Article 79 GDPR

← Article 79 - Right to an effective judicial remedy against a controller or processor →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 79 - Right to an effective judicial remedy against a controller or processor

1.  Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2.  Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Relevant Recitals

Recital 22: Processing Activities by an Establishment

Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

Recital 145: Plaintiff's Right to Choose the Place of Jurisdiction

For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.

Recital 141: Right to Lodge a Complaint and Right to an Effective Judicial Remedy

Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

Recital 147: Specific Rules on Jurisdiction

Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor, general jurisdiction rules such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council should not prejudice the application of such specific rules.

Commentary

Article 79 GDPR establishes the data subject right to an effective judicial remedy against a controller or processor. This Article finds its roots in Article 47 of the Charter of Fundamental Rights of the European Union (‘CFR’), which asserts the 'right to an effective remedy before a tribunal'. Article 77 GDPR, which notes the right to lodge a complaint with a supervisory authority ('SA'), does not constitute an effective remedy for the purposes of Article 47 CFR, as SAs are categorised as administrative not judicial bodies.

The first paragraph of Article 79 GDPR establishes the data subject right to an effective judicial remedy where the data subject considers that their rights under the GDPR were infringed due to the non-compliant processing of their personal data. While the second paragraph of Article 79 GDPR addresses jurisdiction, stipulating in which Member States a data subject can bring court proceedings against a controller or a processor.

(1) Right to an effective judicial remedy

Under Article 79(1) GDPR, each data subject shall have the right to an effective judicial remedy where they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in non-compliance with the GDPR. From the wording of the provision, through the use of the word 'where', access to the right is conditional. The provision introduces a two stage cumulative test to determine the applicability of the right: (i) A data subject must consider that a controller or processor have violated their rights under the GDPR, (ii) as a result of the processing of their personal data in non-compliance with the GDPR.

Infringement of the plaintiff’s rights under the GDPR

Article 79 GDPR is a data subject right. Resultantly, the plaintiff must be a data subject within the meaning of Article 4(1) GDPR - an identified or identifiable natural person. Legal proceedings under Article 79 GDPR can be brought both against a controller (as defined under Article 4(7) GDPR) and a processor (as defined under Article 4(8) GDPR).

As noted above, Article 79 GDPR imposes a two-stage cumulative test. The data subject must claim (i) that their personal data have been processed in breach of the GDPR, and (ii) that this processing resulted in an infringement of their rights under the GDPR.

(i) Processing in breach of the GDPR

Processing in breach of the GDPR, (i), includes all violations of material data protection law such as data processing principles under Article 5 GDPR, unlawful processing under Articles 6 to 9 GDPR, or the lack of a valid transfer mechanism under Chapter V GDPR. It further includes violations of delegated acts and implementing acts pursuant to Chapter X of the GDPR, as well Member State law clarifying GDPR provisions. Nonetheless, for the purposes of Article 79(1) GDPR, it is not sufficient if only the processing is in breach of the GDPR, the non-compliant processing must result in an infringement of the data subject's rights under the GDPR.

(ii) Infringement of the data subject's rights under the GDPR

The second limb of the test under Article 79(1) GDPR notes that non-compliant processing with the GDPR must result in an infringement of the data subject’s rights under the GDPR. Naturally, the individual rights to which the provision refers are those enumerated in Chapter III of the GDPR. Nevertheless, any additional data subject rights not explicitly addressed by Chapter III are not excluded from its scope. For instance, included in the infringement of a data subject's rights would be the failure to communicate a data breach to the data subject, the breach of the privacy by design or by default principle (which, arguably translates into a right), or, finally, an unlawful cross-border data transfer.

This limb of Article 79(1) GDPR necessitates a causal link between the non-compliant processing with the GDPR and the infringement of the data subject’s rights. This requirement would be fulfilled, for example, where a controller refuses to erase data following an erasure request under Article 17 GDPR (right to be forgotten), where the original processing of the data had no legal basis for processing under Article 6(1) GDPR.

However, there are cases, where a data subject’s subjective rights under the GDPR have been infringed, but not necessarily as a result of non-compliant processing under the GDPR. For example, infringements of Article 15 GDPR can occur even where no data is processed or where the processing is compliant with the GDPR. For instance, where the controller ignores a data subject’s access request, the controller has undoubtedly violated Article 15 GDPR. In this case, the infringement of the data subject’s right under the GDPR occurred regardless of whether or not the controller actually processed any data relating to the data subject (after all, this is what the data subject might be trying to find out by their access request).

The same applies if a controller that has disregarded an access request, in fact processes the data subject’s personal data, but the processing as such complies with the GDPR. In this case, the controller has nevertheless infringed Article 15 GDPR. The same is true for infringements of Article 13 and Article 14 GDP, as any processing of a data subject’s data by the controller triggers a data subject’s right under Article 13 and 14 GDPR.

Interpretative considerations

We reject a strict literal interpretation of Article 79(1) GDPR, which understands the right to an effective judicial remedy arising only in instances of substantive infringements of data subject's rights. Such a reading would result in a legal deficit. Taking a rigid reading would mean that data subjects could only bring proceedings under Article 79(1) GDPR in limited circumstances of substantive violations. Instead, Article 79(1) GDPR should be read as excluding proceedings where the issues have no connection to data subject's rights.

In order to avoid a severe legal protection deficit, Article 79(1) GDPR must be interpreted purposively, which widens the scope of Article 79(1) GDPR to include actions for 'mere' violations of Article 13, 14 and 15 GDPR as well. The purpose of Article 79(1) GDPR is to provide the data subject with an effective legal remedy before a court against infringement of their subjective rights under the GDPR. A teleological reading fulfils the requirements already stipulated by Article 47 CFR (see below for more on what constitutes an effective judicial remedy under Article 47 CFR). Arguing otherwise would severely limit the scope of Article 79(1) GDPR and would go against the purpose of the provision.

Rather, the cumulative test under Article 79(1) GDPR must be read as excluding court proceedings based on GDPR violations that have no connection to data subject's rights. This interpretation is supported by Recital 141 GDPR, according to which 'every data subject should have […] the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed'.

Consequently, a data subject cannot bring proceedings under Article 79(1) GDPR where no subjective rights under the GDPR are concerned. For example, a data subject cannot use Article 79(1) GDPR to bring an action against a controller’s failure to maintain records of processing activities under Article 30 GDPR, to carry out a data protection impact assessment under Article 35 GDPR, or to designate a data protection officer under Article 37 GDPR. These provisions impose legal obligations upon controllers, and generally, the infringement of them does not result in the infringement of a data subject’s rights under the GDPR. According to some legal scholars, violations of Article 25 GDPR (data protection by default and by design) can be the subject of legal proceedings under Article 79 GDPR, if they have an effect on rights of the data subject.

Burden of proof

While generally the burden and standard of proof are governed by national law, the GDPR establishes a reversal of the burden in relation to the infringement of certain provisions. If the defendant qualifies as controller under Article 4(7) GDPR, they must demonstrate that their processing is compliant with the principles of data processing under Article 5(1) GDPR.

Article 5(2) GDPR establishes that the controller shall be responsible for, and be able to demonstrate compliance with, the principles of data processing under Article 5(1) GDPR. Usually, the burden of proof lies with the claimant (onus probandi). However, this provision imposes a positive legal obligation upon controllers, which is capable of displacing national procedural rules on the burden of proof. The reversal of the burden of proof in relation to Article 5(1) was affirmed by the CJEU in the case of C-175/20, Valsts ieņēmumu dienests.

While the CJEU has not yet addressed the burden of proof in relation to other provisions, Article 24(1) GDPR similarly imposes a positive legal obligation upon controllers to be able to demonstrate that processing is performed in accordance with the GDPR. Given the position taken by the CJEU in Case C-175/20, arguably the reversal of the burden extends to Article 24(1) GDPR.

Effective judicial remedy

Article 79 GDPR stipulates a directly applicable subjective right for data subjects. However, the precise procedural rules are for Member States to determine through their national law. These rules must be in line with the EU principles of equivalence and effectiveness. Article 79(1) GDPR requires an effective judicial remedy. The conditions for an 'effective judicial remedy' are based on accessibility to the courts. In light of Article 47 CFR, access to courts under Article 79 GDPR must not be disproportionally difficult, for example through excessively strict admissibility requirements or prohibitive costs. Other than procedures before SAs (see Article 57(3) GDPR), legal proceedings under Article 79 GDPR do not have to be free of charge. Legal fees (both court and attorney fees) are subject to Member State law.

Parallel proceedings before an SA and a court

Article 79(1) GDPR stipulates the data subject’s right to a judicial remedy “without prejudice” to any available administrative or non-judicial remedy, including the right to lodge a complaint with a SA pursuant to Article 77 GDPR. Thus, it is the data subject’s free choice either to lodge a complaint under Article 77 GDPR or to bring proceedings under Article 79 GDPR – or both. This flexibility allows for parallel proceedings under both Article 77 GDPR and under Article 79 GDPR. As the GDPR foresees no rules on how to handle the dangers of contradictory decisions by a SA and a court of law, this question must be addressed by a Member State's national law.

Legal remedy against the court’s decision and requests for preliminary rulings

The possibility of a legal remedy against a court decision under Article 79 GDPR is subject to the procedural law of the Member States. A request for a preliminary ruling by the CJEU under Article 267 TFEU is possible at any stage of the proceedings in accordance with established principles.

(2) Competent court

Article 79(2) GDPR addresses the jurisdictional competences of courts. In particular, this provision acts as a lex specialis to the general rules of jurisdiction, as it derogates significantly from the Brussels I Regulation (Regulation (EU) No 1215/2012). Recital 147 GDPR confirms that the GDPR's rules on jurisdiction take precedence over general rules governing jurisdiction, in particular the Brussels I Regulation, especially as regards proceedings seeking a judicial remedy, including proceedings for compensation against a controller or processor.

Under Article 79(2) GDPR, the data subject can choose to bring proceedings against a controller or processor either with (i) the courts of the Member State where the controller or processor has an establishment, or with (ii) the courts of the Member State where the data subject has their habitual residence.

Place of establishment

This provision takes a broad reading of the term 'establishment'. As outlined by Recital 22 GDPR, the term 'establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.'

Case law: In relation to the GDPR's predecessor, Directive 95/46/EC, the CJEU in Google Spain, adopted a wide interpretation of the term 'establishment'. The CJEU considered a branch or subsidiary set up in a Member State by the operator of a search engine 'which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State' an establishment for the purposes of Article 4(1)(a) of the Directive.

In cases where a controller or processor has multiple establishments

Notably, the data subject cannot choose where to bring proceedings against a public authority of a Member State acting in the exercise of its public powers. Such proceedings must be brought before the court of the Member State the public authority belongs to. The question of which national court of the respective Member State is competent for legal proceedings is subject to Member State law.

Relationship to the Brussels I Regulation

recital 147 gdpr

compatibility of brussels with the gdpr

Decisions

→ You can find all related decisions in Category:Article 79 GDPR