Skip main navigation

£199.99 £139.99 for one year of Unlimited learning. Offer ends on 28 February 2023 at 23:59 (UTC). T&Cs apply

Find out more

Rights concerning complaints and judicial remedies

In this article, Evgeni Moyakine explains how the rights for lodging complaints and obtaining judicial remedies can be invoked.
Lady Justice on a desk
© University of Groningen

Rights for lodging complaints and obtaining judicial remedies cannot be disregarded in the context of the GDPR.

Under Article 77 GDPR, data subjects have the right to lodge a complaint with a supervisory authority in the Member States where they live and work and places of alleged infringements if they think that the processing of their personal data infringes the GDPR. It means that if our personal data are processed by a person or entity in a way that is incompatible with the regulation, a complaint can be lodged about this with a supervisory authority.

There is also a right to an effective judicial remedy against decisions of supervisory authorities found in Article 78 GDPR that is granted to natural and legal persons. In addition to this, data subjects have the right to obtain an effective judicial remedy when supervisory authorities do not address their complaints or do not inform them within three months about the progress or outcome of the complaints. The effective judicial remedy under this provision is to be obtained from the courts of the EU Member States where the supervisory authorities are located. Any data subject can thus have an effective judicial remedy against a legal binding decision of a supervisory authority and initiate legal proceedings before a national court.

Furthermore, we should mention the right to an effective judicial remedy against a controller or processor laid down in Article 79 GDPR. It allows data subjects to initiate proceedings against data controllers or processors before a court of the Member State of the establishment of controllers or processors or in the Member State where they have their habitual residence unless controllers or processors are public authorities of the Member States and exercise their public powers. Thus, data subjects can directly complain before a judicial institution against controllers and processors, such as Google or others.

© University of Groningen
This article is from the free online

Understanding the GDPR

Created by
FutureLearn - Learning For Life

Our purpose is to transform access to education.

We offer a diverse selection of courses from leading universities and cultural institutions from around the world. These are delivered one step at a time, and are accessible on mobile, tablet and desktop, so you can fit learning around your life.

We believe learning should be an enjoyable, social experience, so our courses offer the opportunity to discuss what you’re learning with others as you go, helping you make fresh discoveries and form new ideas.
You can unlock new opportunities with unlimited access to hundreds of online short courses for a year by subscribing to our Unlimited package. Build your knowledge with top universities and organisations.

Learn more about how FutureLearn is transforming access to education