By Killian Donoghue

On April 27, 2016, the European Union (EU) issued a new privacy regulation that is binding, with direct legal effect, upon all Member States of the European Union. The EU’s publication of the General Data Protection Regulation is significant for two reasons: firstly, it recognises the importance of protecting EU citizens’ personal data rights; and secondly, it recognises the utility of class action procedures.

Right to privacy of personal information. Article 8(1) of the Charter of Fundamental Rights of the European Union provides that everyone has the right to the protection of personal data concerning him or her. In short, it protects the privacy of personal data. The EU’s General Data Protection Regulation, which was published in the Official Journal of the European Union on the 27th of April 2016, is aimed at giving greater protections to that right. As well as providing the right to lodge a complaint with the supervisory authority of a Member State, the Regulation provides that “each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation” (Art 79(1)). That includes a right to receive compensation, for material or non-material damage suffered as a result of an infringement of the Regulation, from the data controller/processor responsible for the violation of a personal data privacy right (Art 82(1)).

Given the high cost of legal services within some EU Member States, and the “chilling effect” that an order to pay the winning side’s costs could have on a person’s decision whether to initiate legal proceedings to enforce their rights, it is welcome that the Regulation introduces measures which will give substantive effect to the right to privacy guaranteed by Article 8(1) of the Charter of Fundamental Rights.

Class actions to enforce privacy rights. Article 80 of the Regulation provides for two types of class action procedures: (1) an opt-in procedure whereby a data subject can mandate a not-for-profit public interest body, which is active in the field of protecting data rights, to issue proceedings on his or her behalf; and (2), a Member State may provide that a not-for-profit public interest body, which is active in the field of protecting data rights, can issue legal proceedings on behalf of data subjects if it considers that the rights of data subjects have been infringed—independently of the data subjects.

Whether or not Member States choose to exercise option (2), the supremacy of EU law over national law and the direct effect of EU regulations means that, even in Member States where the domestic legal system does not provide for class action procedures, data subjects (EU citizens) within all 28 Member States can avail themselves of a class action procedure to seek an effective judicial remedy where they believe that a data controller/processor has infringed their personal data rights.

Conclusion. The new Regulation is a leap forward in the sense that it creates, for the first time, a class action procedure that all European citizens can use in every one of the Member States of the EU. The procedure is limited to the enforcement of privacy rights under the Regulation. And it is also limited to actions brought by non-profit public interest bodies. In other words, private citizens are not entitled, by this Regulation, to file a class action lawsuit, as in the United States. But it is a step forward that the EU has not taken in other substantive areas of law, such as anti-trust/competition law or consumer protection.