Liability of private parties for data protection breaches

Abstract

The applicable data protection law is based on the idea of protecting individuals from risks in connection with data processing. If no consequences are to be expected for the party responsible in the event of unlawful action, the mandatory character of the provisions will be rendered null and void. For this reason, both European law and German data protection law provide for legal remedies, liability and sanctions. Two trends can be identified in the amendment of data protection law and the drafting of the GDPR regarding the legal consequences: Penalties increase enormously and the individual whose rights have been violated is strengthened. The instruments for law enforcement have become more extensive, but from a private law point of view they have only grown gradually. The fine for administrative offences is and remains the classic sanction.