Author: Olivia Tambou
- The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.
- Member States may provide that anybody, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
A.Preliminary remarks
The rationale of Art. 80 is to enhance the defence of the interests of the data subjects by offering the possibility for an organisation to act in their name lodging a complaint with a DPA or bringing proceedings before courts (be it against SAs or controllers and/or processors). Art. 80 is designed to improve access to justice in the data protection context. The provision for detailed rules on the representation of data subjects is a novelty: Art. 28 para. 4 DPD only laid down that SAs shall “hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data.”
This new representation-provision will probably ensure that authorities may sanction violations of the data subjects’ rights more vigorously and, as such, strengthen effectiveness of the GDPR. Moreover, it seems to take into due account the risk of possible reluctance on the part of the data subject in initiating proceedings, especially in light of the belief that such proceedings may be time consuming and not cost effective.
However, Art. 80 does not create a harmonised European class action. Rather, it leaves it up to the Member States to set the scope and the procedural conditions of the representation. Given the global reinforcement of the obligations of data controllers and processors, Art. 80 will probably increase judicial remedies. Recent case law under the DPD regime has shown how the lack of common principles in collective redress hinders to properly address massive violations at the EU level. The creation of a real collective redress mechanism in data protection by Member States under the GDPR was expected to significantly improve the situation. Not-for-profit organisations have already made use of collective complaints before SAs as well as collective claims before national courts. A first preliminary ruling regarding the application of Art. 80 was lodged on 15 July 2020.
B.Legislative history
Art. 80 has been considerably amended during the negotiations. It became a specific provision under the pressure of the Council, whereas the Comm-P only provided for some elements of representation scattered in several articles. One of the most remarkable changes is the removal of the collective representation mechanism. The Commission, backed by the EP, proposed representation on “behalf of one or more data subjects”. The Council changed this wording due to some Member States being hostile to the creation of a real collective redress or class action. The main reasons for this amendment were fear of abuse and the absence of collective redress in national laws, in particular for legal culture rationales. These tensions between the Member States explain why the final version includes two categories of opening clauses, allowing the Member States to adapt this provision in a very different way in their national law. Firstly, Member States will have to decide whether the representative body (hereinafter the ‘agent’) should have the right to seek compensation for the data subject. Secondly, Member States should clarify whether agents can act without a data subject’s mandate.
The added value of Art. 80 is to clarify how representation can be granted by the data subject as well as the mandatory characteristics of an agent (Art. 80 para. 1) and how Member States can further give representation to an organisation without the mandate of the data subject (Art. 80 para. 2).
[…]