Law note · European Union
GDPR Articles 51-59, 68-76 and 77-84, Supervisory Authorities, Penalties and Remedies
Each Member State designates an independent supervisory authority (Article 51) with investigative and corrective powers, including orders and bans on processing (Article 58); cross border cases route through a lead authority under the one stop shop mechanism (Articles 56, 60-63), coordinated by the European Data Protection Board (Articles 68-76).
Article 83 sets administrative fines up to the higher of EUR 20,000,000 or 4 percent of global annual turnover for infringements of the core provisions, and up to the higher of EUR 10,000,000 or 2 percent for other provisions.
Article 82(1) arms a direct private right of action, letting any person who suffered material or non-material damage claim compensation from the controller or processor, though the Court of Justice held actual, if not necessarily serious, damage must be shown rather than the mere fact of infringement (UI v Osterreichische Post, Case C-300/21, 4 May 2023).
Article 80 lets a not for profit body pursue a complaint or judicial remedy on a data subject's behalf, reinforced by the Representative Actions Directive (EU) 2020/1828 for collective consumer redress. The Dutch, Greek, French and Italian authorities' Clearview AI fines (Netherlands EUR 30.5 million, decision dated 16 May 2024) illustrate Article 83 penalties applied to biometric data drawn from public sources.
What it asks of an app
- Expect an EU supervisory authority to have jurisdiction and fining power, up to the higher of EUR 20,000,000 or 4 percent of global annual turnover, over your processing of EU personal data.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
CJEU Case C-300/21