menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Italy) language
Contact our local member in Italy mail_outline
Visit the website of ISL Studio Legale account_balance

arrow_backPrevious Article
Article 78
Next Articlearrow_forward

Right to an effective judicial remedy against a supervisory authority

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 78 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 78 keyboard_arrow_up

Key words related to article 78

Show the recitals of the Regulation related to article 78 keyboard_arrow_down Hide the recitals of the Regulation related to article 78 keyboard_arrow_up

(141) Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

(147) Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor, general jurisdiction rules such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council (13) should not prejudice the application of such specific rules.

Show the recitals of the Directive related to article 78 keyboard_arrow_down Hide the recitals of the Directive related to article 78 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

The Regulation goes further than the Directive: it is not at the discretion of Member States to set up a procedure for appeals, but a absolute right granted to any physical person or legal entity to appeal against a legally binding decision of the supervisory authority concerned. The right to a judicial remedy against a decision by a supervisory authority is an essential element of the protection of individuals with regard to the processing of personal data.

This  right to a an effective judicial remedy arises where the supervisory authority does not handle a complaint or does not inform the data subject within three months or a shorter period as prescribed by the applicable national law, on the progress or outcome of the complaint lodged (paragraph 2).

As a principle, the data subject must lodge a complaint in the jurisdiction of the Member State where the supervisory authority is established (paragraph 3).

Finally, the European text obliges the supervisory authority to communicate to the relevant jurisdiction a complaint against one of its decisions, the notice or the decision of the European Data Protection Board, which would have been made previously under the consistency mechanism (paragraph 4).

The Directive

We have seen (see the comments on Article 77) that pursuant to the Directive, the Member States should implement a procedure whereby any citizen, or an association that represents that citizen can lodge a complaint with the competent control authority, especially to check the lawfulness of a relevant processing.

The Directive further provided that decisions by the supervisory authorities which give rise to complaints may be appealed through the courts.

Potential issues

The evolution is significant. Several States did not allow an appeal against the decisions of the supervisory authorities, often due to their lack of binding powers. The states should therefore insert this remedy in their domestic law, according to their specific procedures (administrative, judicial courts, etc.).

For instance, under Belgian law, the implementation of this new right to an effective judicial remedy will necessarily involve the implementation of a new procedure. 

We wouldn't be surprised that, as in other areas (right to competition, right to energy, etc.), the remedy is entrusted to a specialized chamber within a Member State.

arrow_back Previous Article • Article 78 • Next Article arrow_forward
arrow_back Previous Article • Article 78 Next Article arrow_forward
arrow_back Previous Article • Article 78 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C‑132/21 (12 January 2023), Budapesti Elektromos Művek

Article 77(1), Article 78(1) and Article 79(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Article 47 of the Charter of Fundamental Rights of the European Union,

must be interpreted as permitting the remedies provided for in Article 77(1) and Article 78(1) of that regulation, on the one hand, and Article 79(1) thereof, on the other, to be exercised concurrently with and independently of each other. It is for the Member States, in accordance with the principle of procedural autonomy, to lay down detailed rules as regards the relationship between those remedies in order to ensure the effective protection of the rights guaranteed by that regulation and the consistent and homogeneous application of its provisions, as well as the right to an effective remedy before a court or tribunal as referred to in Article 47 of the Charter of Fundamental Rights.

Decision of the court

Opinion of the advocate General

C‑26/22 et C‑64/22, UF (C‑26/22), AB (C‑64/22) v. Land Hessen (7 December 2023)

1.      Article 78(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that a decision on a complaint adopted by a supervisory authority is subject to full judicial review.

2.      Article 5(1)(a) of Regulation 2016/679, read in conjunction with point (f) of the first subparagraph of Article 6(1) of that regulation,

must be interpreted as precluding a practice of private credit information agencies consisting in retaining, in their own databases, information from a public register relating to the grant of a discharge from remaining debts in favour of natural persons in order to be able to provide information on the solvency of those persons, for a period extending beyond that during which the data are kept in the public register.

3.      Article 17(1)(c) of Regulation 2016/679

must be interpreted as meaning that the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where he or she objects to the processing pursuant to Article 21(1) of that regulation and there are no overriding legitimate grounds capable of justifying, exceptionally, the processing in question.

4.      Article 17(1)(d) of Regulation 2016/679

must be interpreted as meaning that the controller is required to erase unlawfully processed personal data as soon as possible.

Decision of the court

Opinion of the advocate general

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 78 Next Article arrow_forward
Regulation
1e 2e

Art. 78

1.   Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2.   Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

3.   Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4.   Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
1st proposal close

Art. 74

1. Each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them.

2. Each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights, or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point (b) of Article 52(1).

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4. A data subject which is concerned by a decision of a supervisory authority in another Member State than where the data subject has its habitual residence, may request the supervisory authority of the Member State where it has its habitual residence to bring proceedings on its behalf against the competent supervisory authority in the other Member State.

5. The Member States shall enforce final decisions by the courts referred to in this Article.
2nd proposal close

Art. 74

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority competent in accordance with Article 51 and Article 51a does not deal with a complaint or does not inform the data subject within three months or any shorter period provided under Union or Member State law on the progress or outcome of the complaint lodged under Article 73.

3. (...) Proceedings against a (…) supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. 3a. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the European Data Protection Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

4. (…)

5. (…)
Directive close

Art. 28

(…)

3. (…)

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
Italy
compare_arrows

Bulgaria close

Personal Data Protection Act

Article 38. (Last Amendment - SG No. 39/2011)

[…]

(2) (Last Amendment, SG No. 103/2005) The Commission takes a decision within 30 days after the case was brought before it and may issue binding prescriptions, define a time limit to remedy the infringement or impose an administrative penalty

[…]

(6) (Last Amendment - SG No. 39/2011) The decision of the Commission as referred to in Para 2 is subject to appeal under the terms and conditions of the Administrative Procedure Code within 14 days of its receipt.
arrow_back Previous Article • Article 78 Next Article arrow_forward
close

2016 - www.itiplaw.eu.