TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout
DPC18_Web_300x250-COPY
PrivacyTraining_ad300x250.Promo1-01
10, 16
Editor's Note:

After the publication of this piece, we corrected previously published data for the Irish Data Protection Commission.

A full month has passed since the EU General Data Protection Regulation went into effect May 25, and the GDPR has already had a wide-ranging global impact, with multiple U.S.-based news sites, such as the Los Angeles Times, restricting access to EU users and complaints reportedly coming in regarding the practices of big tech companies.

But how many complaints? Are consumers rushing to deluge their local data protection authorities? To find out, the IAPP reached out to DPAs of each of the 28 member states to check in and discuss how many complaints they had received since May 25, and we are using today's one-month anniversary of GDPR Day to publish the first look at the data. The results we received varied greatly.

In addition to the EU DPAs directly providing the number of complaints received, we used staff and budget data from the International Conference of Data Protection and Privacy Commissioners’ Census 2017 to put together a more complete picture of how well equipped the member states may be to handle the current influx of complaints. It is important to note that the ICDPPC staff data is from 2017, and the budget data is from 2016. In the time leading up to and since the implementation of the GDPR, it is safe to assume that the ICDPPC budget and staffing data that the IAPP used for this study has changed, with both of the data sets likely increasing. The ICDPPC 2017 census surveyed 87 privacy and data protection authorities globally, with 64 percent of respondents being from the European region. Of all respondents, 60 percent reported they had increased their budget from the previous year, with 30 percent of those who had an increased budget seeing their budget grow by more than 10 percent. Staffing data saw a large amount of growth, as well, with 42 percent of all respondents reporting an increase in staff and just 16 percent seeing a decrease.

Out of all 28 EU member states that the IAPP requested information from related to complaints received, the following 10 member states did not respond to our inquiry or did not have official data to provide by the time of our publication: Croatia, Cyprus, Finland, Germany, Hungary, Italy, Lithuania, Luxembourg, Portugal, and Spain.

You'll see in the listings below, we note the "span of days" between May 25 and when the DPA answered with the number of complaints received, so we could do some number-of-complaints-per-day averaging. 

Editor's Note: After the original publication of this piece, the IAPP received additional data from the data protection authorities of Greece, Latvia, Poland and the United Kingdom, which has since been added below.

GDPR complaints received by EU member states since May 25
Staff Data from 2017, Annual Budget Data from 2016, cited from the IDCPPC 2017 Census

Austria
Complaints Received: 81
Span of Days: 20
Staff (2017): 24
Annual Budget (2016): N/A
The Austrian Data Protection Authority has been receiving just over four complaints per day since the GDPR went into effect, with 81 total complaints coming in during the first 20 days of the new regulation.

Belgium
Complaints Received: 3
Span of Days: 26
Staff (2017): 56
Annual Budget (2016): $9,639,000
The Belgian Data Protection Authority received just three complaints during the first 26 days of the GDPR. The Belgian DPA has 56 staff members, which averages out to nearly 20 staff members per complaint received. Their annual budget breaks down to $686,000 in the 26-day span.

Bulgaria
Complaints Received: 91
Span of Days: 28
Staff (2017): 87
Annual Budget (2016): $1,402,394
The Commission for Personal Data Protection of Bulgaria received 91 complaints in the first 28 days of the GDPR, averaging out to just over three complaints per day. The Bulgarian DPA has 87 total staff members, which averages out to nearly 27 staff per daily complaint. Their annual budget breaks down to just over $50,000 for the 28-day span, which averages out to $550 per complaint received.

Czech Republic
Complaints Received: Approximately 400
Span of Days: 26
Staff (2017): 104
Annual Budget (2016): $6,975,834
The Office for Personal Data Protection of the Czech Republic received approximately 400 complaints in the first 26 days of the GDPR, with an average of over 15 complaints per day being received during this span. The Czech Republic’s annual DPA budget breaks down to slightly over $19,100 per day, which would allot about $1,275 per complaint received. With a staff of 104, the Czech Republic’s DPA has an average of seven staff members to handle each of the 15 daily complaints.

Denmark
Complaints Received: 13
Span of Days: 15
Staff (2017): 36
Annual Budget (2016): $3,440,000
The Danish Data Protection Agency received 13 complaints in the first 15 days of the GDPR, averaging under one complaint received per day. The Danish DPA daily budget breaks down to approximately $9,400, with a staff of 36 to handle the single complaint per day that they have been receiving.

Estonia
Complaints Received: 7
Span of Days: 14
Staff (2017): 18
Annual Budget (2016): $833, 877
The Estonian Data Protection Inspectorate received seven complaints in the first 14 days of the GDPR, with an average of one complaint being received every two days. The Estonian DPA daily budget is $2,284, which breaks down to $4,569 per complaint received in this 14-day span.

France
Complaints Received: 426
Span of Days: 24
Staff (2017): 195
Annual Budget (2016): $22,253,000
The National Commission on Informatics and Civil Liberties (aka, the CNIL) of France received 426 complaints in the first 24 days of the GDPR, with an average of approximately 18 complaints being received per day in this span. With a staff of 195, the CNIL has an average of nearly 11 staff members per complaint received. With a daily budget of $60,967, this averages just over $3,400 per complaint received.

Greece
Complaints Received: 113
Span of Days: 34
Staff (2017): 45
Annual Budget (2016): $2,460,920
The Hellenic Data Protection Authority reported receiving an average of over three complaints received per day in the first 34 days of the GDPR. The Hellenic DPA's staff data showed an average of over 13 staff members per complaint received during this period.

Ireland
Complaints Received: 547 Data Breach Notifications, 386 Complaints
Span of Days: 32
Staff (2017): 64
Annual Budget (2016): $5,640,600
The Irish Data Protection Commission received 547 Data Breach Notifications and 386 complaints in the first month of the GDPR. 403 of the data breach notifications and 89 of the complaints are considered under the GDPR. The 2016 staff of 64 would average out to over 29 daily complaints and notifications per staff member, with the 2017 annual budget breaking down to $530 per complaint. As reflected in the Editor's Note, the IAPP has updated the Irish DPC's GDPR complaints data since the original publication of this piece. The IAPP also received updated 2018 staff and budget numbers for Ireland. In 2018, the Irish DPC currently boasts a staff of 100, with a plan to increase that number to 140 by the end of the year. The 2018 annual budget for the Irish DPC has increased to $13,648,382.

Latvia
Complaints Received: 19
Span of Days: 26
Staff (2017): 25
Annual Budget (2016): $720,285
The Data State Inspectorate of Latvia received under one complaint per day during the first 26 days of the GDPR. The Data State Inspectorate's budget breaks down to $2700 per complaint received during this span, and their staffing data shows over one staff member per complaint received.

Malta
Complaints Received: 8
Span of Days: 24
Staff (2017): 10
Annual Budget (2016): $404,600
The Office of the Information and Data Protection Commissioners of Malta has received 8 total complaints in the first 24 days of the GDPR. Their 24-day budget breaks down to $26,600, with an average of $3,325 per complaint received in this span.

Netherlands
Complaints Received: 170
Span of Days: 14
Staff (2017): 75
Annual Budget (2016): $9,743,720
The Data Protection Authority of The Netherlands received 170 complaints over the first 14 days of the GDPR. With an average of 12 complaints daily and a staff of 75, this averages out to just over six staff members per daily complaint. The Dutch DPA’s budget breaks down to approximately $374,000 during this 14-day span, which averages out to $2,198 per complaint received.

Poland
Complaints Received: 756
Span of Days: 37
Staff (2017): 152
Annual Budget (2016): $5,400,360
The Personal Data Protection Office of Poland reported receiving 756 complaints in the first 37 days of the GDPR. Their budget during this 37-day span breaks down to $724 per complaint received, and an average of just over seven staff members per daily complaint.

The Information Commissioners' Office of the United Kingdom reported they marked 1126 GDPR cases in the first 26 days of the regulation. With a staff of 393, the ICO has and average of just under three staff members per complaint received during this period. The ICO's budget breaks down to $1,468 per complaint received since the GDPR went into effect.

Romania
Complaints Received: 145
Span of Days: 14
Staff (2017): 36
Annual Budget (2016): $1,261,260
The National Supervisory of Authority for Personal Data Processing of Romania received 145 complaints in the first 14 days of the GDPR, averaging just over 10 daily complaints. With a staff of 36, this averages out to nearly four staff members per daily complaint, and the Romanian DPA’s budget breaks down to just over $333 per complaint received during this 14-day span.

Slovakia
Complaints Received: 4
Span of Days: 24
Staff (2017): 38
Annual Budget (2016): $1,176,821
The Office for Personal Data Protection of the Slovak Republic received four complaints in the first 24 days of the GDPR. With a staff of 38, this averages out to nearly 10 staff members per complaint received in this span. The Slovak DPA’s budget breaks down to $77,380 for the 24-day span, with an average of $19,345 per complaint received.

Slovenia
Complaints Received: 102
Span of Days: 25
Staff (2017): 32
Annual Budget (2016): $1,589,194
The Office of the Information Commissioner of Slovenia received 102 complaints in the first 25 days of the GDPR, with an average of just over four daily complaints. With a staff of 32, the Slovenian DPA averaged eight staff members per daily complaint received in this 25-day span. Their annual budget breaks down to $108,848 in this span, averaging approximately $1,067 per complaint received.

Sweden
Complaints Received: 2
Span of Days: 18
Staff (2017): 50
Annual Budget (2016): $6,329,570
The Data Inspection Board of Sweden received just two complaints in the first 18 days of the GDPR, averaging one complaint every nine days. With a staff of 50, the Swedish DPA has 25 staff members per complaint received. Their annual budget breaks down to $312,143 over this 18-day span, averaging over $156,000 per complaint received.

United Kingdom
Complaints Received: 1124
Span of Days: 26
Staff (2017): 393
Annual Budget (2016): $23,164,700
The Information Commissioners' Office of the United Kingdom reported they marked 1126 GDPR cases in the first 26 days of the regulation. With a staff of 393, the ICO has and average of just over nine staff members per daily complaint received during this period. The ICO's budget breaks down to $1,468 per complaint received since the GDPR went into effect.

Photo credit: loonyhiker 12/28/15 Complaint Dept via photopin (license)

3 Comments

If you want to comment on this post, you need to login.

  • comment David Agius • Jun 26, 2018
    It would be interesting to know how many of the complaints actually were related to activities of entities within another EU or non-EU state (for example, ICO UK receiving complaint about processing of data by an organisation in the Uk or whether it was a UK resident complaining about a company in another EU state or from outside the EU.
  • comment Alejandra Brown • Jun 27, 2018
    I agree with David's comments and I would also love to know if any of these complaints have resulted in warnings to the organizations that data subjects complained about (I think it is too early for fines and the media would be all over fines anyway). Speaking from the North American perspective and specifically the West Coast, the attitude is really "wait and see" and do nothing in the meantime. No matter how much I explain to them that this gives them an opportunity to set their processes in order and that they can use it as a branding and competitive opportunity, organizations are still way behind, if interested at all. They need a good wake up call that will only come from the EU Data Protection Authorities showing they mean business when it comes to data protection. Hopefully the resource constraints they face will not prevent them from that.
  • comment charlotte christensen • Sep 23, 2018
    a fun one: I am one of these 13 complainers in Denmark. In fact, on 26th May I complained that a small Danish registered company still had my picture and data on their webpage, despite me no longer being associated with the company (since January 2018). On 20 July, I complained again, on 5th August the same and finally,  on 10 August, I got an email with the message that they need up to 6 months to handle my complaint. This is obviously a tiny case of European based person and business in another EU based country. But still. Obviously, I am now wondering how long the audits will take for sizeable companies and how tolerant to be.