1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
Article 78 GDPR - Right to an effective judicial remedy against a supervisory authority
2. Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.
3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.
4. Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Paragraph 1 gives each natural or legal person the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. Recital 143 clarifies that measures which are not legally binding, such as opinions issued or advice provided by the authority, are not covered.
Yes. Paragraph 2 gives the data subject a judicial remedy where the authority competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months of the progress or outcome of a complaint lodged pursuant to Article 77.
Under paragraph 3 proceedings must be brought before the courts of the Member State where the supervisory authority is established. Unlike Article 79(2), which governs actions against controllers and processors, Article 78 offers no alternative forum at the data subject's habitual residence.
No. Paragraph 1 speaks of each natural or legal person, so a controller or processor may equally challenge a legally binding decision addressed to it, such as a corrective measure imposed under Article 58(2). Paragraph 2, by contrast, is confined to data subjects.
Paragraph 4 obliges the supervisory authority to forward to the court the opinion or decision of the Board that preceded its own decision. Recital 143 adds that a national court which considers a Board decision determinative for the dispute and doubts its validity cannot set it aside itself but must refer the question of validity to the Court of Justice.