1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.
Article 80 GDPR - Representation of data subjects
2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject’s mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Under paragraph 1 the data subject may mandate a qualifying not-for-profit body, organisation or association to lodge the complaint under Article 77 on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and, where Member State law so provides, to exercise on his or her behalf the right to receive compensation referred to in Article 82.
Paragraph 1 requires the body to be not-for-profit, to be properly constituted in accordance with the law of a Member State, to have statutory objectives which are in the public interest, and to be active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data. These conditions are cumulative, so a commercial claims vehicle or a body active in unrelated fields does not qualify.
Only where the Member State has exercised the option in paragraph 2. In that case the body may lodge a complaint in that Member State with the supervisory authority competent pursuant to Article 77 and exercise the rights referred to in Articles 78 and 79, if it considers that the rights of a data subject under the Regulation have been infringed as a result of the processing.
No. Paragraph 2 covers only the complaint and the remedies of Articles 78 and 79. The right to receive compensation under Article 82 appears solely in paragraph 1, is exercised on the data subject's behalf under a mandate, and even then only where Member State law provides for it.
Only in part. Mandated representation for the purposes of Articles 77, 78 and 79 flows directly from paragraph 1, whereas representation for compensation claims and any action without a mandate depend on choices left to Member State law, so the reach of collective redress varies between Member States.