What Should I Do If My Data Has Been Processed in Violation of the SCCs? Can I Obtain Compensation? Where Can I File a Complaint?

ANSWER

The SCCs provide various mechanisms for enforcing rights against both the data exporter and the data importer.

Although the data subject is not a party to the SCCs, the SCCs allow data subjects to directly enforce those clauses that provide safeguards for personal data protection. In such cases, the data subject acts as a third-party beneficiary (see Clause 3 of the SCCs).

First, you may file a complaint directly with the data importer

The data importer must designate a specific contact point for handling complaints (see Clause 11(a) of the SCCs).

If the data importer has established a mechanism for complaints to be reviewed by an independent dispute resolution body, you may also submit your complaint to that body.

Second, you may lodge a complaint with a supervisory authority in the EEA country where you reside

You may file a complaint against the data importer if you believe it has acted in breach of the SCCs (see Clause 11(c) of the SCCs).

You may also file a complaint against the data exporter if you believe it has processed personal data unlawfully (see Article 77 GDPR).

Third, you may bring legal proceedings against the parties to the SCCs

For example, you may seek:

• injunctive relief; or
• compensation for damages.

The parties to the SCCs are liable for any material or non-material damage suffered by a person as a result of a breach of those SCC provisions that provide safeguards for personal data processing or grant specific rights to individuals (see Clause 12 of the SCCs).

Legal proceedings may be brought before:

• the competent court in the EEA country where the individual resides (in accordance with national law); or
• the courts in the EEA designated by the parties in the SCCs (see Clause 18(b) and (c) of the SCCs).

Special rules for Module 4

Special rules apply where the data was transferred by a service provider in the EEA acting on behalf of an entity outside the EEA.

In such cases, you may:

• submit a complaint directly to the data importer (i.e., the controller established outside the EEA);
• where available, submit a complaint to an independent dispute resolution body (see Module 4, Clause 11);
• contact the EEA-based data exporter, which must cooperate with the data importer in handling the complaint (see Module 4, Clause 10).

You may also initiate legal proceedings against the parties to obtain injunctive relief or compensation (see Module 4, Clause 18 together with Clause 3). Such proceedings may be brought before the courts designated by the parties in the SCCs.

Compensation under the GDPR

It should be noted that the compensation mechanisms described above apply only to rights granted under the SCCs themselves.

Independently of the SCCs, data subjects may also seek compensation under the GDPR from the data exporter.

Individuals always retain the right to:

• lodge a complaint with a national supervisory authority (Article 77 GDPR); and
• obtain an effective judicial remedy (Article 79 GDPR)

in relation to the processing of their personal data by the data exporter.