Data Protection and European Private International Law

Abstract

The objective of this working paper is to point out actual and potential obstacles to effective protection of the fundamental right to data protection, created by rules on jurisdiction and applicable law, and to put forward solutions for removing those obstacles with regard to data protection. More precisely, the working paper first elaborates on categories of litigation in the field of data protection in order to identify potential claimants, defendants and competent administrative and judicial authorities that may decide on those remedies. Furthermore, building upon these categories of litigation, the working paper seeks to determine jurisdictional issues regarding data protection litigation within the EU, elaborating concretely on potential competent courts in case a data subject wants to file a private enforcement claim against a controller processing his personal data. Finally, the working paper addresses issues of applicable law in data protection litigation, dealing with questions such as the possibility of agreements on applicable law, the questions of applicable law if the controller is situated within the EU and the questions of extraterritorial application of EU data protection law if the controller is established outside of the EU. The working paper concludes with final remarks on the above issues.

Keywords: Data protection, private international law, jurisdiction, applicable law, extraterritoriality