A full month has passed since the EU General Data Protection Regulation went into effect May 25, and the GDPR has already had a wide-ranging global impact, with multiple U.S.-based news sites, such as the Los Angeles Times, restricting access to EU users and complaints reportedly coming in regarding the practices of big tech companies.
But how many complaints? Are consumers rushing to deluge their local data protection authorities? To find out, the IAPP reached out to DPAs of each of the 28 member states to check in and discuss how many complaints they had received since May 25, and we are using today's one-month anniversary of GDPR Day to publish the first look at the data. The results we received varied greatly.
In addition to the EU DPAs directly providing the number of complaints received, we used staff and budget data from the International Conference of Data Protection and Privacy Commissioners’ Census 2017 to put together a more complete picture of how well equipped the member states may be to handle the current influx of complaints. It is important to note that the ICDPPC staff data is from 2017, and the budget data is from 2016. In the time leading up to and since the implementation of the GDPR, it is safe to assume that the ICDPPC budget and staffing data that the IAPP used for this study has changed, with both of the data sets likely increasing. The ICDPPC 2017 census surveyed 87 privacy and data protection authorities globally, with 64 percent of respondents being from the European region. Of all respondents, 60 percent reported they had increased their budget from the previous year, with 30 percent of those who had an increased budget seeing their budget grow by more than 10 percent. Staffing data saw a large amount of growth, as well, with 42 percent of all respondents reporting an increase in staff and just 16 percent seeing a decrease.
Out of all 28 EU member states that the IAPP requested information from related to complaints received, the following 10 member states did not respond to our inquiry or did not have official data to provide by the time of our publication: Croatia, Cyprus, Finland, Germany, Hungary, Italy, Lithuania, Luxembourg, Portugal, and Spain.
You'll see in the listings below, we note the "span of days" between May 25 and when the DPA answered with the number of complaints received, so we could do some number-of-complaints-per-day averaging.
GDPR complaints received by EU member states since May 25
Annual Budget Data from (2016) and Staff Data (2017) cited from the IDCPPC 2017 Census
Austria
- Complaints Received: 81
- Span of Days: 20
- Staff (2017): 24
- Annual Budget (2016): N/A
The Austrian Data Protection Authority has been receiving just over four complaints per day since the GDPR went into effect, with 81 total complaints coming in during the first 20 days of the new regulation.
Belgium
- Complaints Received: 3
- Span of Days: 26
- Staff (2017): 56
- Annual Budget (2016): $9,639,000
The Belgian Data Protection Authority received just three complaints during the first 26 days of the GDPR. The Belgian DPA has 56 staff members, which averages out to nearly 20 staff members per complaint received. Their annual budget breaks down to $686,000 in the 26-day span.
Bulgaria
- Complaints Received: 91
- Span of Days: 28
- Staff (2017): 87
- Annual Budget (2016): $1,402,394
The Commission for Personal Data Protection of Bulgaria received 91 complaints in the first 28 days of the GDPR, averaging out to just over three complaints per day. The Bulgarian DPA has 87 total staff members, which averages out to nearly 27 staff per daily complaint. Their annual budget breaks down to just over $50,000 for the 28-day span, which averages out to $550 per complaint received.
Czech Republic
- Complaints Received: Approximately 400
- Span of Days: 26
- Staff (2017): 104
- Annual Budget (2016): $6,975,834
The Office for Personal Data Protection of the Czech Republic received approximately 400 complaints in the first 26 days of the GDPR, with an average of over 15 complaints per day being received during this span. The Czech Republic’s annual DPA budget breaks down to slightly over $19,100 per day, which would allot about $1,275 per complaint received. With a staff of 104, the Czech Republic’s DPA has an average of seven staff members to handle each of the 15 daily complaints.
Denmark
- Complaints Received: 13
- Span of Days: 15
- Staff: 36
- Annual Budget: $3,440,000
The Danish Data Protection Agency received 13 complaints in the first 15 days of the GDPR, averaging under one complaint received per day. The Danish DPA daily budget breaks down to approximately $9,400, with a staff of 36 to handle the single complaint per day that they have been receiving.
Estonia
- Complaints Received: 7
- Span of Days: 14
- Staff: 18
- Annual Budget: $833, 877
The Estonian Data Protection Inspectorate received seven complaints in the first 14 days of the GDPR, with an average of one complaint being received every two days. The Estonian DPA daily budget is $2,284, which breaks down to $4,569 per complaint received in this 14-day span.
France
- Complaints Received: 426
- Span of Days: 24
- Staff: 195
- Annual Budget: $22,253,000
The National Commission on Informatics and Civil Liberties (aka, the CNIL) of France received 426 complaints in the first 24 days of the GDPR, with an average of approximately 18 complaints being received per day in this span. With a staff of 195, the CNIL has an average of nearly 11 staff members per complaint received. With a daily budget of $60,967, this averages just over $3,400 per complaint received.
Greece
- Complaints Received: 113
- Span of Days: 34
- Staff: 45
- Annual Budget: $2,460,920
The Hellenic Data Protection Authority reported receiving an average of over three complaints received per day in the first 34 days of the GDPR. The Hellenic DPA's staff data showed an average of over 13 staff members per complaint received during this period.
Ireland
- Complaints Received: 547 Data Breach Notifications, 386 Complaints
- Span of Days: 32
- Staff: 64
- Annual Budget: $5,640,600
The Irish Data Protection Commission received 547 Data Breach Notifications and 386 complaints in the first month of the GDPR. 403 of the data breach notifications and 89 of the complaints are considered under the GDPR. The 2016 staff of 64 would average out to over 29 daily complaints and notifications per staff member, with the 2017 annual budget breaking down to $530 per complaint. As reflected in the Editor's Note, the IAPP has updated the Irish DPC's GDPR complaints data since the original publication of this piece. The IAPP also received updated 2018 staff and budget numbers for Ireland. In 2018, the Irish DPC currently boasts a staff of 100, with a plan to increase that number to 140 by the end of the year. The 2018 annual budget for the Irish DPC has increased to $13,648,382.
Latvia
- Complaints Received: 19
- Span of Days: 26
- Staff: 25
- Annual Budget: $720,285
The Data State Inspectorate of Latvia received under one complaint per day during the first 26 days of the GDPR. The Data State Inspectorate's budget breaks down to $2700 per complaint received during this span, and their staffing data shows over one staff member per complaint received.
Malta
- Complaints Received: 8
- Span of Days: 24
- Staff: 10
- Annual Budget: $404,600
The Office of the Information and Data Protection Commissioners of Malta has received 8 total complaints in the first 24 days of the GDPR. Their 24-day budget breaks down to $26,600, with an average of $3,325 per complaint received in this span.
Netherlands
- Complaints Received: 170
- Span of Days: 14
- Staff: 75
- Annual Budget: $9,743,720
The Data Protection Authority of The Netherlands received 170 complaints over the first 14 days of the GDPR. With an average of 12 complaints daily and a staff of 75, this averages out to just over six staff members per daily complaint. The Dutch DPA’s budget breaks down to approximately $374,000 during this 14-day span, which averages out to $2,198 per complaint received.
Poland
- Complaints Received: 756
- Span of Days: 37
- Staff: 152
- Annual Budget: $5,400,360
The Personal Data Protection Office of Poland reported receiving 756 complaints in the first 37 days of the GDPR. Their budget during this 37-day span breaks down to $724 per complaint received, and an average of just over seven staff members per daily complaint.
Romania
- Complaints Received: 145
- Span of Days: 14
- Staff: 36
- Annual Budget: $1,261,260
The National Supervisory of Authority for Personal Data Processing of Romania received 145 complaints in the first 14 days of the GDPR, averaging just over 10 daily complaints. With a staff of 36, this averages out to nearly four staff members per daily complaint, and the Romanian DPA’s budget breaks down to just over $333 per complaint received during this 14-day span.
Slovakia
- Complaints Received: 4
- Span of Days: 24
- Staff: 38
- Annual Budget: $1,176,821
The Office for Personal Data Protection of the Slovak Republic received four complaints in the first 24 days of the GDPR. With a staff of 38, this averages out to nearly 10 staff members per complaint received in this span. The Slovak DPA’s budget breaks down to $77,380 for the 24-day span, with an average of $19,345 per complaint received.
Slovenia
- Complaints Received: 102
- Span of Days: 25
- Staff: 32
- Annual Budget: $1,589,194
The Office of the Information Commissioner of Slovenia received 102 complaints in the first 25 days of the GDPR, with an average of just over four daily complaints. With a staff of 32, the Slovenian DPA averaged eight staff members per daily complaint received in this 25-day span. Their annual budget breaks down to $108,848 in this span, averaging approximately $1,067 per complaint received.
Sweden
- Complaints Received: 2
- Span of Days: 18
- Staff: 50
- Annual Budget: $6,329,570
The Data Inspection Board of Sweden received just two complaints in the first 18 days of the GDPR, averaging one complaint every nine days. With a staff of 50, the Swedish DPA has 25 staff members per complaint received. Their annual budget breaks down to $312,143 over this 18-day span, averaging over $156,000 per complaint received.
United Kingdom
- Complaints Received: 1124
- Span of Days: 26
- Staff: 393
- Annual Budget: $23,164,700
The Information Commissioners' Office of the United Kingdom reported they marked 1126 GDPR cases in the first 26 days of the regulation. With a staff of 393, the ICO has and average of just over nine staff members per daily complaint received during this period. The ICO's budget breaks down to $1,468 per complaint received since the GDPR went into effect.
Photo credit: loonyhiker 12/28/15 Complaint Dept via photopin