When a company ignores an access request, keeps sending you advertising after you objected or processes your data in a way you believe is unlawful, the next step is to turn to an independent authority. In Italy that authority is the Garante per la protezione dei dati personali. A complaint is a tool you can use even without legal assistance, but how effective it is depends largely on how it is prepared.
The legal basis
Article 77 of Regulation (EU) 2016/679 gives every data subject the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, if they consider that the processing of their data infringes the Regulation.
The authority must inform you of the progress and outcome of the complaint. Article 78 adds that if the authority does not handle the complaint or does not inform you within three months of its progress or outcome, you have the right to an effective judicial remedy against it.
Complaint or report
The Italian Personal Data Protection Code distinguishes between two tools.
| Complaint (reclamo) | Report (segnalazione) | |
|---|---|---|
| Who files it | The data subject or their representative | Anyone |
| Purpose | Protecting your own rights in a specific case | Drawing the authority's attention to a possible infringement |
| Outcome | A decision on the case, with possible measures | The authority assesses whether to investigate, with no duty to decide the individual case |
If the matter concerns your data and you have already tried to resolve it with the controller, the right tool is the complaint.
Before complaining: go to the controller
In most cases it is advisable, and often decisive, to have first exercised your rights directly with the controller. A complaint showing "I asked, I waited the one-month deadline in Article 12, I received no reply" is much stronger than one that describes the problem without documenting it.
How to prepare an effective complaint
1. Identify the controller
Give the full name of the company or body, its registered address and, if available, the Data Protection Officer's contact details. You will find them in the privacy notice.
2. Set out the facts in chronological order
A clear sequence helps whoever examines the complaint:
- when and how the controller collected your data;
- which processing you are challenging;
- which request you sent, on what date and by what means;
- what you were told in reply, or the fact that you received no reply.
3. State the provisions you think were breached
No legal analysis is needed, but citing the relevant articles makes the complaint more precise: for example Article 15 for refused access, Article 21 for marketing continued after an objection, Article 6 for processing without a legal basis.
4. Say what you are asking for
For example, that the authority order the controller to respond to your request, erase the data or stop a processing operation.
5. Attach the documents
- a copy of the request sent to the controller and proof of sending;
- any replies received;
- evidence of the processing you are challenging, such as dated promotional emails, screenshots, a log of sales calls noting date and caller number;
- a copy of an identity document, if the procedure requires it.
Attach only what is relevant: a tidy file is more useful than a bulky one.
How to send it
The Garante provides a complaint template and filing instructions on its official website; complaints can also be sent by certified email. Keep a full copy of what you sent and the receipt.
The court alternative
Besides the complaint, Article 79 GDPR grants the right to an effective judicial remedy against the controller, and Article 82 the right to compensation. Under Italian law, for the same matter between the same parties, a complaint to the Garante and an action before the ordinary courts are as a rule alternatives: you have to choose which path to take. A claim for compensation, on the other hand, is brought before the courts.
What to expect
The authority can request information from the controller, invite it to satisfy your requests, order a restriction or ban on processing and, where provided, impose administrative fines. Fines go to the state, not to the person who filed the complaint: if you have suffered damage, compensation must be claimed separately.
In short
- Article 77 GDPR lets you lodge a complaint with the supervisory authority, in Italy the Garante per la protezione dei dati personali.
- A complaint is more effective if you first exercised your rights with the controller and can prove it.
- Describe the facts chronologically, cite the provisions and say what you are asking for.
- In Italy, a complaint to the Garante and a court action on the same matter are as a rule alternatives.
- Fines do not go to the data subject: compensation is claimed in court.