#walrees

[thu-0845-lc-blog]

8:45 - DATA PROTECTION HARMS IN PRIVATE LAW: LEVELLING THE PLAYING FIELD FOR DATA SUBJECTS?

Organised by Radboud University, Nijmegen

Academic *** Policy * Business **

Chair Stefano Leucci, NEXA center for Internet and Society (IT) Moderator Mireille Hildebrandt, VUB (BE) Speakers Valerie Lyons, BH Consulting, Dublin (IE); Tim Walree, Radboud University, Nijmegen (NL); Pieter Wolters, Radboud University, Nijmegen (NL); Claudia Quelle, Tilburg University (NL)

This panel discussion will focus on the issues around the notion of private law liability (injunctions and/or compensation) with regard to data protection violations. Next to enforcement by Data Protection Supervisors, private law enforcement may become an essential mechanism for safeguarding data protection. However, rarely data subjects initiate a procedure against a data controller or processor for breaching rules of data protection law. Litigating can take long, procedural costs can be high and gathering of evidence can be problematic. Harmed data subjects may therefore be reluctant to bring a case before court. If data subjects nevertheless decide to start a procedure, they will in principle bear the burden of proof that harm is caused, raising the question of what constitutes a data protection harm, as tort law requires a concrete (material or immaterial) harm. Furthermore, a violation of data protection law, and causality between such violation and the harm, must be established. This may be burdensome, given the complexity of data processing operations as well as the continuously increasing amount of organisations that process personal data, even if harm can be proven. In light of these constraints, this panel will discuss tort law's potential contribution to a level playing field between data subjects and data controllers and processors.

What should constitute a data protection harm?

How should courts deal with the issue of causality (e.g. reversal of the burden of proof, loss of chance, proportional liability)?  

What solutions does and/or should the GDPR offer to the unequal playing field? Which solutions are offered by national regimes of tort law?