Article 27 — Right to Lodge a Complaint

1. 1.

   Every data subject shall have the right to lodge a complaint with the supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes any provision of this Code. The right to lodge a complaint shall apply irrespective of the jurisdiction in which the processing takes place, provided that the controller or processor is subject to this Code in accordance with Article 3.

2. 2.

   A complaint under paragraph 1 shall be submitted in writing, including by electronic means, and shall contain at a minimum:

   1. the identity and contact details of the complainant;
   2. a description of the facts giving rise to the complaint, including, where known, the identity of the controller or processor concerned;
   3. an indication of the provision or provisions of this Code that the complainant considers to have been infringed;
   4. a description of any steps already taken by the complainant to address the matter with the controller or processor, and any response received.
3. 3.

   The supervisory authority shall acknowledge receipt of a complaint within fourteen days and shall inform the complainant of the progress and outcome of the complaint, including the possibility of a remedy under Article 28, within ninety days of receipt. Where the complexity of the matter requires additional time, the supervisory authority may extend that period by a further ninety days, provided that the complainant is informed of the extension and the reasons therefor before the expiry of the initial period.

4. 4.

   The data subject shall have the right to an effective remedy where the supervisory authority does not handle the complaint, does not inform the complainant of the progress or outcome within the period specified in paragraph 3, or where the data subject is dissatisfied with the decision of the supervisory authority. For the purposes of this paragraph, an effective remedy includes the right to petition the Sovereign to review the matter.

5. 5.

   Without prejudice to any other administrative or judicial remedy, a data subject may at any time petition the Sovereign directly in accordance with the relevant provisions of the Fundamental Laws where the data subject considers that his or her rights under this Code have been infringed. The Sovereign shall consider such petition and may take any action that the supervisory authority is empowered to take under this Code.

6. 6.

   The supervisory authority shall establish and publish clear and accessible procedures for the lodging and handling of complaints, including the provision of complaint forms in electronic format and guidance on the information required to be submitted.

7. 7.

   The lodging of a complaint with the supervisory authority shall be without prejudice to the right of the data subject to seek compensation under Article 28(3) or to pursue any other remedy available under the laws of the jurisdiction in which the data subject is resident.