One of the objectives the EU General Data Protection Regulation is to afford individuals back control over their personal data. And one of the means by which this objective is achieved is the provision of a private right of action for damages. As a consequence, Article 82(1) of the GDPR provides that, "Any person who has suffered material or nonmaterial damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."
This will make a significant contribution to the protection of privacy and data protection rights in the EU.
However, unusually for a Regulation, some provisions of the GDPR will need to be implemented by national legislation in the EU's member states. To look further into this underreported issue, I wrote a new paper that considers whether Article 82 takes effect in its own right in national law or needs to be expressly included in national implementing legislation.
The first part of my article compares and contrasts Article 82(1) of the GDPR with compensation provisions in other EU Regulations and Directives and with the case law of the Court of Justice of the EU on those provisions and concludes that it is not clear that Article 82(1) GDPR is directly horizontally effective though the Court (eventually, if and when it is asked) is likely to interpret it broadly.
This means that the safest course of action at this stage is to provide expressly for a claim for compensation in national law. The second part of my article compares and contrasts the compensation provisions in the Irish government's General Scheme of the Data Protection Bill 2017 with existing legislation, and concludes that the Heads of the Scheme do not give full effect to Article 82(1) GDPR.
Amendments to the Scheme are therefore proposed.
photo credit: justusbluemer Europäische Flagge via photopin (license)