menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : United Kingdom) language
Contact our local member in United Kingdom mail_outline
Visit the website of Moore Blatch account_balance

arrow_backPrevious Article
Article 80
Next Articlearrow_forward

Representation of data subjects

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 80 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 80 keyboard_arrow_up
Show the recitals of the Regulation related to article 80 keyboard_arrow_down Hide the recitals of the Regulation related to article 80 keyboard_arrow_up

(142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject's mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate.

Show the recitals of the Directive related to article 80 keyboard_arrow_down Hide the recitals of the Directive related to article 80 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

Article 80 specifies and supplements the Directive regarding option for representation by an association. The Regulation provides that an association (non-profit association active in the protection of the rights of the data subjects) can be mandated by a data subject not only to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77 on his or her behalf, but also for judicial remedy against a decision of a supervisory authority (Article 78) or against a controller or a processor (see Article 79).

The final version of the Regulation adds that the association is also granted the right to claim compensation as provided by Article 82 on behalf of the data subject where he or she considers that his or her rights under this Regulation have been infringed and as provided by Member State law.

The Member States may grant major powers of action to the associations charged with the protection of rights and freedoms in the data processing. If the state makes use of this provision, these associations may, at their initiative (i.e., regardless of any mandate by a data subject) lodge a claim with a supervisory authority in the territory of the Member State of their establishment (Art. 77) or expedite a judicial remedy against a decision of a supervisory authority (Article 78) or against a controller or a processor (Article 79) if they consider that the rights of a data subject have breached because the personal data processing has not been compliant with the Regulation (paragraph 2).

The Directive

The Directive already provided for the possibility of an association undertaking to lodge a complaint with a supervisory authority on behalf of a person complaining of a breach of his or her rights and freedoms in the context of the personal data processing (see Article 28 (6) of the Directive).

Potential issues

It is a fundamental principle, that associations have the recognized  powers to defend of the rights of data subjects.. We strongly believe this measure will contribute to ensuring the effectiveness of the rights granted to the data subjects by the personal data processing.

Jurisdictional procedures already exist for data subjects; however, it is very rare that a person resorts to legal proceedings, especially in view of the costs. In other words, at present, it is not worth the effort.

However, this development could lead to many problems of implementation. Regarding the possibility for these associations introducing a procedure regardless of a mandate by the data subject,  it is not possible to predict the future implications in different Member states and disparities in the protection of the data subjects will appear on this point.

Associations must exist and be active regarding data protection, but will often involve a significant change in attitudes of the public, members and authorities.

arrow_back Previous Article • Article 80 • Next Article arrow_forward
arrow_back Previous Article • Article 80 Next Article arrow_forward
arrow_back Previous Article • Article 80 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C‑319/20 (28 April 2022) - Meta Platforms Ireland

Article 80(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as not precluding national legislation which allows a consumer protection association to bring legal proceedings, in the absence of a mandate conferred on it for that purpose and independently of the infringement of specific rights of the data subjects, against the person allegedly responsible for an infringement of the laws protecting personal data, on the basis of the infringement of the prohibition of unfair commercial practices, a breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions, where the data processing concerned is liable to affect the rights that identified or identifiable natural persons derive from that regulation.

Judgment of the court

Opinion of advocate general

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 80 Next Article arrow_forward
Regulation
1e 2e

Art. 80

1.   The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

2.   Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
1st proposal close

Art. 76

1. Any body, organisation or association referred to in Article 73(2) shall have the right to exercise the rights referred to in Articles 74 and 75 on behalf of one or more data subjects.

2. Each supervisory authority shall have the right to engage in legal proceedings and bring an action to court, in order to enforce the provisions of this Regulation or to ensure consistency of the protection of personal data within the Union.

3. Where a competent court of a Member State has reasonable grounds to believe that parallel proceedings are being conducted in another Member State, it shall contact the competent court in the other Member State to confirm the existence of such parallel proceedings.

4. Where such parallel proceedings in another Member State concern the same measure, decision or practice, the court may suspend the proceedings.

5. Member States shall ensure that court actions available under national law allow for the rapid adoption of measures including interim measures, designed to terminate any alleged infringement and to prevent any further impairment of the interests involved.
2nd proposal close

Art. 76

1. The data subject shall have the right to mandate a body, organisation or association, which has been properly constituted according to the law of a Member State and whose statutory objectives include the protection of data subjects’ rights and freedoms with regard to the protection of their personal data, to lodge the complaint on his or her behalf and to exercise the rights referred to in Articles 73, 74 and 75 on his or her behalf. 1a. (...)

2. Member States may provide that any body, organisation or association referred to in paragraph 1, independently of a data subject's mandate (…), shall have in such Member State the right to lodge a complaint with the supervisory authority competent in accordance with Article 73 and to exercise the rights referred to in Articles 73, 74 and 75 if it considers that the rights of a data subject have been infringed as a result of the processing of personal data that is not in compliance with this Regulation.

3. (…)

4. (…)
Directive close

Art. 28

(…)

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
United Kingdom
compare_arrows

42. Request for assessment

(1) A request may be made to the Commissioner by or on behalf of any person who is, or believes himself to be, directly affected by any processing of personal data for an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of this Act.

(2) On receiving a request under this section, the Commissioner shall make an assessment in such manner as appears to him to be appropriate, unless he has not been supplied with such information as he may reasonably require in order to—

(a) satisfy himself as to the identity of the person making the request, and

(b) enable him to identify the processing in question.

(3) The matters to which the Commissioner may have regard in determining in what manner it is appropriate to make an assessment include—

(a) the extent to which the request appears to him to raise a matter of substance,

(b) any undue delay in making the request, and

(c) whether or not the person making the request is entitled to make an application under section 7 in respect of the personal data in question.

(4) Where the Commissioner has received a request under this section he shall notify the person who made the request—

(a) whether he has made an assessment as a result of the request, and

(b to the extent that he considers appropriate, having regard in particular to any exemption from section 7 applying in relation to the personal data concerned, of any view formed or action taken as a result of the request. 
United Kingdom close

42. Request for assessment

(1) A request may be made to the Commissioner by or on behalf of any person who is, or believes himself to be, directly affected by any processing of personal data for an assessment as to whether it is likely or unlikely that the processing has been or is being carried out in compliance with the provisions of this Act.

(2) On receiving a request under this section, the Commissioner shall make an assessment in such manner as appears to him to be appropriate, unless he has not been supplied with such information as he may reasonably require in order to—

(a) satisfy himself as to the identity of the person making the request, and

(b) enable him to identify the processing in question.

(3) The matters to which the Commissioner may have regard in determining in what manner it is appropriate to make an assessment include—

(a) the extent to which the request appears to him to raise a matter of substance,

(b) any undue delay in making the request, and

(c) whether or not the person making the request is entitled to make an application under section 7 in respect of the personal data in question.

(4) Where the Commissioner has received a request under this section he shall notify the person who made the request—

(a) whether he has made an assessment as a result of the request, and

(b to the extent that he considers appropriate, having regard in particular to any exemption from section 7 applying in relation to the personal data concerned, of any view formed or action taken as a result of the request. 
arrow_back Previous Article • Article 80 Next Article arrow_forward
close

2016 - www.itiplaw.eu.