Article 79 GDPR: Difference between revisions

From GDPRhub
No edit summary
No edit summary
Line 207: Line 207:
== Commentary ==
== Commentary ==


''You can help us fill this section!''
Article 79(1) GDPR stipulates the right of a data subject to an effective judicial remedy where the data subject considers that their rights under the GDPR have been infringed because of the processing of their personal data in non-compliance with the GDPR. Article 79(2) GDPR stipulates in which Member States a data subject can bring court proceedings against a controller or a processor under Article 79(1) GDPR.
 
== Right to an effective judicial remedy ==
 
=== Requirements ===
Article 79(1) has two requirements: (1) A data subject must consider that (2) their rights under the GDPR have been violated as a result a of the processing of their personal data in non-compliance with the GDPR.
 
=== Data subject as plaintiff ===
The plaintiff must be a data subject within the meaning of Article 4(1) GDPR, i.e. an identified or identifiable natural person. See [[Article 77 GDPR|commentary on Article 77 GDPR, “Data Subject”]] for further details.
 
=== Controller or processor as defendant ===
Legal proceedings under Article 79 GDPR can be brought both against a controller (Article 4(7) GDPR) and a processor Article 4(8) GDPR.<ref>''Mundil'' in Wolff, Brink, BeckOK DatenschutzR, Article 79 GDPR, margin number 8 (Beck 2021, 36<sup>th</sup> ed.) (accessed 09.07.2021).</ref>
 
=== Processing in non-compliance with the GDPR and infringement of the plaintiff’s rights under the GDPR ===
The data subject must claim (i) that his or her <u>personal data have been processed in in non-compliance with the GDPR</u> and (ii) that this <u>resulted in an infringement of his or her rights under the GDPR.</u>
Processing in non-compliance with the GDPR includes all violations of material data protection law such as violations of the principles of data processing under Article 5 GDPR, unlawful processing under Articles 6 to 9 GDPR, the lack of a valid transfer mechanism under Chapter V GDPR,.<ref>See ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin number 10 (rdb.at 2018) (accessed 18.06.2021).</ref> It further includes violations of delegated acts and implementing acts pursuant to Chapter X of the GDPR as well Member State law clarifying provisions of the GDPR.<ref>''Jahnel'' in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).</ref>
 
According to the <u>wording of Article 79(1) GDPR</u>, the processing in non-compliance with the GDPR must result in an infringement of the data subject’s rights under the GDPR, which points towards the necessity of a <u>causal link</u> between the processing in non-compliance with the GDPR and the infringement of the data subject’s rights.<ref>''Kreße'' in Sydow, Europäische Datenschutzverordnung, Artikel 79 GDPR, margin number 16 (Nomos 2018, 2<sup>nd</sup> ed.) (accessed 09.07.2021).</ref> This requirement would be fulfilled, for example, where a controller refuses to erase data following a request under Article 17 GDPR that has been based on the lack of a sufficient legal basis under Article 6(1) GDPR. However, there are cases, where a data subject’s subjective rights under the GDPR have been infringed, but not necessarily as a result of a data processing not in line with GDPR.
 
For example, infringements of Article 15 GDPR can occur even where no data is processed or where the processing is in line with the GDPR: Where the controller had ignored a data subject’s access request, the controller has undoubtedly violated Article 15 GDPR. In this case, the infringement of the data subject’s right under the GDPR occurs <u>regardless</u> of whether or not the controller actually processes any data relating to the data subject (after all, this is what the data subject might be trying to find out by his or her access request). The same is true, if the controller ignoring the access request in fact processes the data subject’s personal data but the processing as such being complies with the GDPR – the controller has infringed Article 15 GDPR nevertheless.
 
The same is true for infringements of Article 13 and Article 14 GDPR.<ref>See ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 13 and 14 (rdb.at 2018) (accessed 18.06.2021).</ref> The collection of the data subject’s data by the controller (processing under Article 4(2) GDPR) triggers the data subject’s right under Article 13 and 14 GDPR. Strictly sticking to the wording of Article 79(1) GDPR would lead to the result that the data subject could only bring proceedings under Article 79(1) GDPR, if the data collection <u>as such</u> has been in non-compliance with the GDPR (e.g. if there was no legal basis under Article 6(1) GDPR for the data collection).<ref>In some cases, a violation of Article 13 or 14 GDPR might lead to violation of the data processing principles established Article 5 GDPR – See ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin number 14 (rdb.at 2018) (accessed 18.06.2021).</ref>
 
In order to avoid a s<u>evere legal protection deficit</u>, Article 79(1) GDPR must be interpreted using a <u>teleological approach</u> allowing for proceedings regarding violations of Article 13, 14 and 15 GDPR as well.<ref>''Jahnel'' in Jahnel, DSGVO, Article 79 GDPR, margin number 29 (Jan Sramek 2021.</ref> The <u>purpose of Article 79(1) GDPR</u> is to provide the data subject with an effective legal remedy before a court against infringement of his or her subjective rights under the GDPR – accomplishing the legal requirements already stipulated by Article 47 CFR.<ref>See Recital 141 of the GDPR.</ref> Arguing otherwise, would severely limit the scope of Article 79(1) GDPR and would not be in line with the provision’s purpose.<ref>''Moos,Schefzig'' in Taeger,Gabel, DSGVO – BDSG, Article 79 GDPR, margin number 8 (Deutscher Fachverlag 2019, 3<sup>rd</sup> (accessed 09.07.2021); ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin number 12 (rdb.at 2018) (accessed 18.06.2021).</ref>
 
Therefore, the requirement of ''an infringement of a data subject’s rights being infringed as a result of data processing in non-compliance with the GDPR'' must rather be read as excluding court proceedings based on GDPR violations that have no connection to subjective rights of a data subject.<ref>''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin number 13 (rdb.at 2018) (accessed 18.06.2021).</ref> This interpretation is supported by Recital 141 GDPR according to which “''every data subject should have'' […] ''the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed''.”
 
Consequently, a data subject cannot bring proceedings under Article 79(1) GDPR where no subjective rights under the GDPR are concerned. For example, a data subject cannot bring proceedings under Article 79(1) GDPR regarding a controller’s failure to maintain records of processing activities under Article 30 GDPR, to carry out a data protection impact assessment under Article 35 GDPR or to designate a data protection officer under Article 37 GDPR.<ref>''Jahnel'' in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).</ref> These GDPR violations might lead to fines by a DPA but generally do not lead to the infringement of a data subject’s subjective right under the GDPR.<ref>''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin number 15 (rdb.at 2018) (accessed 18.06.2021).</ref> According to some legal scholars, violations of Article 25 GDPR (data protection by default and by design) can be subject of legal proceedings under Article 79 GDPR, if they have an effect on rights of the data subject.<ref>''Bergt'' in Kühling, Buchner, DS-GVO BDSG, Artikel 79 GDPR, margin number 24 (Beck 2020, 3rd ed.) (accessed 09.07.2021); ''Boehm'' in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 79 GDPR, margin number 10 (Beck 2019) (accessed 09.07.2021).</ref>
 
=== Effective judicial remedy ===
Article 79 GDPR stipulates a directly applicable subjective right for data subjects. However, the precise procedural rules are subject to Member State law. These rules must be in line with the EU principles of equivalence and effectiveness<ref>''Mundil'' in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 1 (Beck 2020, 36th ed.) (accessed 18.06.2021).</ref> - Article 79(1) GDPR requires an ''effective'' judicial remedy. In light of Article 47 CFR, the access to courts under Article 79 GDPR must not be disproportionally difficult, for example through excessively strict admissibility requirements.<ref>''Mundil'' in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 4 (Beck 2020, 36th ed. (accessed 18.06.2021).</ref>
 
Other than procedures before DPAs (see Article 57(3) GDPR), legal proceedings under Article 79 GDPR do not have to be free of charge. Legal fees (both court fees and attorney fees) are subject to Member State law.
 
Regarding the burden of proof on the existence of data processing not in compliance with the GDPR, Articles 5(2) and 24(1) GDPR must be taken into account: If the defendant qualifies as controller under Article 4(7) it must demonstrate that processing is performed in accordance with the GDPR.<ref>''Jahnel'' in Jahnel, DSGVO, Article 79 GDPR, margin number 31 (Jan Sramek 2021).</ref>
 
=== Parallel proceedings before a DPA and a court? ===
Article 79(1) GDPR stipulates the data subject’s right to a judicial remedy without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR. It is the data subject’s free choice either to lodge a complaint under Article 77 GDPR or to bring proceedings under Article 79 GDPR – or both. This allows for parallel proceedings both under Article 77 and under Article 79 GDPR regarding the same alleged GPDR infringement.<ref>''Martini'' in Paal/Pauly, Datenschutz-Grundverordnung Bundesdatenschutzgesetz, Article 79 GDPR, margin number 12 (Beck 2021, 3th ed.) (accessed 18.06.2021).</ref> The question of how to deal with the dangers of contradictory decisions by a DPA and a court of law<ref>Note that Article 81 GDPR (suspension of proceedings) only deals with parallel proceedings before two courts in different Member States but not with the situation of proceedings concerning the same subject matter pending before a court and a DPA.</ref> and the question of the binding effect of a DPA decision for a court (and vice versa) are to be solved under Member State law as the GDPR foresees no rules for this situation.<ref>See ''Leupold, Schrems'' in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 25 to 28 (rdb.at 2018) (accessed 18.06.2021).</ref>
 
=== Legal remedy against the court’s decision and requests for preliminary rulings ===
The possibility of a legal remedy against a court decision under Article 79 GDPR is subject to the procedural law of the Member States. A request for a preliminary ruling by the CJEU under Article 267 TFEU is possible at any stage of the proceedings in accordance with established principles.<ref>''Nemitz'' in Ehmann, Selmayr, DS-GVO, Article 79 GDPR, margin number 9 (Beck 2018, 2<sup>nd</sup> ed.) (accessed 09.07.2021) .</ref>
 
== Competent court ==
 
=== Controller’s/processor’s establishment or data subject’s habitual residence ===
TBC
----


== Decisions ==
== Decisions ==

Revision as of 09:47, 12 July 2021

Article 79 - Right to an effective judicial remedy against a controller or processor
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 79 - Right to an effective judicial remedy against a controller or processor

1.  Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2.  Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Relevant Recitals

Recital 141: Right to effective judicial remedy - Article 79(1)

Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

Recital 145: Choice of Venue - Article 79(2)

For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.

Commentary

Article 79(1) GDPR stipulates the right of a data subject to an effective judicial remedy where the data subject considers that their rights under the GDPR have been infringed because of the processing of their personal data in non-compliance with the GDPR. Article 79(2) GDPR stipulates in which Member States a data subject can bring court proceedings against a controller or a processor under Article 79(1) GDPR.

Right to an effective judicial remedy

Requirements

Article 79(1) has two requirements: (1) A data subject must consider that (2) their rights under the GDPR have been violated as a result a of the processing of their personal data in non-compliance with the GDPR.

Data subject as plaintiff

The plaintiff must be a data subject within the meaning of Article 4(1) GDPR, i.e. an identified or identifiable natural person. See commentary on Article 77 GDPR, “Data Subject” for further details.

Controller or processor as defendant

Legal proceedings under Article 79 GDPR can be brought both against a controller (Article 4(7) GDPR) and a processor Article 4(8) GDPR.[1]

Processing in non-compliance with the GDPR and infringement of the plaintiff’s rights under the GDPR

The data subject must claim (i) that his or her personal data have been processed in in non-compliance with the GDPR and (ii) that this resulted in an infringement of his or her rights under the GDPR. Processing in non-compliance with the GDPR includes all violations of material data protection law such as violations of the principles of data processing under Article 5 GDPR, unlawful processing under Articles 6 to 9 GDPR, the lack of a valid transfer mechanism under Chapter V GDPR,.[2] It further includes violations of delegated acts and implementing acts pursuant to Chapter X of the GDPR as well Member State law clarifying provisions of the GDPR.[3]

According to the wording of Article 79(1) GDPR, the processing in non-compliance with the GDPR must result in an infringement of the data subject’s rights under the GDPR, which points towards the necessity of a causal link between the processing in non-compliance with the GDPR and the infringement of the data subject’s rights.[4] This requirement would be fulfilled, for example, where a controller refuses to erase data following a request under Article 17 GDPR that has been based on the lack of a sufficient legal basis under Article 6(1) GDPR. However, there are cases, where a data subject’s subjective rights under the GDPR have been infringed, but not necessarily as a result of a data processing not in line with GDPR.

For example, infringements of Article 15 GDPR can occur even where no data is processed or where the processing is in line with the GDPR: Where the controller had ignored a data subject’s access request, the controller has undoubtedly violated Article 15 GDPR. In this case, the infringement of the data subject’s right under the GDPR occurs regardless of whether or not the controller actually processes any data relating to the data subject (after all, this is what the data subject might be trying to find out by his or her access request). The same is true, if the controller ignoring the access request in fact processes the data subject’s personal data but the processing as such being complies with the GDPR – the controller has infringed Article 15 GDPR nevertheless.

The same is true for infringements of Article 13 and Article 14 GDPR.[5] The collection of the data subject’s data by the controller (processing under Article 4(2) GDPR) triggers the data subject’s right under Article 13 and 14 GDPR. Strictly sticking to the wording of Article 79(1) GDPR would lead to the result that the data subject could only bring proceedings under Article 79(1) GDPR, if the data collection as such has been in non-compliance with the GDPR (e.g. if there was no legal basis under Article 6(1) GDPR for the data collection).[6]

In order to avoid a severe legal protection deficit, Article 79(1) GDPR must be interpreted using a teleological approach allowing for proceedings regarding violations of Article 13, 14 and 15 GDPR as well.[7] The purpose of Article 79(1) GDPR is to provide the data subject with an effective legal remedy before a court against infringement of his or her subjective rights under the GDPR – accomplishing the legal requirements already stipulated by Article 47 CFR.[8] Arguing otherwise, would severely limit the scope of Article 79(1) GDPR and would not be in line with the provision’s purpose.[9]

Therefore, the requirement of an infringement of a data subject’s rights being infringed as a result of data processing in non-compliance with the GDPR must rather be read as excluding court proceedings based on GDPR violations that have no connection to subjective rights of a data subject.[10] This interpretation is supported by Recital 141 GDPR according to which “every data subject should have […] the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed.”

Consequently, a data subject cannot bring proceedings under Article 79(1) GDPR where no subjective rights under the GDPR are concerned. For example, a data subject cannot bring proceedings under Article 79(1) GDPR regarding a controller’s failure to maintain records of processing activities under Article 30 GDPR, to carry out a data protection impact assessment under Article 35 GDPR or to designate a data protection officer under Article 37 GDPR.[11] These GDPR violations might lead to fines by a DPA but generally do not lead to the infringement of a data subject’s subjective right under the GDPR.[12] According to some legal scholars, violations of Article 25 GDPR (data protection by default and by design) can be subject of legal proceedings under Article 79 GDPR, if they have an effect on rights of the data subject.[13]

Effective judicial remedy

Article 79 GDPR stipulates a directly applicable subjective right for data subjects. However, the precise procedural rules are subject to Member State law. These rules must be in line with the EU principles of equivalence and effectiveness[14] - Article 79(1) GDPR requires an effective judicial remedy. In light of Article 47 CFR, the access to courts under Article 79 GDPR must not be disproportionally difficult, for example through excessively strict admissibility requirements.[15]

Other than procedures before DPAs (see Article 57(3) GDPR), legal proceedings under Article 79 GDPR do not have to be free of charge. Legal fees (both court fees and attorney fees) are subject to Member State law.

Regarding the burden of proof on the existence of data processing not in compliance with the GDPR, Articles 5(2) and 24(1) GDPR must be taken into account: If the defendant qualifies as controller under Article 4(7) it must demonstrate that processing is performed in accordance with the GDPR.[16]

Parallel proceedings before a DPA and a court?

Article 79(1) GDPR stipulates the data subject’s right to a judicial remedy without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR. It is the data subject’s free choice either to lodge a complaint under Article 77 GDPR or to bring proceedings under Article 79 GDPR – or both. This allows for parallel proceedings both under Article 77 and under Article 79 GDPR regarding the same alleged GPDR infringement.[17] The question of how to deal with the dangers of contradictory decisions by a DPA and a court of law[18] and the question of the binding effect of a DPA decision for a court (and vice versa) are to be solved under Member State law as the GDPR foresees no rules for this situation.[19]

Legal remedy against the court’s decision and requests for preliminary rulings

The possibility of a legal remedy against a court decision under Article 79 GDPR is subject to the procedural law of the Member States. A request for a preliminary ruling by the CJEU under Article 267 TFEU is possible at any stage of the proceedings in accordance with established principles.[20]

Competent court

Controller’s/processor’s establishment or data subject’s habitual residence

TBC


Decisions

→ You can find all related decisions in Category:Article 79 GDPR

References

  1. Mundil in Wolff, Brink, BeckOK DatenschutzR, Article 79 GDPR, margin number 8 (Beck 2021, 36th ed.) (accessed 09.07.2021).
  2. See Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 10 (rdb.at 2018) (accessed 18.06.2021).
  3. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).
  4. Kreße in Sydow, Europäische Datenschutzverordnung, Artikel 79 GDPR, margin number 16 (Nomos 2018, 2nd ed.) (accessed 09.07.2021).
  5. See Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 13 and 14 (rdb.at 2018) (accessed 18.06.2021).
  6. In some cases, a violation of Article 13 or 14 GDPR might lead to violation of the data processing principles established Article 5 GDPR – See Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 14 (rdb.at 2018) (accessed 18.06.2021).
  7. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 29 (Jan Sramek 2021.
  8. See Recital 141 of the GDPR.
  9. Moos,Schefzig in Taeger,Gabel, DSGVO – BDSG, Article 79 GDPR, margin number 8 (Deutscher Fachverlag 2019, 3rd (accessed 09.07.2021); Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 12 (rdb.at 2018) (accessed 18.06.2021).
  10. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 13 (rdb.at 2018) (accessed 18.06.2021).
  11. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).
  12. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 15 (rdb.at 2018) (accessed 18.06.2021).
  13. Bergt in Kühling, Buchner, DS-GVO BDSG, Artikel 79 GDPR, margin number 24 (Beck 2020, 3rd ed.) (accessed 09.07.2021); Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 79 GDPR, margin number 10 (Beck 2019) (accessed 09.07.2021).
  14. Mundil in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 1 (Beck 2020, 36th ed.) (accessed 18.06.2021).
  15. Mundil in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 4 (Beck 2020, 36th ed. (accessed 18.06.2021).
  16. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 31 (Jan Sramek 2021).
  17. Martini in Paal/Pauly, Datenschutz-Grundverordnung Bundesdatenschutzgesetz, Article 79 GDPR, margin number 12 (Beck 2021, 3th ed.) (accessed 18.06.2021).
  18. Note that Article 81 GDPR (suspension of proceedings) only deals with parallel proceedings before two courts in different Member States but not with the situation of proceedings concerning the same subject matter pending before a court and a DPA.
  19. See Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 25 to 28 (rdb.at 2018) (accessed 18.06.2021).
  20. Nemitz in Ehmann, Selmayr, DS-GVO, Article 79 GDPR, margin number 9 (Beck 2018, 2nd ed.) (accessed 09.07.2021) .