The European Union is on the verge of adopting a series of regulations that will affect how data is collected and shared in the EU. These include the Data Governance Act, the Digital Services Act, the Digital Markets Act, the Artificial Intelligence Act and the Data Act. These acts do not focus on personal data — in fact, European lawmakers continuously stress that the main aim of these acts is to regulate nonpersonal data. But these acts also do not exempt personal data from their scope of application. Therefore, it is possible — and likely — that certain processing operations of personal data will be governed by the EU General Data Protection Regulation as well as some of the above-mentioned acts if the processing operation falls within the scope.
These acts state they do not intend to diminish the protection to personal data offered by the GDPR and in case of discrepancy between GDPR provisions and these acts, the GDPR prevails (see Recital 4 of the Data Governance Act). According to the European Commission, there should not be a discrepancy between the GDPR and these acts since the latter are building on and complementing the GDPR. However, not everybody shares this viewpoint, as evidenced by the opinions issued by the European Data Protection Board and the European Data Supervisor on the proposals for these acts coming out of the European Commission.
Setting aside possible inconsistencies between the GDPR and these acts, the fact that some of the provisions of these acts build on certain principles of the GDPR means that an act or omission can constitute a violation of the GDPR and some of the acts. For example, when large online platforms that operate as gatekeepers — per the term defined in Section 2 (definitions) of the Digital Markets Act — combine and cross-use personal data from several of their platforms, they could be violating the DMA and also the GDPR. The same is true for gatekeepers that violate the data portability requirement of the DMA. Another example concerns the Digital Services Act where a violation of the prohibition to send targeted advertising to minors or the prohibition to process special categories of data for advertising purposes could also be a violation of the GDPR. The proposal for the Artificial Intelligence Act contains several provisions that interact with the GDPR, such as provisions on profiling or the use of facial recognition. A violation of any of these provisions could also be a violation of the GDPR.
This creates an interesting situation. Each of these acts has its own set of rules on enforcement and competent authorities. The GDPR does as well, and those rules and competent bodies do not necessarily correspond. Except for the Digital Markets Act where enforcement is entrusted to the European Commission, these acts foresee that Member States appoint national competent authorities tasked with monitoring and enforcing. Despite pleas from the European Data Protection Board and the European Data Protection Supervisor, it is far from certain — and in fact rather unlikely — that Member States will appoint current data protection authorities as the competent bodies for the enforcement of these various acts. Therefore, it is entirely possible that companies face two separate investigations — and fines — for one and the same "offense."
Dual proceedings as such are not a new phenomenon. In the past there have been numerous occasions where individuals or companies have faced double proceedings for the same set of facts. In many of these instances, the individual or company invoked the principle of “non bis in idem” in defense, which is a Latin phrase meaning “not twice for the same.” This principle is essentially the equivalent of the double jeopardy principle in common law jurisdictions as it prohibits an accused from being convicted twice for the same offense. The principle is enshrined in Article 50 of the Charter of Fundamental Rights of the European Union, which indicates that "no one shall be liable to be tried or punished again in criminal proceedings for an offence for which he or she has already been finally acquitted or convicted within the Union in accordance with the law."
The wording of Article 50 refers to criminal law sanctions. The GDPR does not contain criminal sanctions, and most of the acts are unlikely to be sanctioned criminally. The question therefore arises if the double jeopardy principle can be invoked in cases of dual proceedings under the GDPR and one of the acts. The answer to this would seem to be yes. Indeed, notwithstanding the clear wording of Article 50, it is now well-established case law that the principle can also be invoked in cases that are not criminal law in the strict sense of the term but involve penalties severe and punitive in nature, as opposed to merely aimed at repairing damages. (See European Court of Justice Case C-537/16, Case C-524/15 and Case C-596/16, involving violations of rules on market manipulations, Value Added Tax and insider dealing).
The sanctions under the GDPR and those that will be enacted by Member States under the acts will most likely meet the "severe and punitive" test. Companies facing fines under the GDPR and the acts therefore could try to avail themselves of the “non bis in idem” defense. In order to be successful, these companies will need to demonstrate both that:
- There is a prior final decision by a court or administrative body (the "bis," or “twice” condition).
- The prior decision and the subsequent proceedings concern the same facts (the "idem," or “same” condition).
While the “idem” condition may be relatively straightforward in the case of an infringement of the GDPR and any of the acts, the “bis” condition could be problematic as the legal proceedings may run in parallel, and therefore none of them final.
Also, companies invoking the “non bis in idem” defense will need to navigate Article 52 of the Charter, which allows for limitations of the fundamental rights and freedoms enshrined in the Charter, provided they are proportionate, necessary and genuinely meet objectives of general interest recognized in the EU. Courts in the EU have regularly deviated from the “non bis in idem” principle and allowed dual proceedings regarding the same infringement because they find the different sets of legislation on which these proceedings were based to pursue distinct, legitimate and complimentary objectives.
An example would be a set of facts that infringes the GDPR and the DMA where it could be argued that the GDPR aims to protect personal data, whereas the DMA aims to prevent distortion of competition: two distinct, legitimate and complementary objectives. A recent Court of Justice of the European Union case opposing the Belgian postal authority against the Belgian competition authority (Case C-117/20) offers a good overview of the status and reasoning of Europe's highest court in this complex area of law.
The last word on the “non bis in idem” principle clearly has not been said. Hopefully, once these acts start to apply and dual proceedings emerge, the authorities involved will work together, find common ground and avoid dual proceedings.
