Chapter VIII: Remedies, Liability and Penalties

Chapter VIII establishes comprehensive enforcement mechanisms ensuring that data subjects can effectively exercise their rights and that violations of the GDPR result in appropriate consequences. The chapter provides both administrative and judicial remedies, establishes liability rules, and sets out a framework for substantial fines.

Administrative Remedies (Article 77):

Every data subject has the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work, or place of the alleged infringement. The supervisory authority must inform the complainant of progress and outcome of the complaint, including the possibility of judicial remedy.

Judicial Remedies (Articles 78-79):

Against Supervisory Authorities (Article 78):

Data subjects have the right to an effective judicial remedy against legally binding decisions of a supervisory authority concerning them, or if a supervisory authority fails to handle a complaint or inform them of progress within three months. Proceedings must be brought before courts in the Member State where the supervisory authority is established.

Against Controllers or Processors (Article 79):

Data subjects have the right to an effective judicial remedy if they believe their GDPR rights have been infringed as a result of non-compliant processing. Proceedings may be brought before courts of the Member State where the controller or processor has an establishment, or where the data subject has habitual residence, unless the controller or processor is a public authority acting in its official capacity.

Representation of Data Subjects (Article 80):

Data subjects have the right to mandate not-for-profit bodies, organizations, or associations to:

• Lodge complaints with supervisory authorities on their behalf
• Exercise judicial remedies on their behalf
• Receive compensation on their behalf (if provided for by Member State law)

Member States may also provide for such bodies to exercise rights independently of a data subject's mandate if they believe rights have been infringed.

Suspension of Proceedings (Article 81):

Where proceedings concerning the same subject matter are pending before a supervisory authority or court, subsequent courts may suspend proceedings to ensure consistency.

Right to Compensation and Liability (Article 82):

Any person who has suffered material or non-material damage as a result of a GDPR infringement has the right to receive compensation from the controller or processor. Key principles:

• Controller Liability: Controllers are liable for damage caused by processing that infringes the GDPR.
• Processor Liability: Processors are liable where they have not complied with GDPR obligations specifically directed at processors or have acted outside or contrary to lawful instructions from the controller.
• Exemption: Controllers or processors may be exempt from liability if they prove they are not in any way responsible for the event giving rise to damage.
• Joint Liability: Where multiple controllers or processors are involved in the same processing, each is held liable for the entire damage to ensure effective compensation. A controller or processor that has paid full compensation may claim back from other controllers or processors involved their share of responsibility.
• Material and Non-Material Damage: Compensation covers both tangible losses (financial harm) and intangible harm (distress, anxiety, loss of control over personal data).

Administrative Fines (Article 83):

The GDPR establishes a framework for administrative fines that are effective, proportionate, and dissuasive. Fines can reach substantial amounts to ensure compliance even by the largest organizations.

Fine Tiers:

• Lower Tier (up to €10 million or 2% of total worldwide annual turnover): For violations including:
  • Controller/processor obligations (Articles 8, 11, 25-39, 42, 43)
  • Certification body obligations (Article 42, 43)
  • Monitoring body obligations (Article 41)
• Higher Tier (up to €20 million or 4% of total worldwide annual turnover): For violations including:
  • Basic principles for processing (Article 5, 6, 7, 9)
  • Data subjects' rights (Articles 12-22)
  • Transfers to third countries (Articles 44-49)
  • Member State law obligations under Chapter IX
  • Non-compliance with supervisory authority orders

Factors for Calculating Fines (Article 83(2)):

When deciding whether to impose a fine and determining the amount, supervisory authorities must consider:

• Nature, gravity, and duration of infringement
• Intentional or negligent character of the infringement
• Actions taken to mitigate damage suffered by data subjects
• Degree of responsibility considering technical and organizational measures
• Relevant previous infringements
• Degree of cooperation with supervisory authority
• Categories of personal data affected
• Manner in which infringement came to authority's attention
• Compliance with previously ordered measures
• Adherence to approved codes of conduct or certification
• Aggravating or mitigating factors, such as financial benefits gained or losses avoided

Key Principles:

• Each Member State may determine whether and to what extent public authorities are subject to fines
• Compliance with previously ordered measures may be considered when determining fine amounts
• Where processing serves multiple purposes, the maximum fine applies to the most serious infringement
• Fines may be imposed in addition to or instead of other corrective measures (warnings, orders, limitations)

Penalties (Article 84):

Member States must establish rules on other penalties applicable to GDPR infringements, particularly for violations not subject to administrative fines. These penalties must be effective, proportionate, and dissuasive. Member States must notify the Commission of these laws and any subsequent amendments.

Significance:

Chapter VIII ensures GDPR is more than aspirational by providing:

• Multiple avenues for data subjects to seek redress
• Direct liability for both controllers and processors
• Recognition of non-material harm (emotional distress, loss of privacy)
• Fines substantial enough to matter even to the world's largest companies
• Flexibility for supervisory authorities to tailor penalties to circumstances
• Collective redress mechanisms through representative organizations

The fine amounts, particularly the 4% of global turnover option, represent a significant departure from previous data protection regimes and have proven to be an effective deterrent, with major technology companies receiving fines in the hundreds of millions of euros for GDPR violations.