Hence, if the data controller or processor has acted in its home country, where its
actions were ex hypothesis lawful, but should have foreseen the occurrence of an
injury to the data subject in a foreign country, as a consequence of the processing of
its personal data, e.g. because it was offering its goods or services in that country,
and this country’s law holds the controller or processor liable in tort for the damage
thus caused to the data subject, this law shall apply.
Other legal systems, such as the Belgian,
176 German
177 and Italian
178 ones, offer
the plaintiff a choice, in what concerns torts committed at a distance, between the law
of the place of the harmful event and that where the damage was sustained.
Such a choice is in line with the GDPR’s rule on jurisdictional competence
contained in article 79(2), which also applies to court proceedings for the exercise
of the right to receive compensation by virtue of article 82(6) of the Regulation,
according to which:
Proceedings against a controller or a processor shall be brought before the courts of the
Member State where the controller or processor has an establishment. Alternatively, such
proceedings may be brought before the courts of the Member State where the data subject
has his or her habitual residence, unless the controller or processor is a public authority of a
Member State acting in the exercise of its public powers.
A preference for the law of the place of the injury is more openly expressed by
several Common Law systems, notably the American and the English ones, which
determine its applicability to claims for compensation of personal injury.
179
176 See article 99, § 2, according to which: “Obligations resulting from a tort are nevertheless
governed: 1
in the event of defamation or violation of privacy or personality rights, at the choice of
the plaintiff, by the law of the State on the territory of which the act leading to the damage or the
damage occurred or is likely to occur, unless the person liable proves that he could not have
foreseen the damage to occur in that State [. . .]”.
177 See article 40(1) of the Introductory Act to the German Civil Code, according to which: “Tort
claims are governed by the law of the country in which the liable party has acted. The injured party
can demand that instead of this law, the law of the country in which the injury occurred is to be
applied. The option can be used only in the first instance court until the conclusion of the pre-trial
hearing or until the end of the written preliminary procedure”.
178 See article 62(1) of Law of 31 May 1995, section 218, on the Reform of the Italian System of
Private International Law, according to which: “The law of the State where the event occurred
governs tort liability there for. However, at the request of the injured party, the law of the State
where the fact which caused the damage occurred shall apply”.
179 Accordingly the § 146 of the American Restatement 2nd on the Conflict of Laws states that: “In
an action for a personal injury, the local law of the state where the injury occurred determines the
rights and liabilities of the parties, unless, with respect to the particular issue, some other state has a
more significant relationship under the principles stated in § 6 to the occurrence and the parties, in
which event the local law of the other state will be applied”. Section 11 of the English Private
International Law (Miscellaneous Provisions) Act 1995 provides, in turn, that: “(1)The general rule
is that the applicable law is the law of the country in which the events constituting the tort or delict in
question occur. (2) Where elements of those events occur in different countries, the applicable law
under the general rule is to be taken as being (a) for a cause of action in respect of personal injury
caused to an individual or death resulting from personal injury, the law of the country where the
individual was when he sustained the injury [. . .]”.
Data Protection in the Internet: General Report
39
actions were ex hypothesis lawful, but should have foreseen the occurrence of an
injury to the data subject in a foreign country, as a consequence of the processing of
its personal data, e.g. because it was offering its goods or services in that country,
and this country’s law holds the controller or processor liable in tort for the damage
thus caused to the data subject, this law shall apply.
Other legal systems, such as the Belgian,
176 German
177 and Italian
178 ones, offer
the plaintiff a choice, in what concerns torts committed at a distance, between the law
of the place of the harmful event and that where the damage was sustained.
Such a choice is in line with the GDPR’s rule on jurisdictional competence
contained in article 79(2), which also applies to court proceedings for the exercise
of the right to receive compensation by virtue of article 82(6) of the Regulation,
according to which:
Proceedings against a controller or a processor shall be brought before the courts of the
Member State where the controller or processor has an establishment. Alternatively, such
proceedings may be brought before the courts of the Member State where the data subject
has his or her habitual residence, unless the controller or processor is a public authority of a
Member State acting in the exercise of its public powers.
A preference for the law of the place of the injury is more openly expressed by
several Common Law systems, notably the American and the English ones, which
determine its applicability to claims for compensation of personal injury.
179
176 See article 99, § 2, according to which: “Obligations resulting from a tort are nevertheless
governed: 1
in the event of defamation or violation of privacy or personality rights, at the choice of
the plaintiff, by the law of the State on the territory of which the act leading to the damage or the
damage occurred or is likely to occur, unless the person liable proves that he could not have
foreseen the damage to occur in that State [. . .]”.
177 See article 40(1) of the Introductory Act to the German Civil Code, according to which: “Tort
claims are governed by the law of the country in which the liable party has acted. The injured party
can demand that instead of this law, the law of the country in which the injury occurred is to be
applied. The option can be used only in the first instance court until the conclusion of the pre-trial
hearing or until the end of the written preliminary procedure”.
178 See article 62(1) of Law of 31 May 1995, section 218, on the Reform of the Italian System of
Private International Law, according to which: “The law of the State where the event occurred
governs tort liability there for. However, at the request of the injured party, the law of the State
where the fact which caused the damage occurred shall apply”.
179 Accordingly the § 146 of the American Restatement 2nd on the Conflict of Laws states that: “In
an action for a personal injury, the local law of the state where the injury occurred determines the
rights and liabilities of the parties, unless, with respect to the particular issue, some other state has a
more significant relationship under the principles stated in § 6 to the occurrence and the parties, in
which event the local law of the other state will be applied”. Section 11 of the English Private
International Law (Miscellaneous Provisions) Act 1995 provides, in turn, that: “(1)The general rule
is that the applicable law is the law of the country in which the events constituting the tort or delict in
question occur. (2) Where elements of those events occur in different countries, the applicable law
under the general rule is to be taken as being (a) for a cause of action in respect of personal injury
caused to an individual or death resulting from personal injury, the law of the country where the
individual was when he sustained the injury [. . .]”.
Data Protection in the Internet: General Report
39