CHAPTER VIII
Remedies, liability and penalties
Author: Olivia Tambou
- Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
- The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.
A. General overview
Art. 77 concerns the right of the data subject to ask SAs to advocate in his or her favour with regard to an alleged infringement of his or her rights and the application of the GDPR. Art. 77 is placed in the beginning of Chapter VIII, ‘Remedies, liability and penalties’. It illustrates the central role of the SAs, which are (together with courts) the bodies responsible for the protection of the data subjects’ rights in terms of remedies. The SAs are considered as an “essential component”[1] of the European right to data protection under Art. 16 TFEU and Art. 8 of the CFR. Historically, the construction of the EU data protection law is based on the creation of a SA in charge of ensuring its enforcement.[2] The SAs are part of the European model of data protection law, at both national and EU level.
Art. 77 should also be construed in the light of the harmonisation of the SAs’ tasks, powers and competences. Firstly, each national SA has the task to “monitor and enforce the application” of the GDPR within its territory.[3] This includes hearing the complaints of the data subjects in the first place in most cases. Art. 77 is the pendant of Art. 57 para. 1 lit. f, which explicitly reaffirms the task of the SAs to “handle complaints lodged by a data subject” (→ mn. 10). Secondly, the harmonisation of the SAs’ powers has been conceived to improve the enforcement of the GDPR. The SAs in each territory should have the same main investigative and corrective powers (→ Art. 58) in order to hear the complaint of the data subject. There should be the least possible difference[4] in the complaints-handling and outcomes between Member States. This is also the purpose of the new cooperation and consistency mechanism[5] addressing cross-border processing in the EU (→ Art. 56). However, Art. 77 does not provide for a uniform European environment for the handling of complaints.[6] Concrete application of the provision will rely upon national procedural rules including rules of procedure of the SA. Furthermore, the handling of the complaint may vary depending on several factors, such as the different means allocated to the SAs or the additional powers given by Member States to their SAs according to Art. 58 para. 6.[7]
B.Legislative history
Art. 77 clearly consecrates a real right for the data subject in comparison with Art. 28 para. 4 DPD. The former, same as Art. 57 para. 1 lit. f, was more focused on the tasks of the SA to hear “claims lodged by any person or by an association representing that person”. The reference to the representation of the data subject was transferred to a specific article (→ Art. 80) during negotiations, on the initiative of the Council. This aims at making a clear distinction between the existence of the right to lodge a complaint and the particular conditions for its exercise through the representation by an association. Furthermore, Art. 77 recalls that the data subjects could benefit further by including parallel avenues for their complaints, which could be an administrative or judicial remedy. Those novelties, clarifications introduced by the GDPR, aim at giving more consistency to this rights-based approach to data subject remedies. This right has been defined broadly both in substantive and procedural terms. Art. 77 para. 1 lays down the components of the right to lodge a complaint with an SA; whereas art 77 para. 2 clarifies the obligation of the SA regarding the processing of the complaint.
C. Art. 77 para. 1: The lodging of the complaint
Art. 77 para. 1 addresses two kinds of questions. It specifies (I) the right holder i.e. who can lodge the complaint and, (II) the choice of the competent SA to hear the complaint. Beyond these clarifications, Art. 77 does not require any specific conditions regarding what the complaint should be or how the complaint can be lodged (III).
I.The data subject as right holder
Art. 77 para. 1 clarifies that the right to lodge a complaint is attributed to a data subject and not to any person. This, in principle, excludes legal persons. Nevertheless, according to Art. 80, a non-profit body, organisation or association can represent the data subject and lodge a complaint on his or her behalf (→ mn. 7).
[..]
[1]CJEU, Schrems, C-362/14, EU:C:2015:650, para. 41.
[2]Tambou, L’émergence d’un Modèle Européen d’interrégulation En Matière de Protection Des Données Personnelles (Lexis Nexis 2017) <https://hal.archives-ouvertes.fr/hal-01529151/> accessed 2 January 2023; Gloria González-Fuster, The emergence of personal data protection as a fundamental right of the EU (2014).
[3]See Art. 57 para. 1 lit. a.
[4]Whereas it could be argued that the purpose should be to have no differences at all, this seems practically difficult as explained hereafter.
[5]See Chapter VII of the GDPR.
[6]Conform with Paul Nemitz, who considers that Art. 77 is not a “complete harmonisation of the remedies”, see 881, Rn. 2, in: Ehmann/Selmayr, Datenschutz-Grundverordnung, Munich 2018.
[7]For an illustration of such differences see Tambou, Manuel de droit européen de la protection des données à caractère personnel, Bruylant 2020, sp. p. 354 and p. 361.