2.6 Remedies and Sanctions
2.6.1 Remedies for the Breach of Data Protection Rules
General Rules on Personal Data Protection
Under general data protection rules, the GDPR, each data subject shall have the right
to lodge a complaint with a supervisory authority, Art. 77 GDPR, and the right to an
effective judicial remedy against both a supervisory authority, Art. 78 GDPR, and a
controller or processor, Art. 79 GDPR. Furthermore, each person who has suffered
material or non-material damage as a result of an infringement of the GDPR shall
have the right to receive compensation from the controller or processor for the
damage suffered, if the controller cannot prove that it is not in any way responsible
for the event giving rise to the damage, Art. 82 GDPR. The civil liability under the
GDPR is extended compared to the old BDSG due to the legal anchoring of the right
to claim damages in the GDPR. Moreover, the introduction of collective actions, Art.
80 GDPR, facilitates the assertion of these rights.
Administrative fines have increased tremendous in the GDPR. Supervisory bodies can impose fines up to 20 million Euros, or in the case of an undertaking, up to
4% of the worldwide annual turnover of the preceding financial year, whichever is
higher, Art. 83 GDPR. Member States shall lay down other penalties applicable to
infringements of the Regulation, Art. 84 GDPR. The new BDSG provides for
administrative fines up to 50,000 Euro, sec. 43 new BDSG.
The breach of general data protection rules can also lead to criminal prosecution.
The new BDSG contains a special penal provision in sec. 42, which foresees
financial penalty or imprisonment up to 3 years. The breach of general data protection rules may also violate the German Criminal Code (“StGB”), which contains
several sections concerning the violation of privacy in sec. 201 StGB et seq. The
most severe penalty under those provisions is imprisonment not exceeding 5 years in
case of violation of the postal and telecommunications secret, sec. 206 StGB, or
violation of the privacy of the spoken word as a public official, sec. 201 para.
3 StGB.
Online Services
The protection of personal data in the context of services provided at a distance, by
electronic means, at the individual request of a recipient of services, is subject to
general data protection rules, the GDPR.
81 Thus the same remedies apply.
81 See Sect. 2.1.1.
204
C. Breunig and M. Schmidt-Kessel
2.6.1 Remedies for the Breach of Data Protection Rules
General Rules on Personal Data Protection
Under general data protection rules, the GDPR, each data subject shall have the right
to lodge a complaint with a supervisory authority, Art. 77 GDPR, and the right to an
effective judicial remedy against both a supervisory authority, Art. 78 GDPR, and a
controller or processor, Art. 79 GDPR. Furthermore, each person who has suffered
material or non-material damage as a result of an infringement of the GDPR shall
have the right to receive compensation from the controller or processor for the
damage suffered, if the controller cannot prove that it is not in any way responsible
for the event giving rise to the damage, Art. 82 GDPR. The civil liability under the
GDPR is extended compared to the old BDSG due to the legal anchoring of the right
to claim damages in the GDPR. Moreover, the introduction of collective actions, Art.
80 GDPR, facilitates the assertion of these rights.
Administrative fines have increased tremendous in the GDPR. Supervisory bodies can impose fines up to 20 million Euros, or in the case of an undertaking, up to
4% of the worldwide annual turnover of the preceding financial year, whichever is
higher, Art. 83 GDPR. Member States shall lay down other penalties applicable to
infringements of the Regulation, Art. 84 GDPR. The new BDSG provides for
administrative fines up to 50,000 Euro, sec. 43 new BDSG.
The breach of general data protection rules can also lead to criminal prosecution.
The new BDSG contains a special penal provision in sec. 42, which foresees
financial penalty or imprisonment up to 3 years. The breach of general data protection rules may also violate the German Criminal Code (“StGB”), which contains
several sections concerning the violation of privacy in sec. 201 StGB et seq. The
most severe penalty under those provisions is imprisonment not exceeding 5 years in
case of violation of the postal and telecommunications secret, sec. 206 StGB, or
violation of the privacy of the spoken word as a public official, sec. 201 para.
3 StGB.
Online Services
The protection of personal data in the context of services provided at a distance, by
electronic means, at the individual request of a recipient of services, is subject to
general data protection rules, the GDPR.
81 Thus the same remedies apply.
81 See Sect. 2.1.1.
204
C. Breunig and M. Schmidt-Kessel