Part 6: Enforcement Section 165: Complaints by data subjects
This section sets out a data subject’s right to make a complaint to the Commissioner about an infringement of the data protection legislation in relation to his or her personal data. This right reflects Articles 57 and 77 of the GDPR and Articles 46 and 51 of the LED.
	Subsection (1) signposts the right of the data subject to complain under Articles 57 and 77 of the GDPR.
	Subsection (2) gives the data subject the right to complain to the Commissioner if there has been an infringement of Part 3 or Part 4 of the Act relating to their personal data.
	Subsection (3) requires the Commissioner to facilitate the making of complaints, including by providing a complaint form in either electronic or paper format.
	Subsection (4) explains the steps which the Commissioner must take when dealing with a complaint. These include taking appropriate steps to respond to the complaint, informing the data subject of the outcome of the complaint, and informing the data subject of their right to apply for an order from the tribunal against the Commissioner. If asked by the complainant, the Commissioner is also required to give the data subject further information about how to proceed with the complaint.
	Subsection (5) explains that the requirement for the Commissioner to take "appropriate steps" to respond to a complaint includes investigating the complaint, to the extent appropriate, as well as informing the complainant about progress with the complaint and whether further investigation or coordination with another authority is necessary.
	Subsection (6) provides that where the Commissioner receives a complaint which relates to an infringement of another Member State’s legislation implementing the LED, the Commissioner must pass on that complaint to the supervisory authority of the relevant Member State. The Commissioner must inform the complainant that this has been done, and if asked to do so must provide further information about how to proceed with the complaint.
	Subsection (7) defines the other authorities with whom the Commissioner may be required to co-ordinate in dealing with the complaint.
	The provisions in this section are broadly equivalent to section 42 of the 1998 Act, while taking account of the expanded rights of data subjects under the GDPR, the LED and this Act.