At EU level the basic instrument providing common rules for the processing of
the personal data of individuals involved in criminal proceedings is Directive
(EU) 2016/680 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data by
competent authorities for the purposes of the prevention, investigation, detection or
prosecution of criminal offences or the execution of criminal penalties, and on the
free movement of such data, and repealing Council Framework Decision 2008/977/
JHA.
31 It entered into force on 5 May 2016 and it has to be transposed into national
law by Member States by 6 May 2018.
Directive (EU) 2016/680 is aimed at ensuring a consistent and high level of
protection of the personal data of natural persons and facilitating the exchange of
personal data between competent authorities of Members States. It focuses in
strengthening the rights of data subjects and of the obligations of those who process
personal data. A criminal offence within the meaning of Directive (EU) 2016/680 is
an autonomous concept of Union law and it is not limited to crimes committed
through electronic means. The Directive applies to the processing of personal data
wholly or partly by automated means, and to the processing other than by automated
means of personal data which form part of a filing system or are intended to form part
of a filing system.
EU Data Protection Law and particularly the GDPR, the ePrivacy Regulation and
Directive (EU) 2016/680 do not apply to the processing of personal data related to
activities which fall outside the scope of Union law, such as those concerning
national security and defence. Hence, the processing of personal data by the Member
States when carrying activities concerning national security is not covered by those
instruments.
4 Remedies and International Dimension of EU Law
4.1 Remedies and Sanctions
EU Data Protection Law grants significant corrective powers to supervisory authorities, which are empowered, among others, to issue warnings and reprimands to
controllers and processors; to impose a temporary or definitive limitation including a
ban on processing; and to impose administrative fines [see, particularly, Article 58
(2) of the GDPR]. Data subjects are granted the right to lodge a complaint with a
supervisory authority (art. 77 GDPR); to an effective judicial remedy against a
legally binding decision of a supervisory authority concerning them (art.
78 GDPR); and the right to an effective judicial remedy where the rights of the
subject under the GDPR have been infringed (art. 78 GDPR). The latter is particularly relevant with respect to the right to receive compensation from the controller or
31 OJ L 119, 4.5.2016, p. 89.
472
P. A. de Miguel Asensio
the personal data of individuals involved in criminal proceedings is Directive
(EU) 2016/680 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data by
competent authorities for the purposes of the prevention, investigation, detection or
prosecution of criminal offences or the execution of criminal penalties, and on the
free movement of such data, and repealing Council Framework Decision 2008/977/
JHA.
31 It entered into force on 5 May 2016 and it has to be transposed into national
law by Member States by 6 May 2018.
Directive (EU) 2016/680 is aimed at ensuring a consistent and high level of
protection of the personal data of natural persons and facilitating the exchange of
personal data between competent authorities of Members States. It focuses in
strengthening the rights of data subjects and of the obligations of those who process
personal data. A criminal offence within the meaning of Directive (EU) 2016/680 is
an autonomous concept of Union law and it is not limited to crimes committed
through electronic means. The Directive applies to the processing of personal data
wholly or partly by automated means, and to the processing other than by automated
means of personal data which form part of a filing system or are intended to form part
of a filing system.
EU Data Protection Law and particularly the GDPR, the ePrivacy Regulation and
Directive (EU) 2016/680 do not apply to the processing of personal data related to
activities which fall outside the scope of Union law, such as those concerning
national security and defence. Hence, the processing of personal data by the Member
States when carrying activities concerning national security is not covered by those
instruments.
4 Remedies and International Dimension of EU Law
4.1 Remedies and Sanctions
EU Data Protection Law grants significant corrective powers to supervisory authorities, which are empowered, among others, to issue warnings and reprimands to
controllers and processors; to impose a temporary or definitive limitation including a
ban on processing; and to impose administrative fines [see, particularly, Article 58
(2) of the GDPR]. Data subjects are granted the right to lodge a complaint with a
supervisory authority (art. 77 GDPR); to an effective judicial remedy against a
legally binding decision of a supervisory authority concerning them (art.
78 GDPR); and the right to an effective judicial remedy where the rights of the
subject under the GDPR have been infringed (art. 78 GDPR). The latter is particularly relevant with respect to the right to receive compensation from the controller or
31 OJ L 119, 4.5.2016, p. 89.
472
P. A. de Miguel Asensio