I recently noticed that the French CNIL, much like the British ICO, will only deal with complaints once the complainant has contacted the organisation in question. This in my opinion is a dereliction of duty as it represents an unreasonable barrier to making complaints. Contacting the organisation may not always be possible, and if unauthorised processing of information has already taken place then contacting them may only end up letting them know that the details they have are accurate.
As a result I decided to send the following email to the EU commission via their own contact form on their website:
It would appear that the French CNIL refuses to deal with data protection complaints until the organisation that is the subject of the complaint has been contacted. There will be cases however where contacting them may be either impossible or be undesirable. Making such a demand seems to represent an unwarranted barrier to the enforcement of data protection related rights and frankly seems to be more about avoiding providing the help needed by the public than doing their job. Is it acceptable in your view for member state regulators to be making such demands as a prerequisite to any investigation?
It’s a simple yes/no question, but they decided to reply with this:
We would like to inform you that your enquiry is not specifically addressed in the General Data Protection Regulation (GDPR). However, there is a right to judicial remedy for complainants. If you believe that the data protection authority (DPA) has not handled your complaint correctly, or if you aren’t satisfied with its reply, or if it doesn’t inform you with regard to the progress or outcome within 3 months from the day you lodged your complaint, you can bring an action directly before a court against the DPA. Further information is available here: https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens_en
So basically no answer to the one question I asked..