The Collective Private Enforcement of Data Protection Rights in the EU

Abstract

Article 80 of the General Data Protection Regulation (GDPR) requires Member States to introduce collective redress – under the form of representative actions – in their procedural legal order, with the aim of fostering private enforcement. Accordingly, certain entities, such as consumer associations, can litigate on behalf of data subjects. In principle, European regulations do not need to be implemented by Member States. However, the GDPR created a special situation by enacting about fifty open clauses, thereby allocating some free room to national legislators. Additionally, in light of the principle of procedural autonomy, the protection of data subjects’ rights can only be ensured with the assistance of adequate national procedural rules.

In light of this, the present paper examines the procedural aspects of representative actions and analyses the recent legislative measures adopted in France, Belgium, Spain and Germany in order to comply with Article 80 GDPR. Since cross-border cases are likely to arise, the second part of this research project tackles private international law questions regarding international jurisdiction, inasmuch as it directly impacts access to justice. Lastly, concluding remarks are provided.

Keywords: collective redress, representative actions, data protection, Article 80 GDPR, international jurisdiction, Brussels Regulation (recast)

JEL Classification: K10, K33, K40