Representation of data subjects
The General Data Protection Regulation provides that non-profit organisations can actively expose data protection violations by lodging complaints with data protection authorities. Such organisations must not be profit-oriented, must pursue public interest objectives and must work, broadly, in the field of data protection. In Germany, for example, these organisations include the consumer centres (Verbraucherzentralen), which offer advice for consumers and can make use of their right to collective redress with which they can enforce the collective interests of consumers in certain legal areas. In addition, there are numerous non-profit associations that stand up for civil liberties in the digital world.
Consumer protection organisations have two ways of taking action: Data subjects have the right to contact organisations directly to have them file a complaint on behalf of themselves. In addition, EU member states may provide that consumer associations can lodge complaints with public authorities without a specific mandate from interested parties. In Germany, consumer centres and other organisations have been carrying out these tasks for years, thus helping to ensure that market failures can be recognised and punished independently of individual cases.
Article 80 GDPR (Representation of data subjects)
1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.
2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
Source: Regulation (EU) 2016/679
