menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Germany) language
Contact our local member in Germany mail_outline
Visit the website of Rossbach & Beier account_balance

arrow_backPrevious Article
Article 80
Next Articlearrow_forward

Representation of data subjects

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 80 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 80 keyboard_arrow_up
Show the recitals of the Regulation related to article 80 keyboard_arrow_down Hide the recitals of the Regulation related to article 80 keyboard_arrow_up

(142) Where a data subject considers that his or her rights under this Regulation are infringed, he or she should have the right to mandate a not-for-profit body, organisation or association which is constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest and is active in the field of the protection of personal data to lodge a complaint on his or her behalf with a supervisory authority, exercise the right to a judicial remedy on behalf of data subjects or, if provided for in Member State law, exercise the right to receive compensation on behalf of data subjects. A Member State may provide for such a body, organisation or association to have the right to lodge a complaint in that Member State, independently of a data subject's mandate, and the right to an effective judicial remedy where it has reasons to consider that the rights of a data subject have been infringed as a result of the processing of personal data which infringes this Regulation. That body, organisation or association may not be allowed to claim compensation on a data subject's behalf independently of the data subject's mandate.

Show the recitals of the Directive related to article 80 keyboard_arrow_down Hide the recitals of the Directive related to article 80 keyboard_arrow_up

(55) Whereas, if the controller fails to respect the rights of data subjects, national legislation must provide for a judicial remedy; whereas any damage which a person may suffer as a result of unlawful processing must be compensated for by the controller, who may be exempted from liability if he proves that he is not responsible for the damage, in particular in cases where he establishes fault on the part of the data subject or in case of force majeure; whereas sanctions must be imposed on any person, whether governed by private of public law, who fails to comply with the national measures taken under this Directive;

The GDPR

Article 80 specifies and supplements the Directive regarding option for representation by an association. The Regulation provides that an association (non-profit association active in the protection of the rights of the data subjects) can be mandated by a data subject not only to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77 on his or her behalf, but also for judicial remedy against a decision of a supervisory authority (Article 78) or against a controller or a processor (see Article 79).

The final version of the Regulation adds that the association is also granted the right to claim compensation as provided by Article 82 on behalf of the data subject where he or she considers that his or her rights under this Regulation have been infringed and as provided by Member State law.

The Member States may grant major powers of action to the associations charged with the protection of rights and freedoms in the data processing. If the state makes use of this provision, these associations may, at their initiative (i.e., regardless of any mandate by a data subject) lodge a claim with a supervisory authority in the territory of the Member State of their establishment (Art. 77) or expedite a judicial remedy against a decision of a supervisory authority (Article 78) or against a controller or a processor (Article 79) if they consider that the rights of a data subject have breached because the personal data processing has not been compliant with the Regulation (paragraph 2).

The Directive

The Directive already provided for the possibility of an association undertaking to lodge a complaint with a supervisory authority on behalf of a person complaining of a breach of his or her rights and freedoms in the context of the personal data processing (see Article 28 (6) of the Directive).

Potential issues

It is a fundamental principle, that associations have the recognized  powers to defend of the rights of data subjects.. We strongly believe this measure will contribute to ensuring the effectiveness of the rights granted to the data subjects by the personal data processing.

Jurisdictional procedures already exist for data subjects; however, it is very rare that a person resorts to legal proceedings, especially in view of the costs. In other words, at present, it is not worth the effort.

However, this development could lead to many problems of implementation. Regarding the possibility for these associations introducing a procedure regardless of a mandate by the data subject,  it is not possible to predict the future implications in different Member states and disparities in the protection of the data subjects will appear on this point.

Associations must exist and be active regarding data protection, but will often involve a significant change in attitudes of the public, members and authorities.

arrow_back Previous Article • Article 80 • Next Article arrow_forward
arrow_back Previous Article • Article 80 Next Article arrow_forward
arrow_back Previous Article • Article 80 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C‑319/20 (28 April 2022) - Meta Platforms Ireland

Article 80(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as not precluding national legislation which allows a consumer protection association to bring legal proceedings, in the absence of a mandate conferred on it for that purpose and independently of the infringement of specific rights of the data subjects, against the person allegedly responsible for an infringement of the laws protecting personal data, on the basis of the infringement of the prohibition of unfair commercial practices, a breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions, where the data processing concerned is liable to affect the rights that identified or identifiable natural persons derive from that regulation.

Judgment of the Court

Opinion of Advocate general

C-757/22 (11 July 2024 ) - Meta Platforms Ireland (Action représentative)

Article 80(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as meaning that the condition that an authorised entity, in order to be able to bring a representative action under that provision, must assert that it considers the rights of a data subject provided for in that regulation to have been infringed ‘as a result of the processing’, within the meaning of that provision, is satisfied where that entity asserts that the infringement of the data subject’s rights occurs in the course of the processing of personal data and results from the controller’s infringement of its obligation, under the first sentence of Article 12(1) and Article 13(1)(c) and (e) of that regulation, to provide the data subject, in a concise, transparent, intelligible and easily accessible form, in clear and plain language, with information relating to the purposes of that data processing and to the recipients of such data, at the latest when they are collected.

Judgment of the Court 
Opinion of Advocate General 

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 80 Next Article arrow_forward
Regulation
1e 2e

Art. 80

1.   The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

2.   Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
1st proposal close

Art. 76

1. Any body, organisation or association referred to in Article 73(2) shall have the right to exercise the rights referred to in Articles 74 and 75 on behalf of one or more data subjects.

2. Each supervisory authority shall have the right to engage in legal proceedings and bring an action to court, in order to enforce the provisions of this Regulation or to ensure consistency of the protection of personal data within the Union.

3. Where a competent court of a Member State has reasonable grounds to believe that parallel proceedings are being conducted in another Member State, it shall contact the competent court in the other Member State to confirm the existence of such parallel proceedings.

4. Where such parallel proceedings in another Member State concern the same measure, decision or practice, the court may suspend the proceedings.

5. Member States shall ensure that court actions available under national law allow for the rapid adoption of measures including interim measures, designed to terminate any alleged infringement and to prevent any further impairment of the interests involved.
2nd proposal close

Art. 76

1. The data subject shall have the right to mandate a body, organisation or association, which has been properly constituted according to the law of a Member State and whose statutory objectives include the protection of data subjects’ rights and freedoms with regard to the protection of their personal data, to lodge the complaint on his or her behalf and to exercise the rights referred to in Articles 73, 74 and 75 on his or her behalf. 1a. (...)

2. Member States may provide that any body, organisation or association referred to in paragraph 1, independently of a data subject's mandate (…), shall have in such Member State the right to lodge a complaint with the supervisory authority competent in accordance with Article 73 and to exercise the rights referred to in Articles 73, 74 and 75 if it considers that the rights of a data subject have been infringed as a result of the processing of personal data that is not in compliance with this Regulation.

3. (…)

4. (…)
Directive close

Art. 28

(…)

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
Germany
compare_arrows

France close

Loi n° 78-17 du 6 janvier 1978 relative à l'informatique, aux fichiers et aux libertés

Art. 11

Version initiale

La Commission nationale de l'informatique et des libertés est une autorité administrative indépendante. Elle exerce les missions suivantes :

(…)

c) Elle reçoit les réclamations, pétitions et plaintes relatives à la mise en oeuvre des traitements de données à caractère personnel et informe leurs auteurs des suites données à celles-ci ;

(cfr. art. 47 du règlement intérieur de la CNIL  Adopté par la commission réunie en séance plénière le 4 juillet 2013)

Art. 43 ter

Modifié par la loi n°2018-493 du 20 juin 2018

I.-Sous réserve du présent article, le chapitre Ier du titre V de la loi n° 2016-1547 du 18 novembre 2016 de modernisation de la justice du XXIe siècle et le chapitre X du titre VII du livre VII du code de justice administrative s'appliquent à l'action ouverte sur le fondement du présent article.

II.-Lorsque plusieurs personnes physiques placées dans une situation similaire subissent un dommage ayant pour cause commune un manquement de même nature aux dispositions du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité ou de la présente loi par un responsable de traitement de données à caractère personnel ou un sous-traitant, une action de groupe peut être exercée devant la juridiction civile ou la juridiction administrative compétente au vu des cas individuels présentés par le demandeur, qui en informe la Commission nationale de l'informatique et des libertés.

III.-Cette action peut être exercée en vue soit de faire cesser le manquement mentionné au II, soit d'engager la responsabilité de la personne ayant causé le dommage afin d'obtenir la réparation des préjudices matériels et moraux subis, soit de ces deux fins.

Toutefois, la responsabilité de la personne ayant causé le dommage ne peut être engagée que si le fait générateur du dommage est postérieur au 24 mai 2018.

IV.-Peuvent seules exercer cette action :

1° Les associations régulièrement déclarées depuis cinq ans au moins ayant pour objet statutaire la protection de la vie privée et la protection des données à caractère personnel ;

2° Les associations de défense des consommateurs représentatives au niveau national et agréées en application de l'article L. 811-1 du code de la consommation, lorsque le traitement de données à caractère personnel affecte des consommateurs ;

3° Les organisations syndicales de salariés ou de fonctionnaires représentatives au sens des articles L. 2122-1, L. 2122-5 ou L. 2122-9 du code du travail ou du III de l'article 8 bis de la loi n° 83-634 du 13 juillet 1983 portant droits et obligations des fonctionnaires ou les syndicats représentatifs de magistrats de l'ordre judiciaire, lorsque le traitement affecte les intérêts des personnes que les statuts de ces organisations les chargent de défendre.

Lorsque l'action tend à la réparation des préjudices subis, elle s'exerce dans le cadre de la procédure individuelle de réparation définie au chapitre X du titre VII du livre VII du code de justice administrative et au chapitre Ier du titre V de la loi n° 2016-1547 du 18 novembre 2016 de modernisation de la justice du XXIe siècle.

Art. 43 quater

Créé par la loi n°2018-493 du 20 juin 2018

Toute personne peut mandater une association ou une organisation mentionnée au IV de l'article 43 ter aux fins d'exercer en son nom les droits prévus aux articles 77 à 79 et 82 du règlement (UE) 2016/679 du Parlement européen et du Conseil du 27 avril 2016 précité. Elle peut également les mandater pour agir devant la Commission nationale de l'informatique et des libertés, contre celle-ci devant un juge ou contre le responsable de traitement ou son sous-traitant devant une juridiction lorsqu'est en cause un traitement relevant du chapitre XIII de la présente loi
arrow_back Previous Article • Article 80 Next Article arrow_forward
close

2016 - www.itiplaw.eu.