Summary

Personal data protection has become a natural part of our lives. In addition to state institutions, businesses, including large corporations with global reach, are also increasingly processing personal data. All of this has raised a question on how and to what extent it is possible at all for data subjects to effectively protect their rights given such a development.

On 25 May 2018, the new General Data Protection Regulation will enter into force. An important goal of the GDPR is to give data subjects better control over their personal data. This means inter alia that data subjects must have the possibility to use efficient legal remedies in case their rights are violated. This article introduces and analyses the three legal remedies set out in the GDPR: complaint with a supervisory authority, complaint with an administrative court, and a claim for damages. The article compares the regulation of legal remedies in the GDPR with the previous rules, highlights the more important changes and marks the possible bottlenecks of the new set of rules. In addition, it assesses whether the regulation of legal remedies in the new GDPR helps the data subjects to protect their rights in a more efficient manner.