Article 79
Right to an effective judicial remedy against a controller or processor

Official
Texts
Guidelines
& Caselaw
Review of
EU Regulation
Review of
Nat. Regulation
Show the recitals of the Regulation related to article 79 keyboard_arrow_down Hide the recitals of the Regulation related to article 79 keyboard_arrow_up

(145) For proceedings against a controller or processor, the plaintiff should have the choice to bring the action before the courts of the Member States where the controller or processor has an establishment or where the data subject resides, unless the controller is a public authority of a Member State acting in the exercise of its public powers.

Show the recitals of the Directive related to article 79 keyboard_arrow_down Hide the recitals of the Directive related to article 79 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

Article 79 gives people affected by processing, a genuine right to an effective judicial remedy against both the controller and the processor in case of infringement of their rights resulting from the processing of their data. This right is not to be confused either with the possibility of lodging a complaint with a supervisory authority referred to in article 78, nor with any other administrative or extra-judicial remedy provided under the relevant national law.

The second paragraph allows the data subject to bring his action either before the courts of the Member State in which the controller has an establishment or in the courts of the state of habitual residence of the data subject, unless controller or processor is a public authority of a Member State acting in the exercise of its public powers.

It should be noted that as per recital 146, the jurisdictional rules contained in the Regulation need subject to the general jurisdictional rules contained in other legal instruments, such as those contained in Regulation (EU) No. 1215/2012 of the European Parliament and the Council of 12 December 2012 concerning jurisdiction, recognition and enforcement of decisions on civil and commercial matters (Regulation called Brussels I bis).

The Directive

The Directive Article 22 requires the Member States to provide to any person the right to a judicial remedy in case of breach of the rights guaranteed to him by the national provisions transposing the Directive.

Potential issues

The competence of the courts will not necessarily imply that they must apply their national laws that codify the Regulation or that the national authority of the state court is competent.

Poland

The Draft Bill on Personal Data Protection published in September 2017

CHAPTER 8: CIVIL LIABILITY

Art. 78.1. Any person whose rights under the provisions of the Act have been infringed may request that such action be abandoned and may require the person committing the breach to complete the activities necessary to remove the consequences.

2. Making the claim referred to in para. 1, does not exclude the possibility of other claims for breaches of the provisions on the protection of personal data.

3. To the extent not governed by the Regulation 2016/679 and this Act, the redress of claims referred to in para. 1, is governed by the provisions of the Civil Code.

 

Art. 79. 1. For proceedings in cases of claims brought under Art. 78, to the extent not governed by the Act, the provisions of the Code of Civil Procedure shall apply.

2. The district court shall have jurisdiction over claims for infringement of the provisions on the protection of personal data, including claims under Art. 82 of the Regulation 2016/679, irrespective of the value of the subject-matter of the dispute.

 

Art. 80.1. On filing a lawsuit in the cases referred to in Art. 78, the court shall immediately notify the President of the Office.

2. If the proceedings concerning breaches of the provisions on the protection of personal data are pending before the President of the Office or the administrative court, the President of the Office shall notify the court referred to in para. 1.

3. The court may suspend proceedings pending before the court till the termination of the proceedings before the President of the Office.

 

Art. 81. About every judgment -  taking account of the action - on matters referred to in Art. 78 para. 1 and 2, the court shall notify the President of the Office.

Regulation
1e 2e

Art. 79

1.   Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.

2.   Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.

1st proposal close

Art. 75 

1. Without prejudice to any available administrative remedy, including the right to lodge a complaint with a supervisory authority as referred to in Article 73, every natural person shall have the right to a judicial remedy if they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in non-compliance with this Regulation.

2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has its habitual residence, unless the controller is a public authority acting in the exercise of its public powers.

3. Where proceedings are pending in the consistency mechanism referred to in Article 58, which concern the same measure, decision or practice, a court may suspend the proceedings brought before it, except where the urgency of the matter for the protection of the data subject's rights does not allow to wait for the outcome of the procedure in the consistency mechanism.

4. The Member States shall enforce final decisions by the courts referred to in this Article.

2nd proposal close

Art. 75 

1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority under Article 73, data subjects shall have the right to an effective judicial remedy if they consider that their rights under this Regulation have been infringed as a result of the processing of their personal data in non-compliance with this Regulation.

2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment (…). Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority acting in the exercise of its public powers.

3. (…)

4. (…)

Directive close

Art. 22

Without prejudice to any administrative remedy for which provision may be made, inter alia before the supervisory authority referred to in Article 28, prior to referral to the judicial authority, Member States shall provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question.

Entered into force on May 25, 2018:

The Act of May 10, 2018 on Personal Data Protection

 

Art. 92 In the area not regulated by Regulation 2016/679, as to the claims regarding the violation of the personal data protection laws referred to in art79 and art 82 of the Regulation, provisions of the 1964 Act shall apply - Civil Code

Art. 93 All claims arising from the violation of the personal data protection laws referred to in art 79 and art 82 of the Regulation 2016/679 shall be directed to the Regional Court

Art. 94 1. The court shall notify the President of the Office immediately, if a lawsuit is filed and the final judgement is reached in the proceedings regarding the violation of the personal data protection laws referred to in art 79 and art 82 of the Regulation 2016/679 .

2. Once notified about the on-going inspection, the President of the Office shall notify the court of every matter regarding the same violation of the personal data protection laws, that is pending before the President of the Office, court or has already been closed. The President of the Office shall also inform the court about any initiation of proceedings in the case of the same violation immediately

Art. 95 The court shall suspend the proceedings if the proceedings regarding the same violation of the personal data protection laws have been initiated by the President of the Office.

Art. 96 The court shall suspend the proceedings in the area of a final decision by the President of the Office was made regarding the violation of the personal data protection laws or in the area of a final judgement regarding the complaint referred to in art 145a paragraph 3 of the 2002 Act. – Law on proceedings before administrative court.

Art. 97 The findings of the final decision of the President of the Office regarding the violation of the personal data protection laws or in the area of a final judgement regarding the complaint referred to in art 145a paragraph 3 of the 2002 Act. – Law on proceedings before administrative court, bind the court in the proceedings for recovery of damages due to the violation of personal data protection laws in regards to finding a breach of these laws.

Art. 98 1. In cases regarding damages claims based on the violation of personal data protection laws, that can only be heard before the court, the President of the Office can bring an action in the name of that as well as join the proceedings at any stage, provided he receives the consent of the party.

2. In other damages cases, regarding the violation of the personal data protection laws, the President of the Office can joint the proceedings at any stage unless proceedings  regarding the same case have been brought before him.

3. In cases referred to in provisions 1 and 2 of the 1964 act shall apply to the president to the office

Art. 99 The President of the Office can present a viewpoint crucial for the proceedings regarding the violation of the personal data protection laws before the court if it is in public interest.

Art. 100 The proceeding regarding the violation of the personal data protection laws referred to in art 79 and art 82 of the Regulation 2016/679 in shall be governed by the 1964 Act – Civil Code.

Old law close

In force until May 25, 2018:

The Act on Personal Data Protection

 

Article 32

1. The data subject has a right to control the processing of his/her personal data contained in

the filing systems, and in particular he/she has the right to:

(…)

6) demand the data to be completed, updated, rectified, temporally or permanently suspended or erased, in case they are not complete, outdated, untrue or collected with the violation of the act, or in case they are no longer required for the purpose for which they have been collected,

7) make a justified demand in writing, in cases referred to in Article 23 paragraph 1 point 4 and 5, for the blocking of the processing of his/her data, due to his/her particular situation,

8) object to the processing of his/her personal data in cases referred to in Article 23 paragraph 1 point 4 and 5, should the controller intend to process the data for marketing purposes or to object to the transfer of the data to another controller,

9) make a demand to a controller for reconsidering of the individual case settled in contravention of Article 26a paragraph 1.

2. In case of the demand referred to in paragraph 1 point 7 the controller shall immediately stop the processing of the questioned data or without undue delay transmit the demand to the Inspector General who shall make an appropriate decision.

3. In case of the objection referred to in paragraph 1 point 8 further processing of the questioned data shall be prohibited. However, the controller is allowed to leave in filing system forename or forenames and a surname of a person with a PESEL identification number or address solely for the reason to avoid the data being used once more for the purposes to which the data subjects objected.

3a. In case of the demand referred to in Article 32 paragraph 1 point 9 the controller without undue delay shall consider the case or transmit it, together with his/her reasoned stand, to the Inspector General who shall issue an appropriate decision.

(…)

close