Article 79 GDPR: Difference between revisions

From GDPRhub
No edit summary
Line 230: Line 230:


===== Burden of proof =====
===== Burden of proof =====
While generally the burden and standard of proof are governed by national law, the GDPR establishes a reversal of the burden in relation to the infringement of certain provisions. If the defendant qualifies as controller under [[Article 4 GDPR|Article 4(7) GDPR]], they must demonstrate that their processing is compliant with the principles of data processing under [[Article 5 GDPR|Article 5(1) GDPR]]. [[Article 5 GDPR|Article 5(2) GDPR]] establishes that the controller shall be responsible for, and be able to demonstrate compliance with, the principles of data processing under [[Article 5 GDPR|Article 5(1) GDPR]]. Usually, the burden of proof lies with the claimant (''onus probandi''). However, this provision imposes a positive legal obligation upon controllers, which is capable of displacing national procedural rules on the burden of proof. The reversal of the burden of proof in relation to [[Article 5 GDPR|Article 5(1)]] was affirmed by the CJEU in Case C-175/20, Valsts ieņēmumu dienests.<ref>C-175/20, ''Valsts ieņēmumu dienests'', paras 77-78. </ref>
<s>While generally the burden and standard of proof are governed by national law, the GDPR establishes a reversal of the burden in relation to the infringement of certain provisions. If the defendant qualifies as controller under [[Article 4 GDPR|Article 4(7) GDPR]], they must demonstrate that their processing is compliant with the principles of data processing under [[Article 5 GDPR|Article 5(1) GDPR]]. [[Article 5 GDPR|Article 5(2) GDPR]] establishes that the controller shall be responsible for, and be able to demonstrate compliance with, the principles of data processing under [[Article 5 GDPR|Article 5(1) GDPR]]. Usually, the burden of proof lies with the claimant (''onus probandi''). However, this provision imposes a positive legal obligation upon controllers, which can shift the burden of proof in relation to [[Article 5 GDPR|Article 5(1)]] GDPR.</s> (do we keep this)
 
While the CJEU has not yet addressed the burden of proof in relation to other provisions, [[Article 24 GDPR|Article 24(1) GDPR]] similarly imposes a positive legal obligation upon controllers to be able to demonstrate that processing is performed in accordance with the GDPR. Given the position taken by the CJEU in Case C-175/20, arguably the reversal of the burden extends to [[Article 24 GDPR|Article 24(1) GDPR]].


==== Effective judicial remedy ====
==== Effective judicial remedy ====

Revision as of 09:56, 21 November 2023

Article 79 - Right to an effective judicial remedy against a controller or processor
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 79 - Right to an effective judicial remedy against a controller or processor

1.  Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2.  Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Relevant Recitals

Recital 22: Processing Activities by an Establishment
Any processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union should be carried out in accordance with this Regulation, regardless of whether the processing itself takes place within the Union. Establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.

Recital 145: Plaintiff's Right to Choose the Place of Jurisdiction
For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.

Recital 141: Right to Lodge a Complaint and Right to an Effective Judicial Remedy
Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

Recital 147: Specific Rules on Jurisdiction
Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor, general jurisdiction rules such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council should not prejudice the application of such specific rules.

Commentary

Article 79 GDPR establishes the data subject right to an effective judicial remedy against a controller or processor. This Article finds its roots in Article 47 of the Charter of Fundamental Rights of the European Union (‘CFR’), which asserts the 'right to an effective remedy before a tribunal'. Article 77 GDPR, which notes the right to lodge a complaint with a supervisory authority ('SA'), does not constitute an effective remedy for the purposes of Article 47 CFR, as SAs are categorised as administrative not judicial bodies.[1]

The first paragraph of Article 79 GDPR establishes the data subject right to an effective judicial remedy where the data subject considers that their rights under the GDPR were infringed due to the non-compliant processing of their personal data. While the second paragraph of Article 79 GDPR addresses jurisdiction, stipulating in which Member States a data subject can bring court proceedings against a controller or a processor.

(1) Right to an effective judicial remedy

Under Article 79(1) GDPR, each data subject shall have the right to an effective judicial remedy where they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in non-compliance with the GDPR. From the wording of the provision, through the use of the word 'where', access to the right is conditional. The provision introduces a two stage cumulative test to determine the applicability of the right: (i) A data subject must consider that a controller or processor have violated their rights under the GDPR, (ii) as a result of the processing of their personal data in non-compliance with the GDPR.

Infringement of the plaintiff’s rights under the GDPR

Article 79 GDPR is a data subject right. Resultantly, the plaintiff must be a data subject within the meaning of Article 4(1) GDPR - an identified or identifiable natural person. Legal proceedings under Article 79 GDPR can be brought both against a controller (as defined under Article 4(7) GDPR) and a processor (as defined under Article 4(8) GDPR).[2]

As noted above, Article 79 GDPR imposes a two-stage cumulative test. The data subject must claim (i) that their personal data have been processed in breach of the GDPR, and (ii) that this processing resulted in an infringement of their rights under the GDPR.

(i) Processing in breach of the GDPR

Processing in breach of the GDPR, (i), includes all violations of material data protection law such as data processing principles under Article 5 GDPR, unlawful processing under Articles 6 to 9 GDPR, or the lack of a valid transfer mechanism under Chapter V GDPR.[3] It further includes violations of delegated acts and implementing acts pursuant to Chapter X of the GDPR, as well Member State law clarifying GDPR provisions.[4] Nonetheless, for the purposes of Article 79(1) GDPR, it is not sufficient if only the processing is in breach of the GDPR, the non-compliant processing must result in an infringement of the data subject's rights under the GDPR.

(ii) Infringement of the data subject's rights under the GDPR

The second limb of the test under Article 79(1) GDPR notes that non-compliant processing with the GDPR must result in an infringement of the data subject’s rights under the GDPR. Naturally, the individual rights to which the provision refers are those enumerated in Chapter III of the GDPR. Nevertheless, any additional data subject rights not explicitly addressed by Chapter III are not excluded from its scope. For instance, included in the infringement of a data subject's rights would be the failure to communicate a data breach to the data subject, the breach of the privacy by design or by default principle (which, arguably translates into a right), or, finally, an unlawful cross-border data transfer.[5]

This limb of Article 79(1) GDPR necessitates a causal link between the non-compliant processing with the GDPR and the infringement of the data subject’s rights.[6] This requirement would be fulfilled, for example, where a controller refuses to erase data following an erasure request under Article 17 GDPR (right to be forgotten), where the original processing of the data had no legal basis for processing under Article 6(1) GDPR.

However, there are cases, where a data subject’s subjective rights under the GDPR have been infringed, but not necessarily as a result of non-compliant processing under the GDPR. For example, infringements of Article 15 GDPR can occur even where no data is processed or where the processing is compliant with the GDPR. For instance, where the controller ignores a data subject’s access request, the controller has undoubtedly violated Article 15 GDPR. In this case, the infringement of the data subject’s right under the GDPR occurred regardless of whether or not the controller actually processed any data relating to the data subject (after all, this is what the data subject might be trying to find out by their access request).

The same applies if a controller that has disregarded an access request, in fact processes the data subject’s personal data, but the processing as such complies with the GDPR. In this case, the controller has nevertheless infringed Article 15 GDPR. The same is true for infringements of Article 13 and Article 14 GDP,[7] as any processing of a data subject’s data by the controller triggers a data subject’s right under Article 13 and 14 GDPR.

Interpretative considerations

We reject a strict literal interpretation of Article 79(1) GDPR, which understands the right to an effective judicial remedy arising only in instances of substantive infringements of data subject's rights. Such a reading would result in a legal deficit. Taking a rigid reading would mean that data subjects could only bring proceedings under Article 79(1) GDPR in limited circumstances of substantive violations.[8] Instead, Article 79(1) GDPR should be read as excluding proceedings where the issues have no connection to data subject's rights.

In order to avoid a severe legal protection deficit, Article 79(1) GDPR must be interpreted purposively, which widens the scope of Article 79(1) GDPR to include actions for 'mere' violations of Article 13, 14 and 15 GDPR as well.[9] The purpose of Article 79(1) GDPR is to provide the data subject with an effective legal remedy before a court against infringement of their subjective rights under the GDPR. A teleological reading fulfils the requirements already stipulated by Article 47 CFR (see below for more on what constitutes an effective judicial remedy under Article 47 CFR).[10] Arguing otherwise would severely limit the scope of Article 79(1) GDPR and would go against the purpose of the provision.[11]

Rather, the cumulative test under Article 79(1) GDPR must be read as excluding court proceedings based on GDPR violations that have no connection to data subject's rights.[12] This interpretation is supported by Recital 141 GDPR, according to which 'every data subject should have […] the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed'.

Consequently, a data subject cannot bring proceedings under Article 79(1) GDPR where no subjective rights under the GDPR are concerned. For example, a data subject cannot use Article 79(1) GDPR to bring an action against a controller’s failure to maintain records of processing activities under Article 30 GDPR, to carry out a data protection impact assessment under Article 35 GDPR, or to designate a data protection officer under Article 37 GDPR.[13] These provisions impose legal obligations upon controllers, and generally, the infringement of them does not result in the infringement of a data subject’s rights under the GDPR.[14] According to some legal scholars, violations of Article 25 GDPR (data protection by default and by design) can be the subject of legal proceedings under Article 79 GDPR, if they have an effect on rights of the data subject.[15]

Burden of proof

While generally the burden and standard of proof are governed by national law, the GDPR establishes a reversal of the burden in relation to the infringement of certain provisions. If the defendant qualifies as controller under Article 4(7) GDPR, they must demonstrate that their processing is compliant with the principles of data processing under Article 5(1) GDPR. Article 5(2) GDPR establishes that the controller shall be responsible for, and be able to demonstrate compliance with, the principles of data processing under Article 5(1) GDPR. Usually, the burden of proof lies with the claimant (onus probandi). However, this provision imposes a positive legal obligation upon controllers, which can shift the burden of proof in relation to Article 5(1) GDPR. (do we keep this)

Effective judicial remedy

Article 79 GDPR stipulates a directly applicable subjective right for data subjects. However, the precise procedural rules are for Member States to determine through their national law. These rules must be in line with the EU principles of equivalence and effectiveness.[16] Article 79(1) GDPR requires an effective judicial remedy. The conditions for an effective judicial remedy are based on accessibility to the courts.[17] In light of Article 47 CFR, access to courts under Article 79 GDPR must not be disproportionally difficult, for example through excessively strict admissibility requirements or prohibitive costs.[18] Other than procedures before SAs (see Article 57(3) GDPR), legal proceedings under Article 79 GDPR do not have to be free of charge. The regulation of legal fees (both court and attorney fees) are subject to Member State law.

Case law: In Schrems I, the CJEU held that for the purposes of Article 47 CFR, claimants must have access to judicial remedies enabling them to challenge decisions adversely affecting them before the national courts,[19] emphasising that the lack of any such opportunity to pursue legal remedies fails to 'respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter’.[20]

Parallel proceedings before an SA and a court

Article 79(1) GDPR stipulates the data subject’s right to a judicial remedy “without prejudice” to any available administrative or non-judicial remedy, including the right to lodge a complaint with a SA pursuant to Article 77 GDPR. Thus, it is the data subject’s free choice either to lodge a complaint under Article 77 GDPR or to bring proceedings under Article 79 GDPR – or both. This flexibility allows for parallel proceedings under both Article 77 GDPR and under Article 79 GDPR.[21] As the GDPR foresees no rules on how to handle the dangers of contradictory decisions by a SA and a court of law,[22] this question must be addressed by a Member State's national law.[23]

Legal remedy against the court’s decision and requests for preliminary rulings

The possibility of a legal remedy against a court decision under Article 79 GDPR is subject to the procedural law of the Member States. A request for a preliminary ruling by the CJEU under Article 267 TFEU is possible at any stage of the proceedings in accordance with established principles.[24]

(2) Competent court

Article 79(2) GDPR addresses the jurisdictional competences of courts. In particular, this provision acts as a lex specialis to the general rules of jurisdiction,[25] as it derogates significantly from the Brussels I Regulation (Recast) (Regulation (EU) No 1215/2012).[26] Under Article 79(2) GDPR, the data subject can choose to bring proceedings against a controller or processor either with (i) the courts of the Member State where the controller or processor has an establishment, or with (ii) the courts of the Member State where the data subject has their habitual residence.

(i) Place of establishment

This provision takes a broad reading of the term 'establishment'. As outlined by Recital 22 GDPR, the term 'establishment implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.'[27]

Case law: The CJEU in Google Spain in relation to the GDPR's predecessor, Directive 95/46/EC, adopted a wide interpretation of the term 'establishment'. The CJEU considered a branch or subsidiary set up in a Member State by the operator of a search engine, 'which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State', an establishment for the purposes of Article 4(1)(a) of the Directive.[28]

In cases where a controller or processor has multiple establishments, proceedings do not need to be brought against the main establishment. Article 79(2) GDPR allows data subjects the freedom to choose between a controller's or processor's establishments.[29]

Notably, the data subject cannot choose where to bring proceedings against a public authority of a Member State acting in the exercise of its public powers. Such proceedings must be brought before the court of the Member State to which the public authority belongs to.[30] The question of which national court of the respective Member State is competent for legal proceedings is subject to Member State law.[31]

(ii) Habitual residence

Article 79(2) GDPR, in addition, allows data subjects to bring proceedings with the courts of the Member State where the data subject has their habitual residence. Given that term 'habitual residence' is not defined by the GDPR, it should be read autonomously in light of Union law.[32] The term appears throughout other Union regulations, such as in the Brussels I Regulation, the Rome I Regulation and the Rome II Regulation. As clarified by CJEU jurisprudence, a person's habitual residence is determined by the place where a person habitually resides and where the habitual centre of their interests lie. The determination of these two factors necessitates a subjective intention of permanence.[33]

Case law: In the case of Fernández v Commission, the CJEU held that 'the place of habitual residence is that in which the official concerned has established, with the intention that it should be of a lasting character, the permanent or habitual centre of his interests. However, for the purposes of determining habitual residence, all the factual circumstances which constitute such residence must be taken into account.'[34]

Relationship to the Brussels I Regulation

As noted above, Article 79(2) GDPR derogates from the general rules of jurisdiction. Recital 147 GDPR confirms that the GDPR's rules on jurisdiction take precedence over general rules of jurisdiction, in particular over the Brussels I Regulation (Recast), as regards proceedings seeking a judicial remedy, including proceedings for compensation against a controller or processor.

Some Commentators have argued that to the extent that the rules of jurisdiction under the Brussels I Regulation are compatible with the GDPR, they should continue to apply, to allow plaintiffs additional choices of fora.[35] However, such a reading would go against the purpose of Article 79(2) GDPR, which aims to guard against forum shopping.[36]

Decisions

→ You can find all related decisions in Category:Article 79 GDPR

References

  1. Kotschy, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 79 GDPR, p. 1135 (Oxford University Press 2020).
  2. Mundil in Wolff, Brink, BeckOK DatenschutzR, Article 79 GDPR, margin number 8 (C.H. Beck 2021, 36th edition).
  3. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 10 (rdb.at 2018).
  4. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).
  5. Tambou, in Spiecker gen. Döhmann, Papakonstantinou, Hornung, De Hert, General Data Protection Regulation, Article 79, margin number 14 (Nomos Verlagsgesellschaft 2023, 1st edition).
  6. Kreße in Sydow, Europäische Datenschutzverordnung, Artikel 79 GDPR, margin number 16 (Nomos 2018, 2nd edition).
  7. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 13 and 14 (rdb.at 2018).
  8. In some cases, a violation of Article 13 or 14 GDPR might lead to violation of the data processing principles established Article 5 GDPR – See Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 14 (rdb.at 2018).
  9. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 29 (Jan Sramek 2021).
  10. See Recital 141 GDPR.
  11. Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 79 GDPR, margin number 8 (Deutscher Fachverlag 2019 3rd edition); Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 12 (rdb.at 2018).
  12. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 13 (rdb.at 2018).
  13. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).
  14. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 15 (rdb.at 2018).
  15. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 79 GDPR, margin number 24 (C.H. Beck 2020, 3rd edition); Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 79 GDPR, margin number 10 (C.H. Beck 2019).
  16. Mundil in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 1 (C.H. Beck 2020, 36th edition).
  17. For more on the meaning of 'effective' in the context of Article 47 CFR, see Kotschy, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 79 GDPR, p. 1134 (Oxford University Press 2020).
  18. Mundil in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 4 (C.H. Beck 2020, 36th edition).
  19. Case C‑362/14, Schrems I, para 64.
  20. Case C‑362/14, Schrems I, para 95.
  21. Martini in Paal, Pauly, Datenschutz Grundverordnung Bundesdatenschutzgesetz, Article 79 GDPR, margin number 12 (C.H. Beck 2021, 3th edition).
  22. Note that Article 81 GDPR (“Suspension of proceedings”) only deals with parallel proceedings before two courts in different Member States but not with the situation of proceedings concerning the same subject matter pending before a court and a SA.
  23. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 25 to 28 (rdb.at 2018).
  24. Nemitz in Ehmann, Selmayr, DS-GVO, Article 79 GDPR, margin number 9 (C.H. Beck 2018, 2nd edition).
  25. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 79 GDPR, margin number 15 (C.H. Beck 2020, 3rd edition);
  26. Kotschy, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 79 GDPR, p. 1140 (Oxford University Press 2020).
  27. Also, see Case C-131/12, Google Spain, para 48; and Case C-230/14, Weltimmo, para 28.
  28. Case C-131/12, Google Spain, para 55.
  29. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 79 GDPR, margin number 16 (C.H. Beck 2020, 3rd edition).
  30. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 79 GDPR, margin number 14 (C.H. Beck 2020, 3rd edition).
  31. Werkmeister in Gola, Datenschutz-Grundverordnung, Artikel 79 GDPR, margin number 11 (C.H. Beck 2018, 2nd edition).
  32. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 79 GDPR, margin number 17 (C.H. Beck 2020, 3rd edition).
  33. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 37 (rdb.at 2018).
  34. Case C-452/93, Fernández v Commission, para 22.
  35. Kotschy, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 79 GDPR, p. 1140 (Oxford University Press 2020).
  36. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 37 (rdb.at 2018); Martini in Paal, Pauly, Datenschutz Grundverordnung Bundesdatenschutzgesetz, Article 79 GDPR, margin number 28 (C.H. Beck 2021, 3th edition).