You can access the official legal text of GDPR Article 83 via the European Union’s legal database at eur-lex.europa.eu
Article 83(8)
“The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process.”
“Exercise by the supervisory authority”
refers to the use of enforcement powers—especially the imposition of fines—by national data protection authorities (DPAs), such as the CNIL in France.
If a UK-based company processes data of EU residents, it may be subject to:
- UK GDPR (via the ICO)
- EU GDPR (via an EU supervisory authority)
“Subject to appropriate procedural safeguards”
means authorities must follow fair procedures, including:
- Notifying the organization of the alleged violation
- Giving the organization a chance to respond
- Providing access to evidence
- Ensuring impartial decision-making
“In accordance with Union and Member State law”
ensures that enforcement respects both:
- EU-level legal standards (e.g., Charter of Fundamental Rights)
- National procedural rules (e.g., administrative law in Germany or France)
“Effective judicial remedy and due process”
means organizations have the right to:
- Challenge fines in court
- Appeal decisions by supervisory authorities
- Access legal representation and a fair hearing
Article 83(9)
“Where the legal system of the Member State does not provide for administrative fines…”
This clause acknowledges that not all EU Member States allow their data protection authorities (DPAs) to directly impose fines. In some countries, only courts have the legal power to issue financial penalties.
Clause 1: Alternative Enforcement via Courts
- The DPA initiates the fine (e.g., proposes or recommends it)
- The national court formally imposes the fine
This ensures that GDPR enforcement is still possible, even if the DPA lacks direct sanctioning power.
Example: In Germany, the Federal Data Protection Act (BDSG) allows DPAs to impose fines directly. But in other jurisdictions, like Austria, courts may play a more active role in finalizing penalties.
Clause 2: Effectiveness Standard
This echoes Article 83(1) and reinforces that:
- Fines must enforce compliance (effective)
- Match the severity of the violation (proportionate)
- Deter future violations (dissuasive)
Even if fines are imposed by courts rather than DPAs, they must meet these standards.
Clause 3: Notification to the Commission
Member States had to report their national procedures for enforcing GDPR fines to the European Commission.
Leave a Reply