Article 79 GDPR

From GDPRhub
Revision as of 09:17, 29 April 2022 by SR (talk | contribs) (→‎Commentary)
Article 79 - Right to an effective judicial remedy against a controller or processor
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 79 - Right to an effective judicial remedy against a controller or processor

1.  Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2.  Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

Relevant Recitals

Recital 141: Right to Lodge a Complaint and Right to an Effective Judicial Remedy
Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

Recital 145: Plaintiff's Right to Choose the Place of Jurisdiction
For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.

Commentary

Article 79(1) GDPR stipulates the right of a data subject to an effective judicial remedy where the data subject considers that their rights under the GDPR were infringed due to the non-compliant processing of their personal data. Article 79(2) GDPR stipulates in which Member States a data subject can bring court proceedings against a controller or a processor.

(1) Right to an Effective Judicial Remedy

Under Article 79(1) GDPR, each data subject shall have the right to an effective judicial remedy where they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in non-compliance with this Regulation. The provision introduces two requirements: (i) A data subject must consider that a controller or processor have violated (ii) their rights under the GDPR as a result of the processing of their personal data in non-compliance with the GDPR.

Parties

The plaintiff must be a data subject within the meaning of Article 4(1) GDPR, i.e. an identified or identifiable natural person. See commentary on Article 77 GDPR, “Data Subject” for further details. Legal proceedings under Article 79 GDPR can be brought both against a controller (Article 4(7) GDPR) and a processor Article 4(8) GDPR.[1]

Infringement of the Plaintiff’s Rights under the GDPR

The data subject must claim (i) that their personal data have been processed in breach of the GDPR and (ii) that this resulted in an infringement of their rights under the GDPR. Processing in breach of the GDPR includes all violations of material data protection law such as data processing principles under Article 5 GDPR, unlawful processing under Articles 6 to 9 GDPR, or the lack of a valid transfer mechanism under Chapter V GDPR.[2] It further includes violations of delegated acts and implementing acts pursuant to Chapter X of the GDPR as well Member State law clarifying GDPR provisions.[3]

The processing in non-compliance with the GDPR must then result in an infringement of the data subject’s rights under the GDPR, which points towards the necessity of a causal link between the processing in non-compliance with the GDPR and the infringement of the data subject’s rights.[4] This requirement would be fulfilled, for example, where a controller refuses to erase data following a request under Article 17 GDPR that has been based on the lack of a sufficient legal basis under Article 6(1) GDPR.

However, there are cases, where a data subject’s subjective rights under the GDPR have been infringed, but not necessarily as a result of a data processing not in line with GDPR. For example, infringements of Article 15 GDPR can occur even where no data is processed or where the processing is in line with the GDPR: Where the controller ignores a data subject’s access request, the controller has undoubtedly violated Article 15 GDPR. In this case, the infringement of the data subject’s right under the GDPR occurs regardless of whether or not the controller actually processes any data relating to the data subject (after all, this is what the data subject might be trying to find out by their access request). The same applies if the controller ignoring the access request in fact processes the data subject’s personal data but the processing as such complies with the GDPR – in that case, the controller infringed Article 15 GDPR nevertheless. The same is true for infringements of Article 13 and Article 14 GDPR.[5] The collection of the data subject’s data by the controller (processing under Article 4(2) GDPR) triggers the data subject’s right under Article 13 and 14 GDPR.

A strict literal interpretation of Article 79(1) GDPR would lead to the result that the data subject could only bring proceedings under Article 79(1) GDPR if the data collection as such has been in non-compliance with the GDPR (e.g. if there was no legal basis under Article 6(1) GDPR for the data collection or no privacy policy was communicated).[6] In order to avoid a severe legal protection deficit, Article 79(1) GDPR must be interpreted using a teleological approach allowing actions for “mere” violations of Article 13, 14 and 15 GDPR as well.[7] The purpose of Article 79(1) GDPR is to provide the data subject with an effective legal remedy before a court against infringement of their subjective rights under the GDPR – accomplishing the legal requirements already stipulated by Article 47 CFR.[8] Arguing otherwise would severely limit the scope of Article 79(1) GDPR and would not be in line with the purpose of the provision.[9]

Therefore, the requirement of an infringement of a data subject’s rights as a result of data processing in non-compliance with the GDPR must rather be read as excluding court proceedings based on GDPR violations that have no connection to subjective rights of a data subject.[10] This interpretation is supported by Recital 141 GDPR according to which “every data subject should have […] the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringedition”

Consequently, a data subject cannot bring proceedings under Article 79(1) GDPR where no subjective rights under the GDPR are concernedition For example, a data subject cannot use Article 79(1) GDPR regarding a controller’s failure to maintain records of processing activities under Article 30 GDPR, to carry out a data protection impact assessment under Article 35 GDPR or to designate a data protection officer under Article 37 GDPR.[11] These GDPR violations might lead to fines by a SA but generally do not lead to the infringement of a data subject’s subjective right under the GDPR.[12] According to some legal scholars, violations of Article 25 GDPR (data protection by default and by design) can be subject of legal proceedings under Article 79 GDPR, if they have an effect on rights of the data subject.[13]

Regarding the burden of proof on the existence of data processing not in compliance with the GDPR, Articles 5(2) and 24(1) GDPR must be taken into account: If the defendant qualifies as controller under Article 4(7) GDPR, it must demonstrate that processing is performed in accordance with the GDPR.[14]

Effective Judicial Remedy

Article 79 GDPR stipulates a directly applicable subjective right for data subjects. However, the precise procedural rules are subject to Member State law. These rules must be in line with the EU principles of equivalence and effectiveness.[15] Article 79(1) GDPR requires an effective judicial remedy. In light of Article 47 CFR, the access to courts under Article 79 GDPR must not be disproportionally difficult, for example through excessively strict admissibility requirements.[16] Other than procedures before SAs (see Article 57(3) GDPR), legal proceedings under Article 79 GDPR do not have to be free of charge. Legal fees (both court and attorney fees) are subject to Member State law.

Parallel Proceedings Before a DPA and a Court

Article 79(1) GDPR stipulates the data subject’s right to a judicial remedy “without prejudice” to any available administrative or non-judicial remedy, including the right to lodge a complaint with a SA pursuant to Article 77 GDPR. Thus, it is the data subject’s free choice either to lodge a complaint under Article 77 GDPR or to bring proceedings under Article 79 GDPR – or both. This allows for parallel proceedings both pursuant to Article 77 GDPR and under Article 79 GDPR regarding the same alleged GDPR infringement.[17] As the GDPR foresees no rules on how to handle the dangers of contradictory decisions by a SA and a court of law[18] and the question of the binding effect of a SA decision for a court (and vice versa), those issues are to be solved under Member State law for this situation.[19]

Legal Remedy Against the Court’s Decision and Requests for Preliminary Rulings

The possibility of a legal remedy against a court decision under Article 79 GDPR is subject to the procedural law of the Member States. A request for a preliminary ruling by the CJEU under Article 267 TFEU is possible at any stage of the proceedings in accordance with established principles.[20]

(2) Competent Court

Controller’s/Processor’s Establishment or Data Subject’s Habitual Residence

Article 79(2) GDPR is considered the . to the general rules of international jurisdiction under Regulation (EU) No 1215/2012.[21] The data subject can choose to bring proceedings against a controller or processor either (i) with the courts of the Member State where the controller or processor has an establishment or (ii) the courts of the Member State where the data subject has their habitual residence. Taking into account Recital 22 GDPR, establishment “implies the effective and real exercise of activity through stable arrangements. The legal form of such arrangements, whether through a branch or a subsidiary with a legal personality, is not the determining factor in that respect.[22] The data subject cannot choose where to bring proceedings against a public authority of a Member State acting in the exercise of its public powers. Such proceedings must be brought before the court of the Member State the public authority belongs to.[23] The question of which national court of the respective Member State is competent for legal proceedings is subject to Member State law.[24]

Decisions

→ You can find all related decisions in Category:Article 79 GDPR

References

  1. Mundil in Wolff, Brink, BeckOK DatenschutzR, Article 79 GDPR, margin number 8 (C.H. Beck 2021, 36th edition).
  2. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 10 (rdb.at 2018).
  3. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).
  4. Kreße in Sydow, Europäische Datenschutzverordnung, Artikel 79 GDPR, margin number 16 (Nomos 2018, 2nd edition).
  5. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 13 and 14 (rdb.at 2018).
  6. In some cases, a violation of Article 13 or 14 GDPR might lead to violation of the data processing principles established Article 5 GDPR – See Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 14 (rdb.at 2018).
  7. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 29 (Jan Sramek 2021).
  8. See Recital 141 GDPR.
  9. Moos, Schefzig in Taeger, Gabel, DSGVO – BDSG, Article 79 GDPR, margin number 8 (Deutscher Fachverlag 2019 3rd edition); Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 12 (rdb.at 2018).
  10. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 13 (rdb.at 2018).
  11. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 24 (Jan Sramek 2021).
  12. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin number 15 (rdb.at 2018).
  13. Bergt in Kühling, Buchner, DS-GVO BDSG, Artikel 79 GDPR, margin number 24 (C.H. Beck 2020, 3rd edition); Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 79 GDPR, margin number 10 (C.H. Beck 2019).
  14. Jahnel in Jahnel, DSGVO, Article 79 GDPR, margin number 31 (Jan Sramek 2021).
  15. Mundil in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 1 (C.H. Beck 2020, 36th edition).
  16. Mundil in Wolff, Brink, BeckOK Datenschutzrecht, Article 79 GDPR, margin number 4 (C.H. Beck 2020, 36th edition).
  17. Martini in Paal, Pauly, Datenschutz Grundverordnung Bundesdatenschutzgesetz, Article 79 GDPR, margin number 12 (C.H. Beck 2021, 3th edition).
  18. Note that Article 81 GDPR (“Suspension of proceedings”) only deals with parallel proceedings before two courts in different Member States but not with the situation of proceedings concerning the same subject matter pending before a court and a SA.
  19. Leupold, Schrems in Knyrim, Der Datkomm, Article 79 GDPR, margin numbers 25 to 28 (rdb.at 2018).
  20. Nemitz in Ehmann, Selmayr, DS-GVO, Article 79 GDPR, margin number 9 (C.H. Beck 2018, 2nd edition).
  21. Boehm in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 79 GDPR, margin number 17 (C.H. Beck 2019).
  22. See the wide interpretation by the CJEU 13.05.2014, C-131/12 (Google Spain). The CJEU considered the requirement of “processing of personal data carried out in the context of the activities of an establishment” under Article 4(1)(a) of Directive 95/46 fulfilled “when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.”
  23. Bergt in Kühling, Buchner, DS-GVO BDSG, Artikel 79 GDPR, margin number 14 (C.H. Beck 2020, 3rd edition).
  24. Werkmeister in Gola, Datenschutz-Grundverordnung, Artikel 79 GDPR, margin number 11 (C.H. Beck 2018, 2nd edition).