Last updated: 7 May 2018

Having looked, in my previous post, at what Article 82(1) of the General Data Protection Regulation says and means in each of the EU’s 24 official languages, I’m interested in this post in the related question of the current status of incorporation* of the GDPR in each of the EU’s 28 Member States. I am interested in particular in whether provision has been made in any incorporating* legislation or draft for an express claim for compensation or damages to give effect to Article 82 GDPR. The list below is the current state of play so far as I have been able to find out. I would be grateful if you correct any errors and help me fill in the blanks – via the comments below, via email, or via the contact page on this blog – I would very grateful indeed.

Complete incorporation: Legislation to incorporate* the GDPR has been enacted in Austria, Belgium (though a further Bill is pending), Germany, Poland, Slovakia and Slovenia (a French Act anticipated some of its requirements, though a full incorporation Bill is pending). About half of the Member States are likely to complete the process before 25 May 2018.

No information: Drafts have not been published in Bulgaria, Cyprus, Italy, and Malta.

Compensation: Incorporations in various jurisdictions are taking differing positions on Article 82 GDPR. On the one hand, such express claims are included in legislation in Austria, Poland and Slovakia, in Bills in Denmark, Greece, Hungary, Ireland, Romania, Spain, Sweden and the UK. On the other hand, no such express claims appear in legislation in Belgium, France and Germany, in Bills in Belgium (again), Estonia, France (again), Latvia, Lithuania, Luxembourg, the Netherlands, Portugal and Slovenia. Croatia, Finland and Portugal take the view that Article 82 is directly effective; while the Czech Republic considers that the existing compensation provisions cover Article 82 GDPR.

As Katie Nolan points out, this matters a great deal, because – unlike Article 4 of the Data Protection Directive (Directive 95/46/EC) – the GDPR contains no choice of law mechanism to determine which national data protection legislation applies in cross-border cases [update: see also here]. In the context of Article 82 GDPR, differences in national incorporations are likely to encourage plaintiffs to shop for the fora with the most generous compensation claims.

Austria §29(1) of the Bundesgesetz, mit dem das Datenschutzgesetz 2000 geändert wird (Datenschutz-Anpassungsgesetz 2018) (Bundesgesetzblatt I Nr. 120/2017 Teil I) provides for a claim to compensation, which seems to be modelled on, and which directly refers to, Article 82 GDPR. This legislation is of general application; work on other sector-specific laws is still ongoing.

Belgium La loi du 3 décembre 2017 portant création de l’Autorité de protection des données (pdf) will replace the existing Commission de la protection de la vie privée with a more powerful Autorité de protection des données. However, the legislation does not provide for a claim to compensation, though the explanatory notes to the prior Bill (pdf) referred to Article 82 GDPR and implied that it can be relied upon directly in Belgian courts (pp14-15). On 16 March 2018, the Council of Ministers approved a further Bill relating to data protection.

Bulgaria A Bill was not expected before September 2017, but there is no draft legislation yet.

Croatia Consultation on a draft Bill closed on 22 March 2018. Article 39 of the Bill assumes that Article 82 GDPR is directly effective.

Cyprus A Working Group has been set up to prepare general legislation for public consultation and submission to Parliament before end of 2017, but public consultation is not now expected until Spring, and there is no draft legislation yet.

Czech Republic The current draft Bills (here and here) will amend existing legislation (Act No 101/2000 Coll on the Protection of Personal Data) to incorporate the GDPR, and they are expected to be passed before the end of May 2018. However, neither Bill refers to compensation or damages or Article 82 GDPR. Indeed, the explanatory note to the second Bill (fourth .doc download here), discussing changes to domestic civil procedures to accommodate Article 80 GDPR (pp48-49), suggests that claims for compensation or damages will be dealt with by existing civil law; and a concordance prepared by the Office for Personal Data Protection, suggests that such claims will continue to be dealt with by sections 21, 25 and 26 of the 2000 Act, which will not have to be amended to come into line with Article 82 GDPR.

Denmark The Ministry of Justice has published a comprehensive Report on the Data Protection Regulation (vol 1; pdf) (vol 2; pdf). It contains a thorough analysis of Article 82 GDPR and corresponding Danish law (see pp898-918), but it does not recommend any specific incorporation provision, observing instead that it “is assumed that the Member States’ discretion to set their own rules on liability in the personal data area … is limited to some extent as some of those rules now follow directly from Article 82 of the Regulation” (p918). Two Bills have gone to Parliament (here and here), and §40 of L 68 Forslag til lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer i forbindelse med behandling af personoplysninger og om fri udveksling af sådanne oplysninge (databeskyttelsesloven) provides for compensation claims pursuant to Article 82 GDPR.

Estonia The process of amendment is well underway; and draft legislation (pdf) was published in November 2017. However, there do not seem to be plans for provisions relating to compensation or damages or Article 82 GDPR; neither the draft Bill, nor a prior report (pdf) prepared by the Ministry of Justice refer to compensation claims.

Finland The process of incorporation is at an advanced stage. A Working Group appointed by the Finnish Ministry of Justice published a report, which considers that Article 82 GDPR does not need national incorporation (see p62). A public consultation concluded on 15 September 2017, and a Bill was published on 1 March 2018. The explanatory memorandum refers to “liability for damages”, but the Bill does not make any provision for compensation claims; so it seems that the Government has accepted the view that Article 82 GDPR does not need national incorporation.

France LOI n° 2016-1321 du 7 octobre 2016 pour une République numérique (the Digital Republic Act), amends French law to incorporate various provisions of the GDPR, but does not provide a claim for compensation or damages. A Bill to complete the incorporation of the GDPR does not refer to compensation claims.

Germany There is no express provision for compensation or damages in the Gesetz zur Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680 (Datenschutz-Anpassungs- und -Umsetzungsgesetz EU – DSAnpUG-EU); (Gesetz vom 30 Juni 2017; Bundesgesetzblatt Teil I, 2097); official English translation: Act to Adapt Data Protection Law to Regulation (EU) 2016/679 and to Implement Directive (EU) 2016/680 (DSAnpUG-EU) (pdf, via here). The Government is working on consequential amendments to 
sector-specific legislation, and the 16 Länder are working on their implementations.

Greece A consultation on a Bill on the Protection of Personal Data pursuant to Regulation (EU) 2016/679 closed on 5 March 2018. Article 67 of the Bill provides for compensation claims pursuant to Article 82 GDPR.

Hungary A draft Bill, Eloterjesztés az információs önrendelkezési jogról és az információszabadságról szóló 2011. évi CXII. törvény jogharmonizációs célú módosításáról, to amend existing legislation to incorporate the GDPR was released at the end of August (a zip folder may be downloaded via here). Article 9 of the draft Bill adds, inter alia, a new Article 24 to the existing legislation. This new Article 24 expressly provides for a claim for compensation. Submission of the draft to Parliament is expected in Spring 2018.

Italy The Chamber of Deputies approved an omnibus European delegation law 2016-2017 (C.4620), Article 13 of which delegates to the Government the power to adopt legislative decrees to incorporate the GDPR. However, Article 13 is too general to refer specifically to compensation or damages or Article 82 GDPR; the detailed legislative decree has not yet been published; and there is real concern in Brussels that Italy will not finalise changes to its privacy rules util after the May deadline.

Ireland Section 115(4)(b) of the Data Protection Bill 2018 (pdf) contains an express claim for compensation. The progress of the Bill can be monitored here.

Latvia A Bill on Personal Data Processing was approved by Government on 6 March 2018, but has not yet been considered by Parliament. It does not refer to compensation or damages or Article 82 GDPR.

Lithuania The draft Bill published on 15 February 2018 does not refer to compensation or damages or Article 82 GDPR.

Luxembourg There are two Bills; the first concentrates on authorisation regimes, and the second strengthens the powers of the National Data Protection Commission; but neither includes a provision relating to compensation.

Malta Work has commenced, but there is no draft legislation yet.

Netherlands The revised draft Bill does not includes provision relating to compensation, even though Article 36 of the previous draft did. The Ministry of Justice GDPR Manual (pdf, via here) mentions claims for compensation for breach of the GDPR (see section 9.6.4), and refers to Articles 79 to 82 GDPR, but does not expressly locate the source of the claim in either the Dutch Bill or the GDPR. On 13 March, the revised Bill was approved by the House of Representatives (pdf); and, on 15 May, the Senate will adopt the Bill without a vote, passing it into law.

Poland Following the recent publication of results of a consultation, the government has published a revised draft bill (pdf via here), Articles 89 and 90 of which provide for a claim to compensation. The Bill has been enacted by Parliament.

Portugal The Government has published a Bill (pdf), in which Article 35 assumes that Article 82 GDPR is directly effective.

Romania The Government presented a Bill to the Chamber of Deputies on 3 April 2018. The earlier draft (pdf; via here) deals with administrative issues, and Article 14.11(3) provides that, without prejudice to the right to file an administrative complaint, the data subject can claim compensation or damages.

Slovakia § 38 of the Act No. 18/2018 Coll on the protection of personal data provides for a claim to compensation.

Slovenia The draft Bill (pdf) of 4 April 2018 does not refer to compensation or damages or Article 82 GDPR.

Spain Article 30(2) of the draft Bill (pdf download) sent to Parliament by Government in November 2017 provides for a claim for compensation by reference to Article 82 GDPR.

Sweden Chapter 8 §1 of the draft Bill proposed in a Report for the Ministry of Justice (pdf) (pp25, 48, 274-278, 302-304, 384, 401) includes compensation claims that refer to Article 82 GDPR. Draft legislation was published on 8 February 2018, proposing to extend the Article 82 GDPR compensation claim to other areas of Swedish data protection laws beyond the GDPR (see pp149-152 (pdf) referring to pp146-148 (pdf) of an earlier document).

United Kingdom Clause 164 of the Data Protection Bill (pdf) (noted here) as amended in the Public Bill Committee of the House of Commons on 23 March 2018 provides for compensation for contravention of the GDPR, and it refers to Article 82 GDPR. The progress of the Bill can be monitored here. Gibraltar joined the EEC under the UK in 1973, and is thus part of the EU; however, its government and parliament are responsible for implementing EU law. It is likely to follow the UK lead in incorporating the GDPR; though no Bill has yet been published.

European Economic Area (EEA)
Since the GDPR is a text with EEA relevance, its incorporation into domestic law in Iceland, Liechtenstein and Norway is also relevant. It is currently under scrutiny by the EEA, and its member states are preparing the ground for a forthcoming EEA Joint Committee Decision. Meanwhile, the EU has proposed a draft Council Decision (pdf) on the position to be adopted by the EU within the Joint Committee on the issue.
Iceland The Persónuvernd [DPA] has produced a draft Icelandic translation of the GDPR; and the Government has announced long-expected legislation.
Liechtenstein  A Bill is expected in June 2018, with a view to adoption by the end of 2018.
Norway A draft Bill (pdf) has been published; the main part of the Bill will contain a clause to incorporate the GDPR generally, with a Norwegian translation (pdf) of the Regulation itself in an Appendix; other clauses of the Bill will provide additional detail; compensation claims pursuant to Article 82(1) GDPR (see section 27.2; p101) will be provided via the general incorporation and not in an additional specific clause.

Other countries
Other countries that have enacted data protection regimes modelled upon the Data Protection Directive, are likely to amend these regimes to come into line with the GDPR, not least to maintain their current EU adequacy decisions.
Jersey Although the Bailiwick of Jersey is a territory for which the UK is responsible, it is not a member of the UK but is instead a Dependency of the Crown. It is not a member of the EU, but it is a member of the EU Customs Union, and it has an adequacy decision in respect of its current data protection regime. It has now enacted two pieces of legislation (here and here) to incorporate the GDPR; and section 69 of the Data Protection (Jersey) Law 2018 provides for compensation claims.
Switzerland The Federal Council has adopted a Bill to align Swiss law with the GDPR. Article 28(2) (pdf) of the Bill provides that actions relating to the protection of personality are governed by Articles 28, 28a, and 28g-28l of the Swiss Civil Code; in turn, Article 28a(1)(3) (pdf) of the Code provides for a claim for damages for unlawful infringement of personality rights.

Similar trackers
The meetings of the EU Commission expert group on the GDPR and DPD are provided with updates on the state of play of GDPR incorporation in the Member States; the most recent was on 20 February 2018 (pdf).
Baker McKenzie GDPR – National Legislation Survey (January 2018) (pdf) (via here).
Latham & Watkins (Global Privacy & Security Compliance Law Blog) implementation tracker.
Bird & Bird GDPR Tracker.
The national reports on Linklaters’ Data Protected site.
Overview regarding the implementation of the GDPR across the EU by László Pók.
The Better Internet For Kids website is tracking the digital age of consent as each Member State incorporates Article 8(1) GDPR (and see also here).
Reed Smith via JD Supra (Jan 18).
A good context for these trackers is the DACBeechcroft report (pdf) on Personal Data under the General Data Protection Regulation.

* Note
I have had emails asking me why I refer to incorporation rather than implementation. Recital 8 GDPR provides that Member States may “incorporate elements of this Regulation into their national law” (emphasis added). Following that lead, in this post, I have described the process of giving further effect to the Regulation in national law as one of incorporation (to distinguish it form the potentially very different process of implementing or transposing a Directive).