menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Austria) language
Contact our local member in Austria mail_outline
Visit the website of Geistwert account_balance

arrow_backPrevious Article
Article 78
Next Articlearrow_forward

Right to an effective judicial remedy against a supervisory authority

Official
Texts Guidelines
& Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 78 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 78 keyboard_arrow_up

Key words related to article 78

Show the recitals of the Regulation related to article 78 keyboard_arrow_down Hide the recitals of the Regulation related to article 78 keyboard_arrow_up

(141) Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.

(147) Where specific rules on jurisdiction are contained in this Regulation, in particular as regards proceedings seeking a judicial remedy including compensation, against a controller or processor, general jurisdiction rules such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council (13) should not prejudice the application of such specific rules.

Show the recitals of the Directive related to article 78 keyboard_arrow_down Hide the recitals of the Directive related to article 78 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

The Regulation goes further than the Directive: it is not at the discretion of Member States to set up a procedure for appeals, but a absolute right granted to any physical person or legal entity to appeal against a legally binding decision of the supervisory authority concerned. The right to a judicial remedy against a decision by a supervisory authority is an essential element of the protection of individuals with regard to the processing of personal data.

This  right to a an effective judicial remedy arises where the supervisory authority does not handle a complaint or does not inform the data subject within three months or a shorter period as prescribed by the applicable national law, on the progress or outcome of the complaint lodged (paragraph 2).

As a principle, the data subject must lodge a complaint in the jurisdiction of the Member State where the supervisory authority is established (paragraph 3).

Finally, the European text obliges the supervisory authority to communicate to the relevant jurisdiction a complaint against one of its decisions, the notice or the decision of the European Data Protection Board, which would have been made previously under the consistency mechanism (paragraph 4).

The Directive

We have seen (see the comments on Article 77) that pursuant to the Directive, the Member States should implement a procedure whereby any citizen, or an association that represents that citizen can lodge a complaint with the competent control authority, especially to check the lawfulness of a relevant processing.

The Directive further provided that decisions by the supervisory authorities which give rise to complaints may be appealed through the courts.

Potential issues

The evolution is significant. Several States did not allow an appeal against the decisions of the supervisory authorities, often due to their lack of binding powers. The states should therefore insert this remedy in their domestic law, according to their specific procedures (administrative, judicial courts, etc.).

For instance, under Belgian law, the implementation of this new right to an effective judicial remedy will necessarily involve the implementation of a new procedure. 

We wouldn't be surprised that, as in other areas (right to competition, right to energy, etc.), the remedy is entrusted to a specialized chamber within a Member State.

arrow_back Previous Article • Article 78 • Next Article arrow_forward
arrow_back Previous Article • Article 78 Next Article arrow_forward
arrow_back Previous Article • Article 78 Next Article arrow_forward
Regulation
1e 2e

Art. 78

1.   Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2.   Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.

3.   Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4.   Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
1st proposal close

Art. 74

1. Each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them.

2. Each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights, or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point (b) of Article 52(1).

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4. A data subject which is concerned by a decision of a supervisory authority in another Member State than where the data subject has its habitual residence, may request the supervisory authority of the Member State where it has its habitual residence to bring proceedings on its behalf against the competent supervisory authority in the other Member State.

5. The Member States shall enforce final decisions by the courts referred to in this Article.
2nd proposal close

Art. 74

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority competent in accordance with Article 51 and Article 51a does not deal with a complaint or does not inform the data subject within three months or any shorter period provided under Union or Member State law on the progress or outcome of the complaint lodged under Article 73.

3. (...) Proceedings against a (…) supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. 3a. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the European Data Protection Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.

4. (…)

5. (…)
Directive close

Art. 28

(…)

3. (…)

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
Austria
compare_arrows
visibility Old law

Complaints with the Data Protection Authority

§ 24 DSG

(1) Every data subject has the right to lodge a complaint with the Data Protection Authority if the data subject is of the opinion that the processing of the personal data concerning the data subject infringes the General Data Protection Regulation or § 1 or Chapter 1, Article 2.

[...]

(8) Each data subject can apply to the Federal Administrative Court if the Data Protection Authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint lodged.

[...]

Complaints with the Federal Administrative Court

§ 27 DSG

(1) The Federal Administrative Court shall decide through a panel of judges on complaints against administrative decisions on the ground of a breach of the duty to provide information pursuant to § 24 para. 7 and the duty to reach a decision of the Data Protection Authority.

(2) The panel of judges shall consist of a chair and one expert lay judge each from among employers and from among employees. The expert lay judges shall be appointed on the basis of a proposal by the Austrian Federal Economic Chamber and the Federal Chamber of Labour. Appropriate arrangements shall be made so that a sufficient number of expert lay judges is available in due time.

(3) The expert lay judges must have at least five years of relevant professional experience and special knowledge of data protection law.

(4) The chair shall provide all documents relevant to the decision to the expert lay judges without delay, or, if this is impractical or strictly necessary to safeguard the confidentiality of the documents, make them available in some other way.

(5) Where proceedings are brought against an administrative decision of the Data Protection Authority which was preceded by an opinion or a decision of the European Data Protection Board in the consistency mechanism, the Data Protection Authority shall forward that opinion or decision to the Federal Administrative Court.
Old law close

All of the following in force until May 25, 2018:

Rulings of the Data Protection Authority

§ 38 DSG 2000

(1) Controllers in the public sector always have a position as party in proceedings before the Data Protection Authority.

(2) Rulings that permit transmission and committing of data according to section 13, shall be revoked once the legal or factual prerequisites under which the permit was issued, especially pursuant to a promulgation of the Federal Chancellor according to section 55 no longer apply.

(3) Parties according to para. 1 may file a complaint with the federal administrative court.

Procedure before the Federal Administrative Court

§ 39 DSG 2000

(1) The federal administrative court shall decide on complaints against rulings as well as complaints regarding the obligation to decide in due time regarding matters of this federal law by chamber.

(2) The chamber shall consist of a chairman und one professionally experienced lay judge from the domain of the employers and from the domain of employees each. The professionally experienced lay judges shall be appointed on a proposal by the Austrian Federal Economic Chamber and the Federal Chamber of Labour. Appropriate arrangements shall be made so that a sufficient number of professionally experienced lay judges can be nominated at the right time.

(3) The professionally experienced lay judges must have at least five years of relevant professional experience and special knowledge of data protection law.

(4) The chairman shall transmit all documents relevant to the decision to the professionally experienced lay judges without delay, or, if this is impractical or absolutely necessary to safeguard the confidence of the documents, make them available in some other way.

Appeal before the Supreme Administrative Court

§ 40 DSG 2000

 An appeal before the Supreme Administrative Court may be brought by any party according to section 38 para. 1.
arrow_back Previous Article • Article 78 Next Article arrow_forward
close

2016 - www.itiplaw.eu.