The GDPR offers a clear path for data subjects to remedy the perceived infringements of their personal data via complaints with a competent SA. However, complaint mechanisms for data subjects, and hence their access to the SAs, is challenging for multiple reasons. Among others, the national procedural laws applicable to a complaint before SAs remain unclear, and the differences between these national procedural laws impede the cooperation between SAs and limit legal certainty of data subjects.

In addition, SAs vary in the volume of work, their strategic approach to the complaints and resources, resulting in differences in how enforcement is delivered in practice. What is more, in cross-border cases, the difficulty of identifying the lead SA as well as the reliance on the lead SA to lead the process often risks the provision of effective and coordinated enforcement. In view of these limitations of the current systems, the NGOs are increasingly calling for improvements in the GDPR itself and in how SAs make use of their enforcement powers.

This panel seeks to explore the successful aspects of the current complaints handing mechanism under the GDPR, by zooming in on the one-stop-shop mechanism and its functioning, and proposes to critically assess the aspects that remain a challenge and make the access of data subjects to SAs a paper tiger. By taking stock of what the complaints handling landscape has been over the past 4 years, this panel proposes to discuss concrete ways on how to improve it for the benefit of the data subjects.