Article 78
Right to an effective judicial remedy against a supervisory authority
(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;
Regulation
Art. 78 1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. 2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77. 3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. 4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court. |
Directive
Art. 28 (…) 3. (…) Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts. |
Austria
Complaints with the Data Protection Authority § 24 DSG (1) Every data subject has the right to lodge a complaint with the Data Protection Authority if the data subject is of the opinion that the processing of the personal data concerning the data subject infringes the General Data Protection Regulation or § 1 or Chapter 1, Article 2. [...] (8) Each data subject can apply to the Federal Administrative Court if the Data Protection Authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint lodged. [...] Complaints with the Federal Administrative Court § 27 DSG (1) The Federal Administrative Court shall decide through a panel of judges on complaints against administrative decisions on the ground of a breach of the duty to provide information pursuant to § 24 para. 7 and the duty to reach a decision of the Data Protection Authority. (2) The panel of judges shall consist of a chair and one expert lay judge each from among employers and from among employees. The expert lay judges shall be appointed on the basis of a proposal by the Austrian Federal Economic Chamber and the Federal Chamber of Labour. Appropriate arrangements shall be made so that a sufficient number of expert lay judges is available in due time. (3) The expert lay judges must have at least five years of relevant professional experience and special knowledge of data protection law. (4) The chair shall provide all documents relevant to the decision to the expert lay judges without delay, or, if this is impractical or strictly necessary to safeguard the confidentiality of the documents, make them available in some other way. (5) Where proceedings are brought against an administrative decision of the Data Protection Authority which was preceded by an opinion or a decision of the European Data Protection Board in the consistency mechanism, the Data Protection Authority shall forward that opinion or decision to the Federal Administrative Court. |