Question: Where Are Cases Under The GDPR Filed?

Answer: Data subjects who believe that their rights have been infringed have the right to file a complaint with a data protection authority (“DPA”), in particular, in the European Union member state of the data subject’s habitual residence, the data subject’s place of work or the place of the alleged infringement. The DPA must inform the data subjects of the progress and outcome of their complaint.

Any natural or legal person has the right to an effective judicial remedy against legally binding decisions of DPAs. Such a decision producing legal effects concerning that person includes the exercise of investigative, corrective and authorization powers by a DPA or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by DPAs which are not legally binding, such as opinions issued by or advice provided by the DPA.

Data subjects also have the right to an effective judicial remedy when DPAs do not address their complaints or do not inform them within three months about the progress or outcome of the complaints. Proceedings against the DPA have to be initiated before the courts in the European Union member state where the DPA is established.

In addition to the aforementioned right to lodge a complaint with a DPA, data subjects whose rights have been infringed have also the right to an effective judicial remedy against the controller or processor responsible for the alleged breach. Proceedings may be brought before the courts of the European Union member state where the controller or processor has an establishment or, alternatively, the courts of the European Union member state where the data subject has his or her habitual residence, unless the controller or processor is a public authority of an European Union member state acting in the exercise of its public powers.

Any person who has suffered damage or non-material damage as a result of infringement of the GDPR has the right to receive compensation from the controller or the processor for the damage suffered. Proceedings may be brought before the courts of the European Union member state where the controller or processor has an establishment or the courts or where the data subject has his or her habitual residence, unless the controller or processor is a public authority of an European Union member state acting in the exercise of its public powers.

[View source.]