In the judgment C-416/23, the Austrian Data Protection Authority (DSB) received a slap in the face from the CJEU. The authority has – arbitrarily – set the number of complaints that data subjects can file at a maximum of two per month, even if one is affected by GDPR violations almost daily. The CJEU has now made it clear: as long as you do not file abusive complaints, all users have the right to have any GDPR violation remedied by the DSB. Unfortunately, Data Protection Authorities (DPAs) trying to get rid of complaints isn’t just an Austrian problem. Our figures show an EU-wide problem with DPA inactivity.
Right here is where the rubber meets the road. If the GDPR isn’t enforced, the outcome is worse for everyone because the companies in breach will point out that nobody has successfully won a judgement against them, so in other words, they’ve done nothing wrong, whilst all the while they’ll sell your private information out the side door to the highest bidder.
