Having looked, in my previous post, at what Article 82(1) of the General Data Protection Regulation says and means in each of the EU’s 24 official languages, I’m interested in this post in the related question of the current status of incorporation of the GDPR in each of the EU’s 28 Member States.
I am interested in particular in whether provision has been made in any incorporating legislation or draft for an express claim for compensation or damages to give effect to Article 82. The list below is the current state of play so far as I have been able to find out. I would be grateful if you correct any errors and help me fill in the blanks – via the comments below, via email, or via the contact page on this blog – I would very grateful indeed.
It seems that incorporations in various jurisdictions are taking differing positions on Article 82. On the one hand, On the one hand, such express claims are included in legislation in Austria, in draft Bills in the Netherlands, Poland, and Spain, and in a report in Sweden. On the other, no such express claims appear in legislation in Germany and France, in draft Bills in Estonia and Lithuania, or in reports in Finland or the UK. Somewhere in the middle comes Ireland.
Austria §29(1) of the Bundesgesetz, mit dem das Datenschutzgesetz 2000 geändert wird (DatenschutzAnpassungsgesetz 2018) (pdf) provides for a claim to compensation, which seems to be modelled on, and which directly refers to, Article 82 GDPR (updated).
Belgium No information so far.
Bulgaria No information so far.
Croatia Draft legislation is expected in the third quarter of 2017.*
Cyprus No information so far.
Czech Republic Draft legislation is expected no later than 31 August 2017.*
Denmark Draft legislation is expected in the Autumn.*
Estonia The process of amendment is well underway; but there do not seem to be plans for provisions relating to compensation or damages or Article 82.
Finland The Working Group appointed by the Finnish Ministry of Justice has published a report, which considers that Article 82 does not need national incorporation (see p62).
France LOI n° 2016-1321 du 7 octobre 2016 pour une République numérique (the Digital Republic Act), amends French law to implement various provisions of the GDPR, but does not provide a claim for compensation or damages. The Commission Nationale de l’Informatique et des Libertés suggests that further legislation is required (see CNIL Rapport d’activité 2016 (pdf) p23), but does not refer to compensation or damages or Article 82.
Germany There is no express provision for compensation or damages in the Gesetz zur Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680 (Datenschutz-Anpassungs- und -Umsetzungsgesetz EU – DSAnpUG-EU); (Gesetz vom 30 Juni 2017; Bundesgesetzblatt Teil I, 2097).
Greece No information so far.
Hungary No information so far.
Italy The legislative process has formally commenced, but there is no draft legislation yet.
Ireland The Government has published a draft General Scheme of a Data Protection Bill 2017. Head 91 seeks to provide an effective judicial remedy for data breaches, and assumes a claim for compensation. I think that it is unclear whether the current draft effectively incorporates Article 82 GDPR.
Latvia No information so far.
Lithuania The current draft Bill does not refer to compensation or damages or Article 82.
Luxembourg Drafting so far has concentrated on authorisation regimes, and there is no information on when legislation will address other GDPR issues.
Malta No information so far.
Netherlands Article 36 of the current draft Bill provides for a claim for compensation. The draft bill went through public consultation and has been sent for advice to the Council of State, with a view to submission to Parliament in the Autumn (updated).
Poland Article 55 of the current draft Bill (pdf) provides for a claim to compensation.
Portugal No information so far.
Romania No information so far.
Slovakia No information so far.
Slovenia No information so far.
Spain Article 32(2) of the current draft Bill (pdf download) provides for a claim for compensation by reference to Article 82 GDPR. The Plenum of the General Council of the Judiciary unanimously approved the draft (updated).
Sweden Chapter 8 §1 of the draft Bill proposed in a recent Report for the Ministry of Justice (pdf) (pp25, 48, 274-278, 302-304, 384, 401) includes compensation claims that refer to Article 82 GDPR.
United Kingdom The Department of Digital, Culture, Media and Sport conducted a consultation which did not refer to Article 82. On foot of that consultation, and in advance of publishing a Bill, the Department has issued a Statement of Intent, outlining its planned reforms in advance of a Bill due next month. This refers the “greater scope for enforcing rights under the GDPR” (p13) but does not explicitly mention a compensation claim. (updated).
European Economic Area (EEA): Since the GDPR is a text with EEA relevance, its incorporation into domestic law in Iceland, Liechtenstein and Norway is also relevant. In Norway, the main part of the draft Bill (pdf) will contain a clause to incorporate the GDPR generally, with a Norwegian translation (pdf) of the Regulation itself in an Appendix; other clauses of the Bill will provide additional detail; compensation claims pursuant to Article 82(1) GDPR (see section 27.2; p101) will be provided via the general incorporation and not in an additional specific clause (updated).
Third countries: Other countries that have enacted data protection regimes modelled upon the Data Protection Directive, are likely to amend these regimes to come into line with the GDPR, not least to maintain their “current EU adequacy decisions. For this reason, in Switzerland, the government …” has recently issued a preliminary draft of a new Bill (available via here), which does not seem to provide for a compensation claim (for example, there is no entry for Article 82 in the GDPR column in the concordance table (pdf).
* Source: Baker McKenzie GDPR – National Legislation Survey (May 2017) (pdf) (via here).
This post originally appeared on the Cearta.ie blog and is reproduced with permission and thanks.
Reblogged this on World4Justice : NOW! Lobby Forum..