GDPR Articles With Commentary & EU Case Laws by Adv. Prashant Mali (red seas under red skies txt) 📕

(4), the person concerned shall be informed of the outcome of the claim or that a check has taken place. In countries where the authority had no decision-making power, an increase in complaints may be expected, as this situation will lead to a decision likely to be appealed. The problem is then to determine what will be the procedure before the national authority, which should not be overly complicated and/or costly as this may discourage the data subject from pursuing a complaint.

 

Art. 78 GDPR Right to an effective judicial remedy against a supervisory authority

Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

Where proceedings are brought against a decision of a supervisory authority, which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

Suitable Recitals

(141) Right to lodge a complaint; (143) Judicial remedies.

COMMENTARY:

The Regulation goes further than the Directive: it is not at the discretion of Member States to set up a procedure for appeals, but an absolute right granted to any physical person or legal entity to appeal against a legally binding decision of the supervisory authority concerned. The right to a judicial remedy against a decision by a supervisory authority is an essential element of the protection of individuals with regard to the processing of personal data. This right to a an effective judicial remedy arises where the supervisory authority does not handle a complaint or does not inform the data subject within three months or a shorter period as prescribed by the applicable national law, on the progress or outcome of the complaint lodged.

As a principle, the data subject must lodge a complaint in the jurisdiction of the Member State where the supervisory authority is established. Finally, the European text obliges the supervisory authority to communicate to the relevant jurisdiction a complaint against one of its decisions, the notice or the decision of the European Data Protection Board, which would have been made previously under the consistency mechanism.

We have seen in Article 77 that pursuant to the Directive, the Member States should implement a procedure whereby any citizen, or an association that represents that citizen can lodge a complaint with the competent control authority, especially to check the lawfulness of a relevant processing. The Directive further provided that decisions by the supervisory authorities, which give rise to complaints may be appealed through the courts.

The evolution is significant. Several States did not allow an appeal against the decisions of the supervisory authorities, often due to their lack of binding powers. The states should therefore insert this remedy in their domestic law, according to their specific procedures (administrative, judicial courts, etc.).

 

 

Art. 79 GDPR Right to an effective judicial remedy against a controller or processor

Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Suitable Recitals

Right to lodge a complaint; (145) Choice of venue.

COMMENTARY:

Article 79 gives people affected by processing, a genuine right to an effective judicial remedy against both the controller and the processor in case of infringement of their rights resulting from the processing of their data. This right is not to be confused either with the possibility of lodging a complaint with a supervisory authority referred to in article 78, nor with any other administrative or extra-judicial remedy provided under the relevant national law. The second paragraph allows the data subject to bring his action either before the courts of the Member State in which the controller has an establishment or in the courts of the state of habitual residence of the data subject, unless controller or processor is a public authority of a Member State acting in the exercise of its public powers.

It should be noted that as per recital 146, the jurisdictional rules contained in the Regulation need subject to the general jurisdictional rules contained in other legal instruments, such as those contained in Regulation (EU) No. 1215/2012 of the European Parliament and the Council of 12 December 2012 concerning jurisdiction, recognition and enforcement of decisions on civil and commercial matters. The Directive Article 22 requires the Member States to provide to any person the right to a judicial remedy in case of breach of the rights guaranteed to him by the national provisions transposing the Directive.

Individuals have the following rights (against controllers and processors):

the right to lodge a complaint with supervisory authorities where their data have been processed in a way that does not comply with the GDPR;

 

the right to an effective judicial remedy where a competent supervisory authority fails to deal properly with a complaint;

the right to an effective judicial remedy against a relevant controller or processor; and

the right to compensation from a relevant controller or processor for material or immaterial damage resulting from infringement of the GDPR.

Both natural and legal persons have the right of appeal to national courts against a legally binding decision concerning them made by a supervisory authority.

Individuals can bring claims for non-pecuniary loss, not just for compensation. The potential for group actions to be brought is facilitated.

Judicial remedies and liability for compensation extend to both data controllers and data processors who infringe the Regulation.

 

Art. 80 GDPR Representation of data subjects

The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

Member States may provide that anybody, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.

Suitable Recitals

The right of data subjects to mandate a not-for-profit body, organisation or association.

COMMENTARY:

Article 80 specifies and supplements the Directive regarding option for representation by an association. The Regulation provides that an association (non- profit association active in the protection of the rights of the data subjects) can be mandated by a data subject not only to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77 on his or her behalf, but also for judicial remedy against a decision of a supervisory authority (Article 78) or against a controller or a processor (see Article 79).

 

The final version of the Regulation adds that the association is also granted the right to claim compensation as provided by Article 82 on behalf of the data subject where he or she considers that his or her rights under this Regulation have been infringed and as provided by Member State law. The Member States may grant major powers of action to the associations charged with the protection of rights and freedoms in the data processing. If the state makes use of this provision, these associations may, at their initiative (i.e., regardless of any mandate by a data subject) lodge a claim with a supervisory authority in the territory of the Member State of their establishment (Art. 77) or expedite a judicial remedy against a decision of a supervisory authority (Article 78) or against a controller or a processor (Article

79) if they consider that the rights of a data subject have breached because the personal data processing has not been compliant with the Regulation.

The Directive already provided for the possibility of an association undertaking to lodge a complaint with a supervisory authority on behalf of a person complaining of a breach of his or her rights and freedoms in the context of the personal data processing. It is a fundamental principle, that associations have the recognized powers to defend of the rights of data subjects. We strongly believe this measure will contribute to ensuring the effectiveness of the rights granted to the data subjects by the personal data processing.

Jurisdictional procedures already exist for data subjects; however, it is very rare that a person resorts to legal proceedings, especially in view of the costs. In other words, at present, it is not worth the effort. However, this development could lead to many problems of implementation. Regarding the possibility for these associations introducing a procedure regardless of a mandate by the data subject, it is not possible to predict the future implications in different Member states and disparities in the protection of the data subjects will appear on this point. Associations must exist and be active regarding data protection, but will often involve a significant change in attitudes of the public, members and authorities.

Data subjects can allow not-for-profit bodies, organisations or associations to act on their behalf by lodging complaints, receiving compensation and exercising some rights with regard to complaints and judicial remedies. These entities can also have the right to act independently of a data subjects’ mandate if the Member States provide for this possibility.

 

Art. 81 GDPR Suspension of proceedings

Where a competent court of a Member State has information on proceedings, concerning the same subject matter as regards processing by the same controller or processor, that are pending in a court in another Member State, it shall contact that court in the other Member State to confirm the existence of such proceedings.

Where proceedings concerning the same subject matter as regards processing of the same controller or processor are pending in a court in another Member State, any competent court other than the court first seized may suspend its proceedings.

Where those proceedings are pending at first instance, any court other than the court first seized may also, on the application of one of the parties, decline jurisdiction if the court first seized has jurisdiction over the actions in question and its law permits the consolidation thereof.

Suitable Recitals

(144) Related proceedings.

COMMENTARY:

Where a court in one Member State learns of proceedings pending in another Member State, concerning the same controller or processor and the same subject matter, that court may:

contact the relevant court in the other Member State to confirm the existence of such proceedings; and

suspend its own proceedings if appropriate.

Where these proceedings are pending at first instance, any other court may also,