CIPP/E: Certified Information Privacy Professional/EuropeDemo

By IAPP · Question Mode

QuestionQ37

Compliance with European Data Protection Law and Regulation

Assuming that multiple EVETFIT branches across several EU countries act as separate data controllers, and that each branch was responsible for mishandling Javier’s request, how can Javier proceed to seek compensation?

  • A He will have to sue the EVETFIT’s head office in France, where EVETFIT has its main establishment.
  • B He will be able to sue any one of the relevant EVETFIT branches, as each one may be held liable for the entire damage.
  • C He will have to sue each EVETFIT branch so that each branch provides proportionate compensation commensurate with its contribution to the damage or distress suffered by Javier.
  • D He will be able to apply to the European Data Protection Board in order to determine which particular EVETFIT branch is liable for damages, based on the decision that was made by the board.
Explanation

Under Article 82(4) GDPR, where multiple controllers are involved in the same processing and are responsible for damage, each controller may be held liable for the entire damage so that the data subject can obtain effective compensation. Any allocation between the branches is addressed through their right of recourse against one another under Article 82(5).

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!