Such derogations for specific situations include: explicit consent by the data subject
to the proposed transfer, performance of a contract, important reasons of public
interest and protection of the vital interests of the data subject.
Chapter V of Directive (EU) 2016/680 (see number 20, supra) contains the
common rules on international transfers in the law enforcement sector in order to
facilitate cross-border cooperation between police and judicial authorities, both
within the EU and with third States. The specific adequacy assessment elements to
be made by the Commission when adopting adequacy decisions for the law enforcement sector are listed in Article 36(2) Directive (EU) 2016/680.
4.4 Private Enforcement and Conflict of Laws
EU law does not provide for common conflict-of-laws rules to determine the law
applicable to liability for damages caused by the unlawful processing of personal
data. The prevailing view is that such claims are excluded from the scope of
application of Regulation (EC) No 864/2007 of 11 July 2007 on the law applicable
to non-contractual obligations (Rome II) pursuant to Article 1(2)(g). According to
this provision, the Regulation does not apply to non-contractual obligations arising
out of violations of privacy and rights relating to personality, including defamation.
Although this situation has remained unaffected by the adoption of the GDPR, it
is noteworthy that the Regulation includes new special jurisdiction rules concerning
private claims by data subjects against a controller or processor as a result of the
infringement of the rights granted to them by the Regulation. Such rules, which are
intended to supplement those of the Brussels I (Recast) Regulation are of special
significance in a context in which private enforcement of data protection law has
become prominent.
39 In particular, that is the case with regard to the enforcement of
the right to compensation where damage results from an infringement of the GDPR.
In this respect, Article 79 contains a specific provision on international jurisdiction
regarding claims brought by a data subject against a controller or processor where he
or she considers that his or her rights under the GDPR have been infringed, including
court proceedings for exercising the right to receive compensation.
40 Article 82 of
the GDPR provides some common substantive rules on the right of any person who
has suffered material or non-material damage as a result of an infringement of the
Regulation to receive compensation from the controller or processor for the damage
suffered.
39 CJEU Judgment of 25 January 2018, C-498/16, Maximilian Schrems v. Facebook Ireland
Limited, ECLI:EU:C:2018:37.
40 Brkan (2015), pp. 257–278; Kohler (2016), pp. 653–675; De Miguel Asensio (2017), pp. 92–106.
476
P. A. de Miguel Asensio
to the proposed transfer, performance of a contract, important reasons of public
interest and protection of the vital interests of the data subject.
Chapter V of Directive (EU) 2016/680 (see number 20, supra) contains the
common rules on international transfers in the law enforcement sector in order to
facilitate cross-border cooperation between police and judicial authorities, both
within the EU and with third States. The specific adequacy assessment elements to
be made by the Commission when adopting adequacy decisions for the law enforcement sector are listed in Article 36(2) Directive (EU) 2016/680.
4.4 Private Enforcement and Conflict of Laws
EU law does not provide for common conflict-of-laws rules to determine the law
applicable to liability for damages caused by the unlawful processing of personal
data. The prevailing view is that such claims are excluded from the scope of
application of Regulation (EC) No 864/2007 of 11 July 2007 on the law applicable
to non-contractual obligations (Rome II) pursuant to Article 1(2)(g). According to
this provision, the Regulation does not apply to non-contractual obligations arising
out of violations of privacy and rights relating to personality, including defamation.
Although this situation has remained unaffected by the adoption of the GDPR, it
is noteworthy that the Regulation includes new special jurisdiction rules concerning
private claims by data subjects against a controller or processor as a result of the
infringement of the rights granted to them by the Regulation. Such rules, which are
intended to supplement those of the Brussels I (Recast) Regulation are of special
significance in a context in which private enforcement of data protection law has
become prominent.
39 In particular, that is the case with regard to the enforcement of
the right to compensation where damage results from an infringement of the GDPR.
In this respect, Article 79 contains a specific provision on international jurisdiction
regarding claims brought by a data subject against a controller or processor where he
or she considers that his or her rights under the GDPR have been infringed, including
court proceedings for exercising the right to receive compensation.
40 Article 82 of
the GDPR provides some common substantive rules on the right of any person who
has suffered material or non-material damage as a result of an infringement of the
Regulation to receive compensation from the controller or processor for the damage
suffered.
39 CJEU Judgment of 25 January 2018, C-498/16, Maximilian Schrems v. Facebook Ireland
Limited, ECLI:EU:C:2018:37.
40 Brkan (2015), pp. 257–278; Kohler (2016), pp. 653–675; De Miguel Asensio (2017), pp. 92–106.
476
P. A. de Miguel Asensio