Article 78 GDPR

← Article 78 - Right to an effective judicial remedy against a supervisory authority →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 78 - Right to an effective judicial remedy against a supervisory authority

1.   Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2.   Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

3.   Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4.   Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

Relevant Recitals

Recital 143: Action for Annulment of Decisions of the EDPB and Right to an Effective Judicial Remedy

Any natural or legal person has the right to bring an action for annulment of decisions of the Board before the Court of Justice under the conditions provided for in Article 263 TFEU. As addressees of such decisions, the supervisory authorities concerned which wish to challenge them have to bring action within two months of being notified of them, in accordance with Article 263 TFEU. Where decisions of the Board are of direct and individual concern to a controller, processor or complainant, the latter may bring an action for annulment against those decisions within two months of their publication on the website of the Board, in accordance with Article 263 TFEU. Without prejudice to this right under Article 263 TFEU, each natural or legal person should have an effective judicial remedy before the competent national court against a decision of a supervisory authority which produces legal effects concerning that person. Such a decision concerns in particular the exercise of investigative, corrective and authorisation powers by the supervisory authority or the dismissal or rejection of complaints. However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. Proceedings against a supervisory authority should be brought before the courts of the Member State where the supervisory authority is established and should be conducted in accordance with that Member State's procedural law. Those courts should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them.

Where a complaint has been rejected or dismissed by a supervisory authority, the complainant may bring proceedings before the courts in the same Member State. In the context of judicial remedies relating to the application of this Regulation, national courts which consider a decision on the question necessary to enable them to give judgment, may, or in the case provided for in Article 267 TFEU, must, request the Court of Justice to give a preliminary ruling on the interpretation of Union law, including this Regulation. Furthermore, where a decision of a supervisory authority implementing a decision of the Board is challenged before a national court and the validity of the decision of the Board is at issue, that national court does not have the power to declare the Board's decision invalid but must refer the question of validity to the Court of Justice in accordance with Article 267 TFEU as interpreted by the Court of Justice, where it considers the decision invalid. However, a national court may not refer a question on the validity of the decision of the Board at the request of a natural or legal person which had the opportunity to bring an action for annulment of that decision, in particular if it was directly and individually concerned by that decision, but had not done so within the period laid down in Article 263 TFEU.

Recital 144: Lis Alibi Pendens

Where a court seized of proceedings against a decision by a supervisory authority has reason to believe that proceedings concerning the same processing, such as the same subject matter as regards processing by the same controller or processor, or the same cause of action, are brought before a competent court in another Member State, it should contact that court in order to confirm the existence of such related proceedings. If related proceedings are pending before a court in another Member State, any court other than the court first seized may stay its proceedings or may, on request of one of the parties, decline jurisdiction in favour of the court first seized if that court has jurisdiction over the proceedings in question and its law permits the consolidation of such related proceedings. Proceedings are deemed to be related where they are so closely connected that it is expedient to hear and determine them together in order to avoid the risk of irreconcilable judgments resulting from separate proceedings.

Recital 145: Plaintiff's Right to Choose the Place of Jurisdiction

For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.

Commentary

Article 78 GDPR, titled "Right to an effective judicial remedy against a supervisory authority", embodies the general principle of judicial protection against actions or omissions by public authorities in general, and in particular, guarantees a right of judicial review against the decisions of data protection authorities. This approach, in line with Article 47 of the Charter of Fundamental Rights of the European Union ("CFR"), ultimately assigns the role of "guardians of the EU legal order" to the judiciary. In essence, Article 78(1) GDPR recognises an effective judicial remedy for anyone affected by a binding decision of the supervisory authority ("SA").

Paragraph 2 of the provision guarantees the same remedy to data subjects in cases of inactivity by a supervisory authority, following the submission of a complaint under Article 77.

Paragraph 3 clarifies that these proceedings must be initiated in the jurisdiction where the supervisory authority is established.

Finally, paragraph 4 obligates the supervisory authority to inform the court seized of the matter when the challenged decision is the result of a binding decision by the European Data Protection Board ("EDPB").

(1) Right to an effective judicial remedy against an SA's decision

Article 78(1) GDPR grants natural and legal persons the right to a judicial remedy against a "legally binding decision" of a supervisory authority. Therefore, the legal system establishes an additional avenue of protection in cases where the supervisory authority, through its decision, fails to correctly apply or infringes the GDPR or any other applicable laws, including national ones.

Without prejudice to any other administrative or non judicial remedy

See commentary under Article 77 GDPR. Equally, the existence of the right to an effective judicial remedy against a controller or processor in accordance with Article 79(1) GDPR does not affect the right to an effective judicial remedy under Article 78(1) GDPR.

"[...] the existence of the right to an effective judicial remedy against a controller or processor, provided for in Article 79(1) of the GDPR, does not affect the scope of the judicial review exercised, in the context of an action brought under Article 78(1) of that regulation, over a decision on a complaint adopted by a supervisory authority."

CJEU - Joined Cases C‑26/22 and C‑64/22 - SCHUFA, margin number 67..

Each natural or legal person

Article 78(1) GDPR establishes both natural and legal persons as potential claimants for legal actions against a SA decision. A natural person under that provision is usually a data subject (see Article 4(1) GDPR), although it is also possible that a controller or processor is a natural person. A legal person would usually be the controller or processor with regard to a certain processing activity, or a legal entity that is otherwise bound by a SA decision. The term “legal person” also encompasses other public authorities/bodies, as SAs can issue decisions with legal effect on such entities.

Concerned

The natural or legal person must be concerned by the SA decision. This requirement is the case if the natural or legal person (i) has been a party to the proceedings before the SA, either as a complainant or respondent, (ii) has been subject to ex-officio investigations by the SA, (iii) has been fined under Article 83 GDPR or (iv) is subject to a penalty under Article 84 GDPR. If a data subject’s personal data is otherwise affected by the SA decision, for example in case of a data breach in which the data subject’s data was disclosed, they are also concerned by the SA decision. Bergt argues that a data subject could even bring a legal action if a SA rejects the complaint of another data subject on the general illegitimacy of a certain processing activity that also affects the data subject. A controller or processor is also concerned by a SA decision that addresses a third party or does not have an addressee, but has a legally binding general effect. For instance, an example of this would be a SA’s orders regarding withdrawal or non-issuing of certifications under Articles 58(2)(h), 42 and 43 GDPR.

(Shall have a right to) An effective judicial remedy

The point of consideration is certainly one of the most relevant aspects of the entire provision. An individual affected by the decision has the right to an effective judicial remedy. However, what makes this remedy "effective"? In general terms, an "effective" remedy should either halt the alleged violation or its ongoing occurrence, or offer suitable remedy for any violation that has already taken place. Recital 143 of the GDPR specifies that that the courts seized of the matter "should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them."

Therefore, in order for a remedy to be effective, the court seised of an action against a decision of a SA has to be competent to examine all questions of fact and law relevant to the dispute before them.

"Thus, […] it follows from Article 78(1) of the GDPR, read in the light of recital 143 of that regulation, that courts seised of an action against a decision of a supervisory authority should exercise full jurisdiction, which should include jurisdiction to examine all questions of fact and law relevant to the dispute before them […]

Therefore, Article 78(1) of the GDPR cannot be interpreted as meaning that judicial review of a decision on a complaint taken by a supervisory authority is limited to the question of whether the authority has handled the complaint, investigated the subject matter of the complaint to the extent appropriate and informed the complainant of the outcome of the investigation. On the contrary, for a judicial remedy to be ‘effective’, as required by that provision, such a decision must be subject to full judicial review."

CJEU - Joined Cases C‑26/22 and C‑64/22 - SCHUFA, margin number 52 et seq..

Considering the extensive investigative and corrective powers of the SA (see commentary on Article 58 GDPR) it would not meet the requirements of an effective judicial remedy if decisions concerning the exercise of these powers were subject only to limited judicial review. The CJEU already emphasised that the fact that decisions by SAs are subject to full judicial review does not call into question the SAs' guarantee of independence.

At the same time the full judicial review by court does not mean that the SA does not enjoy a certain degree of discretion regarding the usage of its powers (see commentary on Article 58 GDPR). Therefore, the the right to an effective judicial remedy does not mean that the court seised can just substitute its assessment for that of that SA, but requires that the court examines whether the SA has complied with the limits of its discretion.

More information as to what "effective" means can be found in the CJEU's case-law regarding Article 47 CFR. The case-law includes statutory rules about appointment of the judges, length of service and the grounds for abstention, rejection and dismissal of its members, permanence in functioning, organizational independence from all parties of a dispute, impartiality and competence in adjudication. Only when all of the above mentioned standards are fulfilled it is possible to evaluate a state power as a court.

Finally, a remedy is considered effective when an individual has the genuine opportunity to protect their rights and make their arguments in a specific case. On this point, the European Court of Human Rights has clarified that "individuals concerned must receive sufficient information concerning their situations to be able to make use of the appropriate remedies and to substantiate their complaints, and to have access to interpreters and legal assistance." This principle plays a major role in cases where a SA adopts a decision concerning the controller/processor and 'notifies' the data subject without any specific remark regarding the issues raised in the complaint. In this case the data subject should be granted access to the entire administrative file. Otherwise, it would be challenging to conceive of an "effective" judicial remedy, as the appellant would be forced into a defence in the dark, so to speak.

Case-law: This conclusion can also be drawn from the CJEU case law, which identifies a violation of the right to a fair hearing (Article 47 of the Charter) "where a judicial decision is founded on facts and documents which the parties, or one of them, have not had an opportunity to examine and on which they have therefore been unable to comment."

Against a legally binding decision

Article 78(1) GDPR only allows for remedies against legally binding decisions. These include SA decisions on complaints made under Article 77 GDPR; decisions following the exercise of a SA's investigative powers under Articles 58(1)(a), (b), (c), (e) and (f) GDPR; decisions following the exercise of a SA's corrective powers under Article 58(2) GDPR; decisions on the approval of certain legal acts, bodies or processing activities under Article 58(3)(c)-(j) GDPR; and decisions following the exercise of powers vested in the SA by Member State law under Article 58(6) GDPR. Mere notifications, opinions or advisory acts, such as under Articles 58(1)(d) or 58(3)(a) and 58(3)(b) GDPR do not qualify as decisions and cannot be subject to legal actions under Article 78(1) GDPR.

Example: After examining the merits of a complaint longed with it, the SA found a processing activity to be lawful under the GDPR. This rejection of the complaint by the SA constitutes a legally binding decision which produces legal effects with regard to the complainant. Therefore, the complainant has has the right to an effective judicial remedy against this decision.

(2) Right to judicial remedy against DPA inactivity

A data subject has the right to an effective judicial remedy, where the competent SA under Articles 55 and 56 GDPR (i) does not handle a complaint or (ii) fails to inform the data subject within three months on the progress or outcome of a complaint.

Non-handling of complaint by the SA

The data subject has the right to an effective judicial remedy if the SA does not handle the complaint. The GDPR contains no definition of what constitutes the “[non] handling” of a complaint, although the language can be found in other parts of the GDPR. To begin with, Recital 141 GDPR clarifies that an SA must “act on a complaint”. Article 57(1)(f) GDPR, in turns, establishes that the SA has to “handle complaints lodged by a data subject […], and investigate, to the extent appropriate, the subject matter of the complaint […]”.

The use of the conjunction "and [investigate]" indicates that the "handling" of the complaint must involve an investigative activity, understood as the process of ascertaining the facts. This phrasing does not mean that the SA must always undertake complex investigative activities. Sometimes, to address the complaint, it will be sufficient to verify whether a privacy policy complies with the requirements specified in Article 13 GDPR. Similarly, in the case of cookie banners, it should be ensured that the user dialogue window contains all the necessary elements to render consent valid under the GDPR.

In turn, the investigative activity, whether simple or complex, must lead to the adoption of a final decision that can be challenged under Article 78(1) GDPR. Again, Article 57(1)(f) GDPR is instructive regarding the SA's obligation "[to reach] the outcome of the investigation within a reasonable period". The EDPB confirms that the investigation must have an "outcome," and such an "outcome" must specify "the facts and legal considerations for, e.g., rejecting the complaint or dismissing the complaint, i.e., not investigating it further, with a view to make it a legally attackable act." In other words, what is necessary for the handling of a complaint is not only an investigation, but also the adoption of a legally challengeable act, being the latter a decision in the merits or just a procedural dismissal.

It may also be that the case is settled between the parties and, or the data subject withdraws the complaint. In those cases there is no room to claim that the SA did not handle the complaint, as the complaint ceased to exist. Finally, a SA cannot take an indefinite amount of time to decide on the merits of the case. In light of the principle of effectiveness under Article 4(3) of the Treaty on the European Union ("TEU"), Articles 8, 41 and 47 CFR, and Article 6 of the European Convention on Human Rights ("ECHR"), the SA must issue a decision within a reasonable time. Some Member States foresee decision periods in their national law.

Lack of information by the SA

Article 78(2) GDPR also provides for a remedy where a SA fails to inform the data subject on the progress or outcome of the complaint lodged pursuant to Article 77 GDPR. The SA with which the complaint has been lodged has a duty to inform the data subject under Article 77(2) GDPR but not under Article 78(2) GDPR – unless it is also competent to handle the case under Article 55 or 56 GDPR. Taking into account of the fourth sentence of Recital 141 GDPR, the SA must provide the information at least every three months (“If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject”). Consequently, if a SA manages to decide on a complaint within three months or less, it must only inform the data subject on the outcome of the complaint procedure. Should the procedure take longer, the SA must proactively provide an update on the state of play every three months. If the SA fails to do so, it can be subject to legal actions under Article 78(2) GDPR.

(3) Competent courts and national procedural requirements

Under Article 78(3) GDPR, proceedings against a SA shall be brought before the courts of the Member State where the SA is established. The procedural details of such judicial remedies are subject to Member State law. It is up to Member State law to foresee which national court is competent. In some Member States, civil courts are competent for legal remedies under Article 78 GDPR, in other Member States administrative courts have jurisdiction.

Article 78(1) GDPR requires an effective judicial remedy – a term already used in Article 47(1) CFR. Hence, a Member State's law must not impose inappropriate restrictions that hinder the effectiveness of a remedy under Article 78 GDPR (such as very short deadlines to appeal a SA’s decision under Article 78(2) GDPR). These remedies do not necessarily have to be free of charge, as Article 57(3) GDPR only concerns the performance of the tasks of SAs. However, imposing inadequately high court fees on the claimant – especially if they are a data subject – may violate primary EU law, namely Article 47 CFR in connection with Article 16 TFEU and Article 8 CFR.

In Joined Cases E-11/19 and E-12/1, the EFTA Court held that there are cases in which proceedings under Article 78(1) GDPR that were not initiated by the data subject must be free of charge for the data subject: “It follows from Articles77(1) and 57(3) of Regulation(EU) 2016/679 that where a data subject becomes a party to proceedings under Article 78(1) as a result of a data controller appealing against a supervisory authority’s decision, and where national law imposes this status on a data subject automatically, the data subject may not be made responsible for any costs incurred in relation to those proceedings."

(4) Information on preceding EDPB opinion or decision

If a legal remedy under Article 78(1) GDPR is filed against a SA decision that was preceded by an opinion or a decision of the EDPB in the consistency mechanism (Articles 63 et seq. GDPR), the SA must forward that opinion or decision to the court that is handling the case. This provision ensures that the court does not ignore the EDPB’s opinion or decision when assessing the case. As a national court lacks the competence to waive a decision by the EDPB, if it considers the EDPB’s decision invalid (Recital 143 sentence 11 GDPR), it must request a preliminary ruling from the CJEU under Article 267 TFEU. However, the court may not refer a question on the validity of the EDPB decision at the request of a natural or legal person, which had missed the opportunity to bring an action for annulment of the EDPB decision under Article 263 TFEU.

Decisions

→ You can find all related decisions in Category:Article 78 GDPR