Two weeks ago today I was chatting over coffee with a data protection expert during the second day of the Data Summit 2017. He was annoyed at my blogpost on the Government’s General Scheme of the Data Protection Bill 2017 [the Scheme] to give further effect in Irish law to the EU’s General Data Protection Regulation [the GDPR]. Article 82(1) GDPR provides claim for compensation for anyone whose rights under the GDPR are infringed. In the post that annoyed him so much, I said that I couldn’t find a Head to this effect in the Government’s Scheme. He said: what about Head 91? I said: that’s where it should be, but it isn’t there. He wasn’t convinced. So, I went back and had a closer look at the Scheme and the GDPR. I also had a look at an associated Directive (the Police and Criminal Justice Authorities Directive [the PCJAD]) which is also being transposed by the Scheme. Article 56 PCJAD similarly provides for a claim for compensation for anyone whose rights under the PCJAD are infringed. Heads 91 and 58 (respectively) of the Scheme address these claims, but they do not completely provide for such claims for compensation. So, I’m still of the view that the Scheme does not provide a claim for compensation for breach of the GDPR and the Scheme. It seems to assume one, to be sure; but it never goes so far as expressly to provide one.

Article 79 GDPR provides for a right to an effective judicial remedy against a controller or processor; and Article 82 GDPR provides for a claim for compensation as part of that effective judicial remedy. Head 91 of the Scheme seems to be directed towards these Articles. Head 91(1) provides what it describes as “a data protection action” to data subjects whose rights under the GDPR or its translating legislation are infringed. Head 91(2) provides jurisdiction to the Circuit Court, concurrently with the High Court, to hear such actions. Head 91(3) provides:

In a data protection action under this Head, the Circuit Court shall, without prejudice to its powers to award compensation in respect of material or non-material damage, have the power to grant relief by means of injunction or declaratory orders.

And Head 91(4)(b) requires a plaintiff in a data protection action to specify, inter alia, “any material or non-material damage alleged to have been occasioned by the infringement”.

The reference in Head 91(3) to the provision of other remedies “without prejudice to [the Circuit Court’s] … powers to award compensation” assumes that the Court has such powers. And the reference in Head 91(4)(b) to “any material or non-material damage” further assumes that that the powers to award compensation cover both material and non-material damage. However, Head 91 does not expressly afford a claim compensation for material or non-material damage; nor is it expressly afforded elsewhere in the Scheme. It may be that this Head is predicated on the assumption that Article 82(1) GDPR is directly horizontally effective and thereby provides those “powers to award compensation”.

However, it is not so clear that Article 82(1) GDPR is indeed directly horizontally effective. It does not say that a person whose rights have been infringed has the right to receive compensation. Instead, it provides, in a much more mealy-mouthed fashion, that a plaintiff “shall have” such a right. This seems to imply that there is something more to be done in national law before plaintiffs actually have the claim. If so, it is not sufficiently clear, precise and unconditional to create a direct horizontal claim for compensation that can be relied upon in the Irish courts without an express provision giving effect to it in the Scheme. On the other hand, the Court of Justice of the European Union [CJEU; the main Courtroom is pictured right] has provided expansive interpretations of claims for compensation pursuant to various other Regulations (C-402/07 Sturgeon; eg Case C-481/14 Hansson) and Directives (eg Case C-271/91 Marshall (No 2); Case C-168/00 Leitner; Case C-314/09 Stadt Graz; Case C-99/15 Liffers), and a similarly expansive interpretation of the claim for compensation for damage in Article 82(1) GDPR is inevitable, but only if it is asked. Unless and until it is, there is the potential for great uncertainty. It would therefore be better to have this matter settled by legislation rather than leaving it to the vagaries of litigation to – and in – the CJEU.

Whilst Head 91 provides a superstructure for an effective judicial remedy for infringement of the GDPR or of its translating legislation, and whilst it assumes a claim for compensation, it does not expressly provide one. Rather than hope that litigation to the CJEU establishes that Article 82(1) GDPR is directly horizontally effective and requires that it be interpreted expansively, the best solution would be for Head 91 of to contain an express provision giving full effect to Article 82(1) GDPR in Irish law.

The architecture of the PCJAD in this respect is very similar to the GDPR. Article 54 PCJAD provides for a right to an effective judicial remedy against a controller or processor; and Article 56 PCJAD provides for a claim for compensation as part of that effective judicial remedy. Head 58 of the Scheme seems to be directed towards these Articles. It provides that a person “who suffers material or non-material damage” by reason of an infringement of the Part of the Scheme transposing the PCJAD “shall have the right to receive compensation …”. This is a clear claim for compensation, and it is unfortunate that a similarly clear clause was not provided in Head 91. However, Head 58 does not locate this claim for compensation in a superstructure for an effective judicial remedy for infringement of that Part of the Scheme, comparable with the superstructure provided in Head 91. It may be that Head 58 is predicated on the assumption that ordinary court procedures will fill that gap. Rather than hope that litigation will work this issue out, the best solution would be for the claim for compensation in Head 58 of the Scheme to be contained an express superstructure for an effective judicial remedy, much as is provided in Head 91.

Both Head 58 and Head 91 do half the necessary work, and each does a different half: whereas Head 58 contains an express claim for compensation but does not provide a superstructure for an effective remedy, Head 91 provides a superstructure for an effective remedy but does not contain an express claim for compensation. The solution is simple; in Head 58, add a superstructure for an effective remedy along the lines of that already provided in Head 91; and, in Head 91, add an express claim for compensation, following the lead of Head 58. In this way, the issues of compensation and remedies for infringement of the GDPR and the PCJAD can be dealt with on a consistent basis in the Scheme.

I have written an extended analysis of compensation for breach of the GDPR (download via SSRN) which I have applied to the Scheme, and I have written a summary of the argument as a submission (which you may download here (pdf)) to the Joint Oireachtas Committee on Justice and Equality which is conducting pre-legislative scrutiny on the Scheme. The points in this post are drawn from these sources, and all comments on any version of the analysis will be very gratefully received.