Sadržaj/Table of Contents
Right to File a Complaint with the Commissioner
Article 82
Data subjects have the right to file a complaint with the Commissioner if he/she considers that the processing of personal data relating to them has been carried out contrary to the provisions of this Law. Provisions of the law regulating inspection supervision in the part thereof relating to actions upon complaints apply mutatis mutandis in the proceedings initiated upon complaints. Filing a complaint with the Commissioner is without prejudice to the right of such person to initiate other administrative or judicial remedial proceedings.
The Commissioner is obliged to inform the complainant about the course of the proceedings that he/she conducts, on the outcomes of the proceedings, as well as of the right of such person to initiate a court proceeding in compliance with Article 83 of this Law.
Right to Judicial Protection against a Decision of the Commissioner
Article 83
Data subjects, controllers, processors and/or other natural or legal persons have the right to initiate an administrative dispute against decisions of the Commissioner concerning them which are passed in compliance with this Law, within 30 days from the date of receipt of such decision. Filing of an action in an administrative dispute is without prejudice to the right to initiate other administrative or judicial redress procedures. If the Commissioner fails to act within 60 days of filing a complaint or fails to comply with Article 82, paragraph 2 of this Law, the data subject has the right to initiate an administrative dispute.
Judicial Redress
Article 84
Data subjects have the right to judicial redress if they consider that their rights under this Law have been infringed due to the processing of their personal data by a controller or a processor in non-compliance with this Law. Filing of an action to a court is without prejudice to the right of such person to initiate other administrative or judicial redress procedures.
In an action for the protection of rights referred to in paragraph 1 of this Article, a request can be made to the court to put the defendant under legal obligation of:
1) provision of information referred to in Articles 22 through 27, Articles 33 through 35 and Article 37 of this Law;
2) rectification and/or erasure of data on the plaintiff referred to in Articles 29, 30 and 32 of this Law;
3) restriction of processing referred to in Articles 31 and 32 of this Law;
4) provision of data in a structured, commonly used and machine-readable form;
5) transmission of data to another controller referred to in Article 36 of this Law;
6) suspend processing of data referred to in Article 37 of this Law.
In an action for the protection of rights referred to in paragraph 1 of this Article, a request can additionally be made to the court to determine that the decision concerning the plaintiff has been passed contrary to Articles 38 and 39 of this Law.
The action referred to in paragraphs 2 and 3 of this Article shall be filed with a higher court in the territory of which the controller and/or the processor or their representative has their domicile, residence and/or seat or in the territory of which the data subject has the domicile or residence, except if the controller and/or the processor is a public authority.
A revision of a final decision passed upon the actions referred to in paragraphs 2 and 3 of this Article is always permitted.
In a judicial remedy procedure, the provisions of the law regulating civil proceedings apply unless this Law determines otherwise.
Representation of Data Subjects
Article 85
The data subject, relating to personal data protection, has the right to authorize a representative from an association active in protecting data subjects’ rights and freedoms to represent them, in accordance with the law, in the proceedings referred to in Articles 82 through 84 and Article 86 of this Law.
Right to Compensation for Damage
Article 86
Any person who has suffered material or non-material damage due to an infringement of the provisions of this Law has the right to receive monetary compensation for the damage from the controller and/or processor who caused it.
If the material or non-material damage is caused by unlawful processing carried out by the competent authorities for special purposes, and/or by infringement of the provisions of the law relating to the processing of such data, the person that has suffered damage has the right to compensation from the controller or another competent authority against which an action can be filed for compensation for damage, in compliance with the law.
The controller will be held liable for the damage referred to in paragraph 1 of this Article, and the processor will be held liable only if it has not complied with obligations prescribed by this Law that are specifically directed to them or if it has acted outside or contrary to instructions of the controller issued in compliance with this Law.
A controller and/or processor will be exempt from liability for damage if it proves that it is not in any way responsible for the event giving rise to the damage.
If more than one controller or processor, or both a controller and a processor, are involved in the same processing and if they are responsible for any damage caused by processing, each controller or processor will be held liable for the entire amount of compensation for damage.
If a controller and/or processor referred to in paragraph 5 of this Article has paid the entire amount of compensation for the damage suffered, they have the right to claim from the other controllers or processors the reimbursement of the portion of the amount corresponding to their part of the responsibility for the damage, in accordance with paragraph 3 of this Article.
Conditions for Imposing Fines
Article 87
Fines in respect of infringements of the provisions of this Law will, in each individual case, be imposed and applied in an effective, proportionate, and dissuasive manner.
The fines referred to in paragraph 1 of this Article, depending on the circumstances of each individual case, can be imposed in addition to the measures or instead of the measures provided for in Article 79, paragraph 2, items 1) through 8) and item 10) of this Law.
When deciding whether to impose a fine and deciding on the amount of the fine in each individual case, due regard must be given to:
1) the nature, gravity, and duration of the infringement of provisions of the law, taking into account the nature, scop,e and purpose of the processing concerned, as well as the number of data subjects affected and the level of damage suffered by them;
2) the existence of an intention or negligence of the offender;
3) any action taken by the controller or processor directed at eliminating or mitigating the damage suffered by data subjects;
4) the degree of responsibility of the controller or processor, taking into account the measures implemented by them in compliance with Article 42 and Article 50 of this Law;
5) previous cases of infringements of the provisions of this Law by the controller or processor which are of relevance for the imposition of fine;
6) the degree of cooperation by the controller and processor with the Commissioner in order to eliminate the consequences of the infringement of the law and eliminate or mitigate the adverse consequences of the infringement;
7) the types of personal data to which the violations relate;
8) the manner in which the infringement became known to the Commissioner, in particular whether, and if so, to what extent, the controller and/or processor notified the Commissioner of the infringement;
9) if corrective measures of the Commissioner in compliance with Article 79, paragraph 2 of this Law have previously been ordered against the controller and/or processor concerned regarding the same case of infringement;
10) adherence to approved codes of conduct in compliance with Article 59 of this Law, and/or the existence of certificates referred to in Article 61 of this Law;
11) any other aggravating or mitigating circumstances applicable to the case in question, such as financial losses avoided or benefits gained, directly or indirectly, from the infringement of the provisions of this Law.