Article 29 Working Party adopted on 23 March its Opinion on the proposed EU data protection reform package, criticizing the lack of ambition of the Directive regarding data protection in police and criminal justice matters and also finding some flaws in the proposed Regulation.
You can find the original text HERE.
I will only highlight here the notes of the WP29 regarding the “Right to liability and compensation”.
“The Working Party welcomes the provisions introduced in Article 77(1) to ensure any person who has suffered damage as a result of an unlawful processing operation or an action incompatible with the Regulation has the right to receive compensation by the controller or processor for the damage suffered.
The Working Party also welcomes the fact that Article 77(2) ensures that the data subject does not bear the burden of addressing the responsible controller in case more than one controller or processor is involved in the processing.
The Working Party considers however that it is necessary to clarify (in a recital) that the word “damage” does not merely mean material harm but also includes distress (harm that is not material).
If there is a decision taken by another DPA, (for example, the DPA of the main establishment) affecting or producing a prejudice to the data subject, the latter should be able to bring action against this decision before the administrative courts of her/his country of residence.
The solution as proposed by the European Commission, to have either the data subject or the DPA to bring action against the other DPA on the territory of this DPA is far from satisfactory. The Working Party calls for a system that allows data subjects to bring action against an administrative decision before the administrative court of their country of residence.”
pdpEcho 