What is the current status of GDPR incorporation in the EU’s 28 Member States? [Ongoing updates]

Last updated: 17 October 2017

GDPR incorporationHaving looked, in my previous post, at what Article 82(1) of the General Data Protection Regulation says and means in each of the EU’s 24 official languages, I’m interested in this post in the related question of the current status of incorporation* of the GDPR in each of the EU’s 28 Member States. I am interested in particular in whether provision has been made in any incorporating* legislation or draft for an express claim for compensation or damages to give effect to Article 82 GDPR. The list below is the current state of play so far as I have been able to find out. I would be grateful if you correct any errors and help me fill in the blanks – via the comments below, via email, or via the contact page on this blog – I would very grateful indeed.

It seems that incorporations* in various jurisdictions are taking differing positions on Article 82 GDPR. On the one hand, such express claims are included in legislation in Austria, in draft Bills in Hungary, the Netherlands, Poland, Romania, Slovakia, Spain, and the UK, and in a report in Sweden. On the other, no such express claims appear in legislation in Germany and France, in draft Bills in Belgium, Latvia, Lithuania, Luxembourg, and Slovenia, or in reports in Denmark, Estonia, and Finland. The Czech Republic considers that the existing compensation provisions cover Article 82 GDPR. Somewhere in the middle comes Ireland.

Austria §29(1) of the Bundesgesetz, mit dem das Datenschutzgesetz 2000 geändert wird (Datenschutz-Anpassungsgesetz 2018) (Bundesgesetzblatt I Nr. 120/2017 Teil I) provides for a claim to compensation, which seems to be modelled on, and which directly refers to, Article 82 GDPR.

Belgium The draft Bill (pdf) does not provide for a claim to compensation, but the explanatory notes refer to Article 82 GDPR and imply that it can be relied upon directly in Belgian courts (pp14-15).

Bulgaria A Bill is not expected before September 2017.

Croatia Draft legislation is expected in the third quarter of 2017.

Cyprus No information so far.

Czech Republic The current draft Bills (here and here) will amend existing legislation (Act No 101/2000 Coll on the Protection of Personal Data) to incorporate the GDPR. Neither Bill refers to compensation or damages or Article 82 GDPR. Indeed, the explanatory note to the second Bill (fourth .doc download here), discussing changes to domestic civil procedures to accommodate Article 80 GDPR (pp48-49), suggests that claims for compensation or damages will be dealt with by existing civil law; and a concordance prepared by the Office for Personal Data Protection, suggests that such claims will continue to be dealt with by sections 21, 25 and 26 of the 2000 Act, which will not have to be amended to come into line with Article 82 GDPR.

Denmark The Ministry of Justice has published a comprehensive Report on the Data Protection Regulation (vol 1; pdf) (vol 2; pdf). It contains a thorough analysis of Article 82 GDPR and corresponding Danish law (see pp898-918), but it does not recommend any specific incorporation provision, observing instead that it “is assumed that the Member States’ discretion to set their own rules on liability in the personal data area … is limited to some extent as some of those rules now follow directly from Article 82 of the Regulation” (p918).

Estonia The process of amendment is well underway; but there do not seem to be plans for provisions relating to compensation or damages or Article 82 GDPR; in particular, a report (pdf) on a new legal framework for the protection of personal data prepared by the Ministry of Justice does not refer to compensation claims.

Finland The Working Group appointed by the Finnish Ministry of Justice has published a report, which considers that Article 82 GDPR does not need national incorporation (see p62). Draft legislation will be submitted to Parliament in Autumn 2017 or during early Spring 2018.

France LOI n° 2016-1321 du 7 octobre 2016 pour une République numérique (the Digital Republic Act), amends French law to implement various provisions of the GDPR, but does not provide a claim for compensation or damages. The Commission Nationale de l’Informatique et des Libertés suggests that further legislation is required (see CNIL Rapport d’activité 2016 (pdf) p23), but does not refer to compensation or damages or Article 82 GDPR. An implementation report has been approved by French National Assembly, and draft legislation is due by December 2017.

Germany There is no express provision for compensation or damages in the Gesetz zur Anpassung des Datenschutzrechts an die Verordnung (EU) 2016/679 und zur Umsetzung der Richtlinie (EU) 2016/680 (Datenschutz-Anpassungs- und -Umsetzungsgesetz EU – DSAnpUG-EU); (Gesetz vom 30 Juni 2017; Bundesgesetzblatt Teil I, 2097); official English translation: Act to Adapt Data Protection Law to Regulation (EU) 2016/679 and to Implement Directive (EU) 2016/680 (DSAnpUG-EU) (pdf, via here).

Greece Work has commenced, but there is no draft legislation yet.

Hungary A draft Bill, Eloterjesztés az információs önrendelkezési jogról és az információszabadságról szóló 2011. évi CXII. törvény jogharmonizációs célú módosításáról, to amend existing legislation to incorporate the GDPR was released at the end of August (a zip folder may be downloaded via here). Article 9 of the draft Bill adds, inter alia, a new Article 24 to the existing legislation. This new Article 24 expressly provides for a claim for compensation. The Bill will be submitted to the Hungarian Parliament in October, with a view to passing the legislation in December.

Italy The legislative process has formally commenced, but there is no draft legislation yet.

Ireland The Government has published a draft General Scheme of a Data Protection Bill 2017. Head 91 seeks to provide an effective judicial remedy for data breaches, and assumes a claim for compensation. I think that it is unclear whether the current draft effectively incorporates Article 82 GDPR.

Latvia The current draft Bill does not refer to compensation or damages or Article 82 GDPR.

Lithuania The current draft Bill does not refer to compensation or damages or Article 82 GDPR.

Luxembourg There are two Bills; the first concentrates on authorisation regimes, and the second strengthens the powers of the National Data Protection Commission; but neither includes a provision relating to compensation.

Malta No information so far.

Netherlands Article 36 of the current draft Bill provides for a claim for compensation. The draft bill went through public consultation and was sent for advice to the Council of State, and a revised draft is expected in late 2017.

Poland Articles 78 and 79 of the current draft Bill (pdf) provide for a claim to compensation; that Bill is open for consultation until 13 October 2017.

Portugal No information so far.

Romania The current draft Bill (pdf; via here) deals with administrative issues, and Article 14.11(3) provides that, without prejudice to the right to file an administrative complaint, the data subject can claim compensation or damages.

Slovakia A consultation process on draft legislation has begun; it seems that § 39 of the Draft Bill [available as the 12th .doc here; helpfully reposted .pdf here] provides for a claim to compensation.

Slovenia The current draft Bill (pdf) does not refer to compensation or damages or Article 82 GDPR.

Spain Article 32(2) of the current draft Bill (pdf download) provides for a claim for compensation by reference to Article 82 GDPR. The Plenum of the General Council of the Judiciary unanimously approved the draft.

Sweden Chapter 8 §1 of the draft Bill proposed in a recent Report for the Ministry of Justice (pdf) (pp25, 48, 274-278, 302-304, 384, 401) includes compensation claims that refer to Article 82 GDPR; and draft legislation is expected in late 2017.

United Kingdom Clause 159 of the Data Protection Bill 2017 (noted here) provides for compensation for contravention of the GDPR, and it refers to Article 82 GDPR. Gibraltar joined the EEC under the UK in 1973, and is thus part of the EU; however, its government and parliament are responsible for implementing EU law; and it is likely to follow the UK lead in implementing the GDPR.

European Economic Area (EEA)
Since the GDPR is a text with EEA relevance, its incorporation into domestic law in Iceland, Liechtenstein and Norway is also relevant.
Iceland The Persónuvernd [DPA] has produced a draft Icelandic translation of the GDPR, and the Government expects legislation in the Spring of 2018, but no further details are available.
Liechtenstein No information so far.
Norway A draft Bill (pdf) has been published; the main part of the Bill will contain a clause to incorporate the GDPR generally, with a Norwegian translation (pdf) of the Regulation itself in an Appendix; other clauses of the Bill will provide additional detail; compensation claims pursuant to Article 82(1) GDPR (see section 27.2; p101) will be provided via the general incorporation and not in an additional specific clause.

Third countries
Other countries that have enacted data protection regimes modelled upon the Data Protection Directive, are likely to amend these regimes to come into line with the GDPR, not least to maintain their current EU adequacy decisions.
Switzerland The Federal Council has adopted a Bill to align Swiss law with the GDPR. Article 28(2) (pdf) of the Bill provides that actions relating to the protection of personality are governed by Articles 28, 28a, and 28g-28l of the Swiss Civil Code; in turn, Article 28a(1)(3) (pdf) of the Code provides for a claim for damages for unlawful infringement of personality rights.

Other similar trackers
Baker McKenzie GDPR – National Legislation Survey (May 2017) (pdf) (via here); updated here.
Global Privacy & Security Compliance Law Blog GDPR implementation tracker (pdf) (via here).
Bird & Bird GDPR Tracker.
Overview regarding the implementation of the GDPR across the EU by László Pók.
The Better Internet For Kids website is tracking the digital age of consent as each Member State incorporates Article 8(1) GDPR.

* Note
I have had emails asking me why I refer to incorporation rather than implementation. Recital 8 GDPR provides that Member States may “incorporate elements of this Regulation into their national law” (emphasis added). Following that lead, in this post, I have described the process of giving further effect to the Regulation in national law as one of incorporation (to distinguish it form the potentially very different process of implementing or transposing a Directive).

6 Comments

Add a Comment

Your email address will not be published. Required fields are marked *