Recital 141

Recital 141

General Data Protection Regulation · UE 2016/679

(141)

Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

Luxembourg specificity
loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the competent authority is the CNPD (Commission nationale pour la protection des donnees), based in Belvaux. The law of 1 August 2018 organising the CNPD specifies the complaint procedure: online filing via the CNPD form, handling by a designated investigating commissioner, and appeal before the Administrative Tribunal against decisions of the restricted formation. The CNPD regularly publishes its complaint statistics and average handling times.

Luxgap practice: connect Luxgap Complaint Shield to the CNPD form via automated monitoring, so you are alerted the same day a complaint targeting your organisation is registered, and immediately trigger the internal freeze and defence preparation procedure.