EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
remains responsible unless it proves that it was not in any way responsible for the event giving rise to the damage. The exemption under Article 82 (3) therefore applies only where the controller demon - strates the absence of a causal link. • Right of access and scope of the “copy” obliga - tion (Article 15 GDPR) – in FT v DW (C-307/22, 26 October 2023), the CJEU strengthened the effec - tiveness of the right of access. It held that patients are entitled to obtain a first copy of their medical records free of charge, irrespective of the purpose of the request, including where the data is sought for potential litigation. National law cannot impose systematic fees for the first copy. The CJEU also clarified that the right to obtain a “copy” may require full reproduction of documents, including diagnoses and treatment details, where necessary to ensure intelligibility and effective exercise of rights. Taken together, these decisions have not revolution - ised EU privacy litigation but have consolidated a structured and increasingly predictable framework. This jurisprudence now provides national courts with a coherent template for adjudicating GDPR-based civil claims. 2.3 Collective Redress Mechanisms At EU level, collective redress in privacy and data pro - tection matters is structured around Article 80, GDPR and the Representative Actions Directive (RAD) (Direc - tive (EU) 2020/1828). Article 80, GDPR allows not-for-profit organisations representing data subjects to bring complaints and judicial remedies on their behalf. Member states may also permit such organisations to act without an indi - vidual mandate. This mechanism has enabled strate - gic litigation by consumer and privacy associations, particularly in cases involving large-scale tracking, platform practices and data breaches. The RAD, applicable since 25 June 2023, requires all member states to ensure the availability of representa - tive actions aimed at protecting the collective interests of consumers. It applies to infringements of a broad list of EU legislation set out in Annex I, including data protection rules.
Only designated “qualified entities” may bring repre - sentative actions under the RAD. These must gen - erally be non-profit organisations or public bodies pursuing consumer interests and satisfying independ - ence and transparency requirements, including safe - guards regarding third-party funding. For cross-border actions, designation criteria are harmonised and sub - ject to mutual recognition across member states. The RAD requires member states to provide for both injunctive measures and redress measures (including compensation), but it leaves significant procedural discretion at national level. In particular, member states may choose between opt-in or opt-out par - ticipation models, or adopt hybrid approaches, espe - cially for redress actions. As a result, the structure and practical reach of collective compensation vary across jurisdictions. Participation models (opt-in or opt-out) and the avail - ability of collective compensation therefore differ across member states. In practice, injunctions remain more common and procedurally straightforward than collective damages. Recent developments centre on the domestic implementation of the RAD and the gradual emergence of case law applying these new mechanisms, with some jurisdictions (notably the Netherlands and Germany) becoming more active fora for data-related collective litigation. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation At EU level, rules on non-personal data are shaped primarily by a set of “data economy” instruments to facilitate data circulation, access and market fairness, rather than solely protect privacy. The Free Flow of Non-Personal Data Regulation (Regulation (EU) 2018/1807) addresses barriers to the movement of non-personal data within the internal market by prohibiting member states from enforcing data localisation restrictions for non-personal data, allowing it to be stored or processed anywhere in the EU.
97 CHAMBERS.COM
Powered by FlippingBook