3.5 Remedies and Sanctions
In the European Union, supervisory authorities have significant corrective powers,
including those to issue warnings and reprimands, impose temporary or definitive
limitations on processing, and impose administrative fines. These administrative
fines may amount to up to 20 million euros or four percent of the annual worldwide
turnover of an undertaking in the preceding financial year, whichever is higher.
142
Data subjects are granted several remedies under the GDPR in case of infringement to their rights. The main ones consist of the right to lodge a complaint with a
supervisory authority and the right to an effective judicial remedy, either against the
supervisory authority or against a third party, such as the data controller or the data
processor. Data subjects have the right to receive compensation for damages suffered
by any infringement.
Additionally, Member States may set forth national rules for criminal responsibility. The infringer may, thus, be subject to civil liability, criminal and administrative responsibility.
In the United States, the fact that data protection legislation is essentially of a
sectoral nature determines that rules on remedies and sanctions, as well as the
jurisdiction to enforce them, are equally sectoral in nature. As in Europe, sanctions
for infringements of data protection rules in the United States may be administrative,
civil or criminal, but the amounts of the applicable penalties are far lower.
143
Other legal systems included in the scope of this study also have rules on
remedies and sanctions for breaching data protection rules, such as the Singaporean
legal system.
144
4 The International Dimension of Data Protection
4.1 The Territorial Scope of Rules on Data Protection
We now turn to the issues raised by the international dimension of personal data
protection.
Due to, on the one hand, the global reach of the communications networks
through which personal data are currently collected, transmitted, and used—and,
hence, the ubiquitous nature that their processing typically takes on—and, on the
other hand, the different approaches that, as seen in the previous sections, are
adopted by several jurisdictions in respect of certain key aspects of their protection,
these issues are now of paramount significance.
142 See the European Union Special Report, Sect. 4.1.
143 See the United States of America’s National Report, Sect. 6.
144 See the Singaporean Report, Sect. 3.10.
30
D. Moura Vicente and S. de Vasconcelos Casimiro
In the European Union, supervisory authorities have significant corrective powers,
including those to issue warnings and reprimands, impose temporary or definitive
limitations on processing, and impose administrative fines. These administrative
fines may amount to up to 20 million euros or four percent of the annual worldwide
turnover of an undertaking in the preceding financial year, whichever is higher.
142
Data subjects are granted several remedies under the GDPR in case of infringement to their rights. The main ones consist of the right to lodge a complaint with a
supervisory authority and the right to an effective judicial remedy, either against the
supervisory authority or against a third party, such as the data controller or the data
processor. Data subjects have the right to receive compensation for damages suffered
by any infringement.
Additionally, Member States may set forth national rules for criminal responsibility. The infringer may, thus, be subject to civil liability, criminal and administrative responsibility.
In the United States, the fact that data protection legislation is essentially of a
sectoral nature determines that rules on remedies and sanctions, as well as the
jurisdiction to enforce them, are equally sectoral in nature. As in Europe, sanctions
for infringements of data protection rules in the United States may be administrative,
civil or criminal, but the amounts of the applicable penalties are far lower.
143
Other legal systems included in the scope of this study also have rules on
remedies and sanctions for breaching data protection rules, such as the Singaporean
legal system.
144
4 The International Dimension of Data Protection
4.1 The Territorial Scope of Rules on Data Protection
We now turn to the issues raised by the international dimension of personal data
protection.
Due to, on the one hand, the global reach of the communications networks
through which personal data are currently collected, transmitted, and used—and,
hence, the ubiquitous nature that their processing typically takes on—and, on the
other hand, the different approaches that, as seen in the previous sections, are
adopted by several jurisdictions in respect of certain key aspects of their protection,
these issues are now of paramount significance.
142 See the European Union Special Report, Sect. 4.1.
143 See the United States of America’s National Report, Sect. 6.
144 See the Singaporean Report, Sect. 3.10.
30
D. Moura Vicente and S. de Vasconcelos Casimiro