Article 78
Right to an effective judicial remedy against a supervisory authority

Official
Texts
Guidelines
& Caselaw
Review of
EU Regulation
Review of
Nat. Regulation
Show the recitals of the Regulation related to article 78 keyboard_arrow_down Hide the recitals of the Regulation related to article 78 keyboard_arrow_up

(141) Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

(147) Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor, general jurisdiction rules such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council (13) should not prejudice the application of such specific rules.

Show the recitals of the Directive related to article 78 keyboard_arrow_down Hide the recitals of the Directive related to article 78 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

The Regulation goes further than the Directive: it is not at the discretion of Member States to set up a procedure for appeals, but a absolute right granted to any physical person or legal entity to appeal against a legally binding decision of the supervisory authority concerned. The right to a judicial remedy against a decision by a supervisory authority is an essential element of the protection of individuals with regard to the processing of personal data.

This  right to a an effective judicial remedy arises where the supervisory authority does not handle a complaint or does not inform the data subject within three months or a shorter period as prescribed by the applicable national law, on the progress or outcome of the complaint lodged (paragraph 2).

As a principle, the data subject must lodge a complaint in the jurisdiction of the Member State where the supervisory authority is established (paragraph 3).

Finally, the European text obliges the supervisory authority to communicate to the relevant jurisdiction a complaint against one of its decisions, the notice or the decision of the European Data Protection Board, which would have been made previously under the consistency mechanism (paragraph 4).

The Directive

We have seen (see the comments on Article 77) that pursuant to the Directive, the Member States should implement a procedure whereby any citizen, or an association that represents that citizen can lodge a complaint with the competent control authority, especially to check the lawfulness of a relevant processing.

The Directive further provided that decisions by the supervisory authorities which give rise to complaints may be appealed through the courts.

Potential issues

The evolution is significant. Several States did not allow an appeal against the decisions of the supervisory authorities, often due to their lack of binding powers. The states should therefore insert this remedy in their domestic law, according to their specific procedures (administrative, judicial courts, etc.).

For instance, under Belgian law, the implementation of this new right to an effective judicial remedy will necessarily involve the implementation of a new procedure. 

We wouldn't be surprised that, as in other areas (right to competition, right to energy, etc.), the remedy is entrusted to a specialized chamber within a Member State.

Regulation
1e 2e

Art. 78

1.   Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2.   Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

3.   Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4.   Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

1st proposal close

Art. 74

1. Each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them.

2. Each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights, or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point (b) of Article 52(1).

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4. A data subject which is concerned by a decision of a supervisory authority in another Member State than where the data subject has its habitual residence, may request the supervisory authority of the Member State where it has its habitual residence to bring proceedings on its behalf against the competent supervisory authority in the other Member State.

5. The Member States shall enforce final decisions by the courts referred to in this Article.

2nd proposal close

Art. 74

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority competent in accordance with Article 51 and Article 51a does not deal with a complaint or does not inform the data subject within three months or any shorter period provided under Union or Member State law on the progress or outcome of the complaint lodged under Article 73.

3. (...) Proceedings against a (…) supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. 3a. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the European Data Protection Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

4. (…)

5. (…)

Directive close

Art. 28

(…)

3. (…)

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

Art. 46 WBP

1. Indien een beslissing als bedoeld in artikel 45 is genomen door een ander dan een bestuursorgaan, kan de belanghebbende zich tot de rechtbank wenden met het schriftelijk verzoek, de verantwoordelijke te bevelen alsnog een verzoek als bedoeld in de artikelen 30, derde lid, 35, 36 of 38, tweede lid, toe of af te wijzen dan wel een verzet als bedoeld in de artikelen 40 of 41 al dan niet te honoreren.

2. Het verzoekschrift moet worden ingediend binnen zes weken na ontvangst van het antwoord van de verantwoordelijke. Indien de verantwoordelijke niet binnen de gestelde termijn heeft geantwoord, moet het verzoekschrift worden ingediend binnen zes weken na afloop van die termijn.

3. De rechtbank wijst het verzoek toe, voor zover zij dit gegrond oordeelt. Alvorens de rechtbank beslist, stelt zij zo nodig de belanghebbenden in de gelegenheid hun zienswijze naar voren te brengen.

4. De indiening van het verzoekschrift behoeft niet door een advocaat te geschieden.

5. De derde afdeling van de vijfde titel van het Tweede Boek van het Wetboek van Burgerlijke Rechtsvordering is van overeenkomstige toepassing.

6. De rechtbank kan partijen en anderen verzoeken binnen een door haar te bepalen termijn schriftelijke inlichtingen te geven en onder hen berustende stukken in te zenden. De verantwoordelijke en belanghebbende zijn verplicht aan dit verzoek te voldoen. De artikelen 8:45, tweede en derde lid, en 8:29 van de Algemene wet bestuursrecht zijn van overeenkomstige toepassing.

_________________________________________________________________________________________________

Section 46

1. Where a decision as referred to in Section 45 is taken by a body other than an administrative body, the interested party may file a written application with the court to order the controller to grant or refuse a request as referred to in Sections 30 (3), 35, 36 or 38 (2) or to allow or reject an objection as referred to in Sections 40 or 41.

2. The application must be filed within six weeks of receipt of the controller’s answer. If the controller has not answered within the stipulated time limit, the application must be filed within six weeks from that time limit.

3. The court will grant the request in so far as it deems it well-founded. Before the court takes a decision, it will, where necessary, give the interested parties the opportunity to put their points of view forward.

4. The application does not have to be filed by a lawyer.

5. Division 3 of Title 5 of Book 2 of the Code of Civil Procedure applies equally.

6. The court may request parties and others to submit written information and documents they hold within a time limit set by the court. The controller and the interested party must comply with this request. Section 8:45 (2) and (3) and Section 8:29 of the General Administrative Law Act apply equally.

close