#1.1 Preliminary Remarks
General Data Protection Regulation (GDPR) contains many instruments of enforcement to effectively implement data protection across the European Union (EU). A data subject does not need to wait for a specific legal act of their Member State; they can claim legal protection directly under the GDPR. Breaching the GDPR may result in administrative and civil liability. Administrative liability can be pursued with by the supervisory authority, while a data subject may demand civil liability from a controller or a processor directly against the breaching party through the courts.
The GDPR provides the following legal remedies to a data subject:
- 1)complaining to the supervisory authority (Article 77(1) GDPR),
- 2)complaining to an administrative court against a decision or lack of decision by the supervisory authority (Article 78(1, 2) GDPR),
- 3)suing the data controller or processor seeking an order or prohibition (Article 79(1) GDPR),
- 4)suing the data controller or processor seeking compensation for material and non-material damage (Article 77(1) GDPR).
#1.2 Complaint to the Supervisory Authority
A complaint to a supervisory authority is a basic measure of legal protection available to a data subject under the GDPR.
Pursuant to Article 77(1) GDPR:
every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her [1] habitual residence, [2] place of work or [3] place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
Any natural person who believes that their personal data are being processed in breach of the GDPR is entitled to bring a complaint to a supervisory authority. A complaint can as well concern breaches of secondary legislation approved pursuant to the GDPR and the laws of Member States that specify how the GDPR is to be implemented.
A complaint may be addressed, at the discretion of the data subject, to a supervisory authority competent for (venue):
- 1)their habitual place of residence (where they actually live in a given territory),
- 2)their place of work (resulting from an employment contract or self-employment contract),
- 3)the place where the breach allegedly took place.
When forming a complaint, bear in mind that the supervisory authority is bound by the content of the complaint (at least formally), and any proceedings must relate to a specific case. The supervisory authority should assist data subjects with filing complaints, e.g., by making a complaint form available, preferably one that can be completed in electronic form.
#1.3 Complaint to a Court Against a Supervisory Authority
According to Article 78(1, 2) GDPR, a data subject can file a complaint to the court against a decision by an authority or against a delay in informing on a progress of proceedings in three months.
Of course, a complaint should be filed with a court of a Member State where the supervisory authority is established.
As usual, a local (a Member State’s) procedure applies to court proceedings initiated by a complaint against a supervisory authority. Laws ‘implementing’ the GDPR across Member States will usually point to a specific local court competent to try complaints against their supervisory authorities.
Based on our practical experience from several EU Member States, we assume that a complaint on a delayed decision or information from a supervisory authority will not be a very useful remedy.
#1.4 Civil Liability: Demand for Cessation or Preservation
#1.4.1 The Right to Go to Court
Pursuant to Article 79 GDPR, a natural person (a data subject) is entitled to seek legal protection directly against a controller or processor (irrespective of a complaint to the supervisory authority) in case they believe their rights have been breached by a particular processing.
By this measure, a data subject can demand that the controller or administrator take certain actions or cease certain actions (mandatory or prohibitory judgment).
A proceeding may be started against a controller (co-controller), a processor or both jointly or a group of those, including so-called subprocessors.
A person (data subject) may sue to the court irrespective if they file a complaint with the supervisory authority in parallel. It brings interesting conflict issues. The supervisory authority’s decision may collide with the court’s decision, especially in case the court and the supervisory authority come from different EU Member States. The GDPR provides for a reconciliation mechanism between different supervisory authorities but not for a direct reconciliation mechanism for courts. Therefore until the CJEU decides, the stance of supervisory authorities may in some cases differ to those of courts of the EU Member States.
#1.4.2 Competent Court
The court before which legal protection can be sought against a controller or processor depends on the nature of the entity alleged to have breached the regulation:
- 1)a public body – in each case the court having jurisdiction over the place where that body resides;
- 2)private entity – the data subject can choose between the court of the Member State in which the controller or processor has its organisational unit and the court of the Member State in which the data subject has their habitual residence.
#1.5 Compensatory Liability
According to Article 82 GDPR, in case the data subject suffers a material or nonmaterial damage (financial damage, loss of property, loss of profits as well as a physical harm or moral harm) as a result of a breach of the GDPR by a controller or processor, that data subject may sue for compensation, independently from other legal remedies sought under the GDPR.
#1.5.1 Controller and Processor
Liability for each breach caused by a breach of the GDPR will be borne by the controller, but in respect of the processor, Article 82(2) GDPR states that:
A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
Given the long list of duties the GDPR requires of processors, a breach of the GDPR can be easily attributed to a processor.
#1.5.2 Exemption from Liability
The GDPR sets the bar very high with regard to any exemption from liability if a number of entities take part in processing as controllers or processors.
Pursuant to Article 82(3) GDPR:
A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage.
According to the quoted provision, the burden of proving innocence lies with the defendant, and what is worse is that even the slightest contribution to a breach (e.g., a processor remaining silent on the subject of the legality of the controller’s instructions) can mean full liability (which can later be shared regressively).
Natalia Zawadzka takes the view that the conditions for a controller or processor to be held liable are:
- 1)a data subject suffers material or non-material damage,
- 2)a controller or processor breaches the provisions of the regulation,
- 3)a causal relationship exists between the damage caused and the breach,
- 4)the controller or processor is responsible and that these conditions must exist jointly in order for the controller or processor to be held liable.
A literal analysis of Article 82 GDPR seems to indicate not so much that ‘is responsible’ creates liability but that ‘is not in any way responsible’ excludes liability. This could be interpreted simply as a standard of extreme diligence, for it would mean ‘did everything in its power’. We hope that case law will turn out to be more balanced and will soften the harsh wording of Article 82(3) GDPR.
#1.5.3 Presumption of Fault
Theoretically, the burden of proof of a breach rests with a data subject who claims they have suffered damage. In practice, though, it is the controller who is obliged. In view of the existing principle of accountability (Article 5(2) GDPR), a controller must be able to show the correctness of its data processing and thus, in effect, the absence of any fault on its part in the incident. Article 82(3) GDPR also implies a presumption of fault on the part of the controller and processor. The burden of proof of the absence of any fault, therefore, rests with the controller or processor.
Note that neither a reduced degree of fault, nor the absence of wilfulness, nor a contribution to the occurrence of damage by the data subject eliminates liability.
#1.5.4 Joint and Several Liability
If a number of entities – controllers and processors – take part in the processing, their liability is joint and several. This means that a natural person who has suffered damage as a result of improper processing of their data by several entities can choose to seek full compensation from all of them, or from any of them. The entity that pays full compensation then has recourse to the other ‘guilty parties’. This solution is aimed at enabling a data subject whose data were processed contrary to the regulation to effectively obtain full compensation.
#1.5.5 Jurisdiction
As we have mentioned above, the competent court in a case is determined in accordance with Article 79(2) GDPR. Where damage is caused by a public body, in each case the competent court is the court having jurisdiction over the seat of that body. In other cases, the complainant can choose the court of the Member State in which the controller or processor has its organisational unit or the court of the Member State in which the data subject has their habitual residence.
#1.6 Representation of Data Subjects by Specialised Entities
Article 80 GDPR provides the possibility of natural persons having an organisation or association lodge a complaint on their behalf, pursue their rights or seek compensation from a controller or processor. This means social organisations, foundations, etc., i.e. non-governmental organisations that are encouraged to support data subjects with their complaints and in their disputes concerning breaches of the GDPR.