complaint in the local language of the data subject.

Place of work[edit | edit source]

Similar to the habitual residence, complainants can file a complaint at their work place. This may be relevant for cases in employment cases, but it is not required that the complaint has any connection to the work place.

Place of alleged infringement[edit | edit source]

The complaint can be brought at the place of the alleged infringement. This clause is a typical form of jurisdiction, that is aimed to align location of the decision maker with the location of facts.

Example: The DPA that is close to a CCTV camera may be best placed to gather factual evidence on the CCTV system, without the need to request mutual assistance from other DPAs.
Cross country cases[edit | edit source]

The option to file a case with any DPA does not mean that this DPA necessarily decides about the case.

→ See Article 56 GDPR for the definition of the lead supervisory authority.

Alternative forms of submissions[edit | edit source]

Opening Clause[edit | edit source]

Article 77(1) GDPR explicitly recognizes that Member States may provide for additional forms of submissions and redress. They may however not replace the right to launch a formal complaint.

Informal Petitions[edit | edit source]

Some DPAs also allow different form of informal submissions that can be best described as "petitions". Petitions are informal submissions that inform the DPA of an issue. Anyone can petition a DPA, without the need to be a data subject. At the same time petitions do not require the DPA to take any action and the petitioner is usually not a party to the procedure. The petitioner usually has no right to appeal under Article 78 GDPR.

GDPR does not know petitions. Petitions may have a legal basis in national law, such as a general "right to petition" any government authority.

(2) Duty to inform the data subject[edit | edit source]

Progress[edit | edit source]

You can help us fill this section!

Outcome[edit | edit source]

You can help us fill this section!

Every three Months[edit | edit source]

You can help us fill this section!

Information about Article 78[edit | edit source]

You can help us fill this section!

National procedural law[edit | edit source]

In addition to the requirements of Article 77, the procedural law of the Member States defines all further details of the procedure. National procedural laws are only applicable as far as they comply with the EU principles of equivalence and effectiveness.

You can find more details about the applicable national procedural laws in the DPA profiles.

Decisions[edit | edit source]

→ You can find all related decisions in Category:Article 77 GDPR

References[edit | edit source]