Article 79
Right to an effective judicial remedy against a controller or processor
Chapter 8
|
Remedies, Liability and Penalties
|
đ 3 min read
1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
Understanding This Article
Article 79 establishes private enforcement of GDPR through direct judicial actions by data subjects against controllers and processors. While supervisory authorities conduct public enforcement, data subjects can independently vindicate their rights in court, seeking remedies including compliance orders, damages, and injunctions.
Paragraph 1 gives data subjects standing to sue whenever they "consider" their rights have been infringed. Like Article 77, the threshold is subjectiveâcourts can't dismiss cases without examining whether violations occurred. Data subjects needn't prove violations before filing suit; they must only believe, in good faith, that violations occurred.
"Without prejudice" means data subjects can sue without exhausting administrative remedies first. They needn't complain to supervisory authorities before going to court. This direct access prevents controllers from hiding behind procedural barriers ("you should have complained to the authority first"). Data subjects can choose their preferred enforcement mechanismâpublic (complaint to authority) or private (lawsuit), or pursue both simultaneously.
Private enforcement serves functions public enforcement can't fully provide. Supervisory authorities prioritize systemic violations affecting many data subjects, potentially deprioritizing individual grievances. They may lack resources to investigate every complaint thoroughly. They can't award compensation to individual data subjects (only Article 58(2) corrective powers and fines paid to the state). Private lawsuits fill these gapsâindividuals can pursue idiosyncratic harms, seek personalized remedies, and recover damages for specific injuries.
Paragraph 2's jurisdictional rules give data subjects strategic choice. They can sue where the controller/processor has an establishment (where the defendant is located, following general jurisdictional principles), or alternatively, in their own habitual residence (where they normally live). This "alternative jurisdiction" is powerfulâa Portuguese citizen can sue an Irish company in Portuguese courts, closer to home, in their own language, under familiar procedures. This substantially lowers barriers to enforcement.
The exception for public authorities prevents forum shopping against government agencies. If the French government processes data, a German citizen can't sue in German courts just because they live thereâthey must sue in French courts where the French public authority is established. This respects sovereignty and prevents courts from exercising extraterritorial jurisdiction over foreign governments. However, this exception only applies to public powersâif a government agency operates commercially (e.g., government-owned enterprise), normal jurisdictional rules apply.
Article 79 cases form a substantial body of GDPR jurisprudence. Individuals sue for various remedies: ordering data erasure, compelling access requests, challenging automated decision-making, stopping unlawful marketing, securing compensation for breaches, and enjoining illegal surveillance. Courts develop detailed interpretations of GDPR provisions through these private cases, complementing authority enforcement and Board guidelines.