Understanding This Article

Article 78 ensures supervisory authorities themselves are subject to the rule of law through judicial review. While authorities enforce GDPR, they can err, act arbitrarily, or fail to act. Article 78 gives individuals and organizations recourse when authorities make poor decisions or ignore complaints.

Paragraph 1 provides judicial remedy against "legally binding decisions" of authorities. These include decisions to impose fines (Article 58(2)(i)), order processing bans (Article 58(2)(f)), dismiss complaints, approve binding corporate rules (Article 47), reject certification criteria (Article 42), or any other decision creating legal obligations. Both individuals and legal persons (companies, NGOs, government agencies) can seek review—controllers/processors affected by enforcement decisions, or data subjects dissatisfied with complaint outcomes.

Judicial review serves multiple purposes. It corrects errors—if an authority misinterprets GDPR, misapplies facts, or imposes disproportionate sanctions, courts can overturn the decision. It ensures consistency—courts develop jurisprudence harmonizing GDPR interpretation across authorities. It provides checks and balances—preventing authorities from acting beyond their powers or infringing fundamental rights. It legitimizes enforcement—knowing decisions are judicially reviewable encourages authorities to be thorough and fair.

Paragraph 2 addresses authority inaction—the "three-month rule." If an authority doesn't handle a complaint or inform the complainant about progress/outcome within three months, the complainant can sue. This prevents authorities from ignoring complaints indefinitely. The remedy isn't automatic dismissal after three months (authorities can still handle complaints), but complainants gain standing to seek judicial intervention, potentially compelling the authority to act or addressing the underlying complaint directly in court.

The three-month threshold balances competing considerations. Investigations take time—authorities need to gather information, analyze processing operations, consult with controllers, and assess compliance. Three months isn't rigid (authorities can take longer for complex matters if they keep complainants informed), but it prevents indefinite delays. If an authority hasn't even informed the complainant about progress after three months, judicial intervention is justified.

Paragraph 3 establishes territorial jurisdiction: proceedings are brought where the authority is established. If challenging a French CNIL decision, proceedings are in French courts. If challenging the Irish DPC, Irish courts have jurisdiction. This respects judicial systems' territorial organization and ensures courts apply their own procedural law when reviewing their own authorities.

Paragraph 4 ensures courts reviewing authority decisions see the full picture when those decisions implement Board opinions or decisions under the consistency mechanism. If the Irish DPC's decision was based on an EDPB binding decision under Article 65, the court must receive that decision to understand the legal context. This prevents authorities from being judicially challenged for merely implementing Board decisions they were bound to follow—the court sees that the decision reflected Board-level consensus, not just the authority's individual judgment.