Complaint
According to Article 63(1) of Regulation (EU) 2018/1725, "every data subject shall have the right to lodge a complaint with the European Data Protection Supervisor if the data subject considers that the processing of personal data relating to him or her infringes this Regulation".
Article 68 of the Regulation also provides that "Any person employed by a Union institution or body may lodge a complaint with the European Data Protection Supervisor regarding an alleged infringement of the provisions of this Regulation, including without acting through official channels."
Anyone who believes that an EU institution or body violates his/her rights with regard to the processing of personal data may file a complaint with the European Data Protection Supervisor (EDPS). A staff member of an EU institution or body may also lodge a complaint with the EDPS even if he or she is not directly concerned by the violation.
In general, complainants are recommended to turn to the EDPS only after having contacted the controller and/or the Data protection officer of the institution or body concerned. However, complaints can also be lodged directly with the EDPS if this is deemed necessary.
Complaints to the EDPS must be in writing, either on paper or electronically, in principle using the complaint submission form available on the EDPS website. This form can be completed and sent electronically. Alternatively, it can be sent by fax or post including all relevant information as well as any supporting evidence.
If a complaint is found admissible, the EDPS will conduct an inquiry if he finds this appropriate. If the case is not resolved satisfactorily during the course of his inquiry, the EDPS will try to find a friendly solution which satisfies the complainant. If the attempt at conciliation fails, the EDPS may order the rectification, restriction of processing, erasure or destruction of data or even impose a ban on a particular data processing.
The EDPS is not competent to deal with issues involving national authorities or private entities in the EU countries, and has no power to compensate the person concerned by the violation of data protection rules.
In order to ensure the consistent treatment of complaints concerning data protection and to avoid unnecessary duplication, the European Ombudsman and the EDPS have signed a Memorandum of Understanding (pdf). It stipulates, among other things, that a complaint that has already been brought forward should not be reopened by the other institution unless significant new evidence is submitted.
