The legal framework of data subject representation

Abstract

The GDPR provided for new rules on the right of the data subjects to an effective judicial remedy against a controller or a processor where they consider that their rights have been infringed under the Regulation as a result of the processing of personal data. Art. 80 of the GDPR, on the representation of data subjects, is intended to favour private enforcement of EU data protection law, providing for the representation of data subjects by a body or entity which must meet specific requirements in order to exercise the rights conferred to the data subject regarding an effective judicial remedy. The representation of data subjects by a third party in legal actions is possible in two cases: on the one hand, the situation where a data subject mandates the body or organization to represent them or, on the other side, when a body or organization, has the right to lodge a complaint and exercise the rights to effective judicial remedies provided by the GDPR independently of a mandate. This paper will detail the legal framework of this private enforcement tool and analyse the links between data protection and consumer protection from the perspective of collective redress and representation of the interests of a data subject.