Article 80 GDPR: Difference between revisions

From GDPRhub
No edit summary
Line 229: Line 229:


=== (2) Independent complaints and lawsuits where provided for by Member State law ===
=== (2) Independent complaints and lawsuits where provided for by Member State law ===
The second paragraph of Article 80 GDPR also acts as an opening clause, which enables Member States to regulate for the right of NPOs to file a complaint or instigate legal proceedings independently of a data subject's mandate. There is a consensus amongst the majority of Commentators that the existence of this right is dependent on Member States to recognise it.<ref>See ''Moos, Schefzig'' in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR, margin number 22 (Deutscher Fachverlag 2019, 3rd edition); ''Boehm'' in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin numbers 14, 15 (C.H. Beck 2019); ''Kreße'' in Sydow, Europäische Datenschutzverordnung, Article 80 GDPR, margin number 13 (Nomos 2018, 2nd edition); ''Frenzel'' in Paal, Pauly, Datenschutz-Grundverordnung Bundesdatenschutzgesetz, Article 80 GDPR, margin number 11 (C.H. Beck 2021, 3th edition); ''Bergt'' in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 13 (C.H. Beck 2020, 3rd edition); ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 80 GDPR, margin number 37 (rdb.at 2018).
The second paragraph of Article 80 GDPR also acts as an opening clause, which enables Member States to provide for the right of NPOs to file a complaint or instigate legal proceedings in the absence of a mandate by a data subject's mandate.  


There is a consensus amongst the majority of Commentators that the existence of this right is dependent on Member States to recognise it.<ref>See ''Moos, Schefzig'' in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR, margin number 22 (Deutscher Fachverlag 2019, 3rd edition); ''Boehm'' in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin numbers 14, 15 (C.H. Beck 2019); ''Kreße'' in Sydow, Europäische Datenschutzverordnung, Article 80 GDPR, margin number 13 (Nomos 2018, 2nd edition); ''Frenzel'' in Paal, Pauly, Datenschutz-Grundverordnung Bundesdatenschutzgesetz, Article 80 GDPR, margin number 11 (C.H. Beck 2021, 3th edition); ''Bergt'' in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 13 (C.H. Beck 2020, 3rd edition); ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 80 GDPR, margin number 37 (rdb.at 2018).
</ref> Consequently, Member States are free to decide whether and to what extent they wish to introduce this right.<ref>''Bergt'' in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 13 (C.H. Beck 2020, 3rd edition).</ref>  
</ref> Consequently, Member States are free to decide whether and to what extent they wish to introduce this right.<ref>''Bergt'' in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 13 (C.H. Beck 2020, 3rd edition).</ref>  


According to Article 80(2) GDPR, where legislated for by Member States, this right extends to [[Article 77 GDPR|Articles 77]], [[Article 78 GDPR|78]] and [[Article 79 GDPR|79 GDPR]], but not [[Article 82 GDPR]]. This exclusion of [[Article 82 GDPR]] is confirmed by the last sentence of Recital 142 GDPR. In addition, Article 80(2) GDPR does not permit Member States to allow NPOs to take legal actions against ''any'' kind of GDPR infringement. The wording of Article 80(2) GDPR specifically requires that the NPO “[…] ''considers that the rights of a data subject under this Regulation have been infringed as a result of the processing''.” Hence, Member States may only provide for NPOs' right to lodge complaints and bring legal proceedings with regard to GDPR provisions that grant subjective rights to data subjects.  
According to Article 80(2) GDPR, where implemented by Member States, this right extends to the lodging of a complaint in accordance with [[Article 77 GDPR|Article 77]] and to the legal remedies listed in Articles [[Article 78 GDPR|78]] and [[Article 79 GDPR|79 GDPR]]. However, the provision does not cover the claim for for compensation under [[Article 82 GDPR]]. This exclusion of [[Article 82 GDPR]] is confirmed by the last sentence of Recital 142 GDPR which states that NPOs "''may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate''".
 
In addition, Article 80(2) GDPR does not permit Member States to allow NPOs to take legal actions against ''any'' kind of GDPR infringement. The wording of Article 80(2) GDPR specifically requires that the NPO “[…] ''considers that the rights of a data subject under this Regulation have been infringed as a result of the processing''.” Hence, Member States may only provide for NPOs' right to lodge complaints and bring legal proceedings with regard to GDPR provisions that grant subjective rights to data subjects.  


However, this specification does not require that a SA or court would need to assess if a ''specific'' data subject’s right under the GDPR has been violated. Rather this question must be assessed on an abstract level, looking to whether ''any'' data subjects’ GDPR rights could have been violated by the processing activity in question.<ref>''Boehm'' in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin numbers 13, 15 (C.H. Beck 2019).</ref>
However, this specification does not require that a SA or court would need to assess if a ''specific'' data subject’s right under the GDPR has been violated. Rather this question must be assessed on an abstract level, looking to whether ''any'' data subjects’ GDPR rights could have been violated by the processing activity in question.<ref>''Boehm'' in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin numbers 13, 15 (C.H. Beck 2019).</ref>

Revision as of 11:42, 18 July 2024

Article 80 - Representation of data subjects
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 80 - Representation of data subjects

1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.

Relevant Recitals

Recital 142: Right to Mandate a Non-Profit Body, Organisation or Association
Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject's mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate.

Commentary

Article 80 GDPR grants data subjects the right to mandate not-for-profit entities ('NPOs') for representation. The purpose of this provision is to remedy the deficits of legal protection for individuals and facilitate the enforcement of data subject rights.[1] The Article regulates how and which not-for-profit entities (NPOs) may lodge complaints and exercise the rights referred to in Articles 77, 78, 79 and 82 GDPR, on data subjects' behalf. Notably, the second paragraph of Article 80 GDPR contains an opening clause,[2] which allows Member States to introduce a right of appeal and a right of action for NPOs, independent of a data subject's mandate.[3]

(1) Data subject right to mandate an NPO

Article 80(1) GDPR establishes the data subject right to mandate a not-for-profit body, organisation or association to lodge a complaint on their behalf, to exercise the rights referred to in Articles 77, 78, 79 and 82 GDPR.

Requirements under Article 80(1) GDPR

The first paragraph of Article 80 GDPR establishes several cumulative conditions for entities to qualify as NPOs. For the purposes of Article 80(1) GDPR must be (i) a not-for-profit body, organisation or association, (ii) properly constituted in accordance with the law of a Member State, (iii) have statutory objectives which are in the public interest, and (iv) must be active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data.

(i) Not-for-profit

The understanding of the term 'not-for-profit' must be given an autonomous meaning, its interpretation in this context should not be determined by Member State law.[4] Essentially, an NPO must not pursue profit-making objectives. However, it may recover its costs by charging a fee or a reimbursement of expenses for its activities, so long as this does not pursue profit-making aims.

(ii) Body, organisation or association properly constituted in accordance with the law of a Member State

The term “body, organisation or association” encompasses only legal persons independent of their legal form under Member State law, but not natural persons.[5] In this regard, the decisive factor is whether an entity is capable of holding rights and obligations under its Member States' national law. Organisations established outside of the Union and European Economic Area cannot represent data subjects under Article 80(1) GDPR.[6] An NPO can be organised under public law of a Member State (such as national chambers of labour or consumer protection organisations foreseen by statutory law), or under civil law (such as private associations).[7]

(iii) Public interest

The interpretation of the term 'public interest' must be done so autonomously, independently of Member State law.[8] The term is to be read broadly, and incorporates the protection of other fundamental rights and freedoms under Union law, as well as the promotion of the general principles of Union law as established in the TEU and TFEU.[9] Notably, the public interest does not need to be restricted solely to data protection law. Nonetheless, the NPO's activities must be in some capacity active in the field of data protection.[10]

(iv) Active in the field of data protection

As noted above, Article 80(1) GDPR does not necessitate that the NPO is exclusively active in the field of data protection. However, it must at least be active in the public interest with a connection to data protection.[11] This requirement would include, for example, consumer protection organisations,[12] workers unions or chambers of labour but excludes entities pursuing commercial interests.[13]

Representation of a data subject under Articles 77, 78 and 79 GDPR

Article 80(1) GDPR establishes the data subject right to mandate an NPO, so long as the NPO qualifies as such in light of the Article's requirements. Firstly, the data subject may mandate the NPO to lodge a complaint under Article 77(1) GDPR on behalf of the data subject and to represent the them before all supervisory authorities (“SA”) (Article 4(21) GDPR).[14] Secondly, the NPO may be mandated to file for a legal remedy under Article 78(1) GDPR against a legally binding SA decision concerning the data subject. Thirdly, the NPO may file for a legal remedy under Article 78(2) GDPR, on behalf of the data subject, where the competent SA for the purposes of Articles 55 and 56 GDPR does not handle a complaint, or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77 GDPR. Lastly, the NPO may file a legal remedy under Article 79 GDPR against a controller or processor regarding a GDPR infringement.

Representation of a data subject under Article 82 GDPR, where provided for by Member State law

The conditions for the right to mandate an NPO for the exercise of the right to receive compensation under Article 82 GDPR, can be distinguished from the right to mandate an NPO for the exercise of the rights under Articles 77, 78 and 79 GDPR. The provision includes an opening clause, which notes that the right to mandate an NPO for the exercise of the rights under Article 82 GDPR, can only be given effect 'where provided for by Member State law'. Consequently, the regulation of representation in damages proceedings are left to the Member States.[15]

The majority of Commentators have interpreted the conditional phrase 'where provided for by Member State law' in Article 80(1) GDPR, as only applying to the mandate for the exercise of the right to receive compensation under Article 82 GDPR.[16] In relation to the right to mandate an NPO for the exercise of the rights under Articles 77, 78, and 79 GDPR, there is no prior requirement for further legislation by the Member State.

This reading is further supported by Recital 142 GDPR, which clarifies that the words 'where provided for by Member State law' only apply to the exercise of the right to receive compensation referred to in Article 82 GDPR. Furthermore, the legislative history of Article 80 GDPR affirms this interpretation. The right to mandate a NPO when exercising the right to receive compensation under Article 82 GDPR was not included in the initial draft of Article 80 GDPR (then Article 73) and was only inserted later by the European Parliament. Following the submission of the original draft, during the Trialogue proceedings, the right to mandate NPOs when exercising the right to compensation was made subject to an opening clause.[17]

Nonetheless, even in instances where a Member State has not made use of the opening clause in relation to Article 82 GDPR, claims for damages may still be undertaken by an NPO if this is permitted under the civil law of the Member State. In such cases, the NPO would not represent the data subject but claim the assigned damages on its own behalf and forward any compensations received through the court proceedings to the data subject.

The Collective Redress Directive (Directive (EU) 2020/1828) foresees that qualified non-profit entities shall be entitled to bring representative actions on behalf of consumers for certain infringements of EU law.[18] According to Article 2 and Annex 1 of the Collective Redress Directive, these actions include issues relating to GDPR infringements. Depending on the respective national implementation of the Collective Redress Directive, the opening clause in Article 80(1) GDPR might become somewhat redundant, as Member States would have to entitle NPOs to represent data subjects in connection with claims for compensation under Article 82 GDPR.

(2) Independent complaints and lawsuits where provided for by Member State law

The second paragraph of Article 80 GDPR also acts as an opening clause, which enables Member States to provide for the right of NPOs to file a complaint or instigate legal proceedings in the absence of a mandate by a data subject's mandate.

There is a consensus amongst the majority of Commentators that the existence of this right is dependent on Member States to recognise it.[19] Consequently, Member States are free to decide whether and to what extent they wish to introduce this right.[20]

According to Article 80(2) GDPR, where implemented by Member States, this right extends to the lodging of a complaint in accordance with Article 77 and to the legal remedies listed in Articles 78 and 79 GDPR. However, the provision does not cover the claim for for compensation under Article 82 GDPR. This exclusion of Article 82 GDPR is confirmed by the last sentence of Recital 142 GDPR which states that NPOs "may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate".

In addition, Article 80(2) GDPR does not permit Member States to allow NPOs to take legal actions against any kind of GDPR infringement. The wording of Article 80(2) GDPR specifically requires that the NPO “[…] considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.” Hence, Member States may only provide for NPOs' right to lodge complaints and bring legal proceedings with regard to GDPR provisions that grant subjective rights to data subjects.

However, this specification does not require that a SA or court would need to assess if a specific data subject’s right under the GDPR has been violated. Rather this question must be assessed on an abstract level, looking to whether any data subjects’ GDPR rights could have been violated by the processing activity in question.[21]

Decisions

→ You can find all related decisions in Category:Article 80 GDPR

References

  1. Leupold, Schrems in Knyrim, Der Datkomm, Article 80 GDPR, margin number 2 (rdb.at 2018).
  2. Opening clauses permit a Member State to modify the provisions of an Article. In practice, opening clauses allow Member States to legislate for a more restrictive application of the provision concerned.
  3. Leupold, Schrems in Knyrim, Der Datkomm, Article 80 GDPR, margin number 6 (rdb.at 2018).
  4. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 6 (C.H. Beck 2020, 3rd edition).
  5. Karg in Wolff, Brink, BeckOK DatenschutzR, Article 80 GDPR, margin number 10 (C.H. Beck 2021, 36th edition).
  6. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 5 (C.H. Beck 2020, 3rd edition).
  7. Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR margin number 7 (Deutscher Fachverlag 2019, 3rd edition).
  8. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 6 (C.H. Beck 2020, 3rd edition); Leupold, Schrems in Knyrim, Der Datkomm, Article 80 GDPR, margin number 12 (rdb.at 2018).
  9. Leupold, Schrems in Knyrim, Der Datkomm, Article 80 GDPR, margin number 13 (rdb.at 2018).
  10. Leupold, Schrems in Knyrim, Der Datkomm, Article 80 GDPR, margin number 12 (rdb.at 2018).
  11. Karg in Wolff, Brink, BeckOK DatenschutzR, Article 80 GDPR, margin number 11 (C.H. Beck 2021, 36th edition); Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR margin number 10 (Deutscher Fachverlag 2019, 3rd edition).
  12. See the Austrian Supreme Court’s request for the CJEU’s preliminary ruling regarding the legal relationship between Article 80 GDPR and national law granting consumer protection organisations the power to bring abstract lawsuits.
  13. Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR, margin number 6 (Deutscher Fachverlag 2019, 3rd edition).
  14. The wording of Article 80(1) GDPR differentiates between “lodging a complaint on behalf of the data subject” and “exercising the right referred to in Article 77 GDPR”. As the right to lodge a complaint is the only right exercisable under Article 77 GDPR, this differentiation is redundant; see Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR, margin number 12 (Deutscher Fachverlag 2019, 3rd edition).
  15. Boehm in Simitis. Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin number 11 (C.H. Beck 2019).
  16. See for example Fuster in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 80 GDPR, p. 1148 (Oxford University Press 2020); Kreße in Sydow, Europäische Datenschutzverordnung, Artikel 80 GDPR, margin number 11 (Nomos 2018, 2nd edition); Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR, margin number 13 (Deutscher Fachverlag 2019, 3rd edition); Werkmeister in Gola, Datenschutz-Grundverordnung, Artikel 80 GDPR, margin number 9 (C.H. Beck 2018, 2nd edition); the only German legal scholars disagreeing seem to be Nemitz in Ehmann, Selmayr, DS-GVO, Article 80 GDPR, margin number 9 (C.H. Beck 2018, 2nd edition) and Karg in Wolff, Brink, BeckOK DatenschutzR, Article 80 GDPR, margin number 8 (C.H. Beck 2021, 36th edition). The latter take the view that Article 80(1) GDPR shall apply only if and to the extent that Member State law provides that natural persons may be represented by organisations.
  17. Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin number 5 (C.H. Beck 2019); Bergt in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 4 (C.H. Beck 2020, 3rd edition).
  18. See, Articles 3(4) and 4 Collective Redress Directive (EU) 2020/1828.
  19. See Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 80 GDPR, margin number 22 (Deutscher Fachverlag 2019, 3rd edition); Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin numbers 14, 15 (C.H. Beck 2019); Kreße in Sydow, Europäische Datenschutzverordnung, Article 80 GDPR, margin number 13 (Nomos 2018, 2nd edition); Frenzel in Paal, Pauly, Datenschutz-Grundverordnung Bundesdatenschutzgesetz, Article 80 GDPR, margin number 11 (C.H. Beck 2021, 3th edition); Bergt in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 13 (C.H. Beck 2020, 3rd edition); Leupold, Schrems in Knyrim, Der Datkomm, Article 80 GDPR, margin number 37 (rdb.at 2018).
  20. Bergt in Kühling, Buchner, DS-GVO BDSG, Article 80 GDPR, margin number 13 (C.H. Beck 2020, 3rd edition).
  21. Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 80 GDPR, margin numbers 13, 15 (C.H. Beck 2019).