Answer
If you think your data protection rights have been breached, you have three options:
- lodge a complaint with your national Data Protection Authority (DPA)
The authority investigates and informs you of the progress or outcome of your complaint within 3 months; - take legal action against the company or organisation
File an action directly in court against a company/organisation if you believe that it has violated your data protection rights. This doesn’t stop you lodging a complaint with the national DPA if you so wish; - take legal action against the DPA
If you believe that the DPA has not handled your complaint correctly or if you aren’t satisfied with its reply or if it doesn’t inform you with regard to the progress or outcome within 3 months from the day you lodged your complaint, you can bring an action directly before a court against the DPA.
Sometimes, the company against which the complaint has been lodged processes data in different EU Member States. In this particular case, the competent DPA handles the complaint in cooperation with the DPAs based in the other EU Member States. This system, called the ‘one-stop-shop mechanism’, ensures complaints are handled more efficiently. For example, it may help connect your complaint with similar complaints lodged in other EU Member States. The DPA where you have lodged the complaint is your main contact point.
Example
You enjoy running. You have bought a watch which calculates your heart rate and speed per kilometre, tracks your route and gathers other relevant data. You upload all your data on the website. You realise that your data has been mixed up with someone else’s. You can file a complaint before your DPA against the website.