Rina Steenkamp - Privacy and technology

My annotated General Data Protection Regulation

Chapter VIII Remedies, liability and sanctions

Article 74 Right to a judicial remedy against a supervisory authority

October 2013

Article 74(1)

1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them.

Article 74(2)

2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights, or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point (b) of Article 52(1).

Article 74(3)

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

Article 74(4)

4. Without prejudice to the consistency mechanism a data subject which is concerned by a decision of a supervisory authority in another Member State than where the data subject has its habitual residence, may request the supervisory authority of the Member State where it has its habitual residence to bring proceedings on its behalf against the competent supervisory authority in the other Member State.

Article 74(5)

5. The Member States shall enforce final decisions by the courts referred to in this Article.

[Source: October 2013]

Recital 113

(113) Each natural or legal person should have the right to a judicial remedy against decisions of a supervisory authority concerning them. Proceedings against a supervisory authority should be brought before the courts of the Member State, where the supervisory authority is established.

Recital 114

(114) In order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another Member State than the one where the data subject is residing, the data subject may mandate any body, organisation or association acting in the public interest to bring proceedings against that supervisory authority to the competent court in the other Member State.

Recital 115

(115) In situations where the competent supervisory authority established in another Member State does not act or has taken insufficient measures in relation to a complaint, the data subject may request the supervisory authority in the Member State of his or her habitual residence to bring proceedings against that supervisory authority to the competent court in the other Member State. This does not apply to non-EU-residents. The requested supervisory authority may decide, subject to judicial review, whether it is appropriate to follow the request or not.

[Source: October 2013 | Notes: Recitals | Context: Recitals]

January 2012

Explanatory memorandum

3.4. Detailed explanation of the proposal

Article 74 concerns the right of judicial remedy against a supervisory authority. It builds on the general provision of Article 28(3) of Directive 95/46/EC. It provides specifically a judicial remedy obliging the supervisory authority to act on a complaint, and clarifies the competence of the courts of the Member State where the supervisory authority is established. It provides also the possibility that the supervisory authority of the Member State in which the data subject is residing, may bring on behalf of the data subject proceedings before the courts of another Member State where the competent supervisory authority is established.

[Source: January 2012 | Context: Proposal from the European Commission]

Article 74(1) [Amended: October 2013]

1. Each natural or legal person shall have the right to a judicial remedy against decisions of a supervisory authority concerning them.

Article 74(2) [Amended: October 2013]

2. Each data subject shall have the right to a judicial remedy obliging the supervisory authority to act on a complaint in the absence of a decision necessary to protect their rights, or where the supervisory authority does not inform the data subject within three months on the progress or outcome of the complaint pursuant to point (b) of Article 52(1).

Article 74(3)

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

Article 74(4) [Amended: October 2013]

4. A data subject which is concerned by a decision of a supervisory authority in another Member State than where the data subject has its habitual residence, may request the supervisory authority of the Member State where it has its habitual residence to bring proceedings on its behalf against the competent supervisory authority in the other Member State.

Article 74(5)

5. The Member States shall enforce final decisions by the courts referred to in this Article.

[Source: January 2012 | Context: Proposal from the European Commission]

Recital 113

(113) Each natural or legal person should have the right to a judicial remedy against decisions of a supervisory authority concerning them. Proceedings against a supervisory authority should be brought before the courts of the Member State, where the supervisory authority is established.

Recital 114 [Amended: October 2013]

(114) In order to strengthen the judicial protection of the data subject in situations where the competent supervisory authority is established in another Member State than the one where the data subject is residing, the data subject may request any body, organisation or association aiming to protect the rights and interests of data subjects in relation to the protection of their data to bring on the data subject's behalf proceedings against that supervisory authority to the competent court in the other Member State.

Recital 115 [Amended: October 2013]

(115) In situations where the competent supervisory authority established in another Member State does not act or has taken insufficient measures in relation to a complaint, the data subject may request the supervisory authority in the Member State of his or her habitual residence to bring proceedings against that supervisory authority to the competent court in the other Member State. The requested supervisory authority may decide, subject to judicial review, whether it is appropriate to follow the request or not.

[Source: January 2012 | Notes: Recitals | Context: Proposal from the European Commission, Recitals]

Directive 95/46/EC

Cross-reference

General Data Protection Regulation:Directive 95/46/EC:
Article 74Article 28(3)

Chapter VI Supervisory authority and Working Party on the Protection of Individuals with regard to the Processing of Personal Data

Article 28 Supervisory authority

Article 28(3)

[...]

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.