Representative body conditions

It is not-for-profit, constituted under Member State law, has public-interest statutory objectives, and is active in personal-data protection.

An actor referred to in these recitals as potentially responsible for processing, compensation, compliance, and proceedings.

What is data subject?

The natural person whose personal data are processed.

Remedies, Sanctions, and Context-Specific Reconciliation — The General Data Protection Regulation: A Section-by-Section Deep Dive into Regulation (EU) 2016/679

Q: A natural person commits a minor GDPR infringement, and the likely fine would create a disproportionate burden. Which outcome does Recital (148) describe?

A reprimand may be issued instead of a fine.. Recital (148) says that, in a case of a minor infringement or where the likely fine would be a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. It does not erase the infringement or mandate criminal punishment.

Map of the Framework: Enforcement and Reconciliation

What these recitals do

Recitals (141) to (165) link individual enforcement with context-specific reconciliation: complaints, courts, compensation, sanctions, expression, employment, research, statistics, secrecy, and churches.

Do not upgrade the language

These are recitals. Preserve their wording: should, may, and should be able to are not automatically rewritten as shall.

Enforcement pathway

A practical sequence is complaint, investigation, judicial remedy, compensation, and penalties. The later recitals explain how protection coexists with other public and social functions.

Currency note

Regulation (EU) 2025/2518 is in force but applies from April 2, 2027. It adds cross-border enforcement procedure; it does not replace these GDPR recitals.

Recital (141): Complaints, Investigation, and Information

One supervisory authority

Recital (141): Every data subject should have the right to lodge a complaint with a single supervisory authority, particularly in the Member State of habitual residence.

When court protection matters

The recital addresses alleged GDPR-rights infringements and authority inaction, rejection, dismissal, or failure to act where protection of rights requires action.

Investigation is case-sensitive

An investigation should occur, subject to judicial review, to the extent that is appropriate in the specific case. That qualifier prevents a one-size-fits-all reading.

Keep the complainant informed

The authority should communicate progress and outcome within a reasonable period, with intermediate information where more investigation or inter-authority coordination is needed.

Accessible submission

Authorities should facilitate complaints, for example through electronic forms, without excluding other communication methods.

Recitals (142) to (145): Representation, Courts, and Jurisdiction

Who may represent a data subject?

A mandated body must be not-for-profit, constituted under Member State law, pursue public-interest statutory objectives, and be active in personal-data protection.

Mandate versus independent action

Member State law may permit independent complaints and judicial remedies by such bodies. But compensation cannot be claimed independently of the data subject's mandate.

Board decisions: two deadlines

A concerned authority has two months from notification to challenge a Board decision. A directly and individually concerned controller, processor, or complainant has two months from publication.

National court review

A legally binding authority decision can be challenged before the national court where that authority is established. Non-binding opinions or advice are not included.

Related proceedings

Closely connected cases in different Member States may be stayed or consolidated through the first-seized court where the recital's conditions are met, avoiding irreconcilable judgments.

Quiz: Complaint and Representation Routes

Choose the answer that most precisely follows Recitals (141) and (142).

Which statement is most accurate under these recitals?

A not-for-profit body may always claim compensation for a data subject without that person's mandate.
A supervisory authority should offer only an electronic complaint form, because electronic submission replaces other channels.
A qualifying not-for-profit body may act on a data subject's behalf with a mandate, while independent compensation claims on the data subject's behalf may not be allowed.
Every supervisory-authority opinion automatically produces legal effects and therefore always has to be open to judicial review.

Show Answer

Answer: C) A qualifying not-for-profit body may act on a data subject's behalf with a mandate, while independent compensation claims on the data subject's behalf may not be allowed.

Recital (142) permits mandated representation by a qualifying not-for-profit body. A Member State may permit some independent complaint and judicial-remedy action, but the body may not be allowed to claim compensation independently of the data subject's mandate. Recital (141) says electronic forms should not exclude other communication methods, while Recital (143) excludes non-binding opinions and advice from the described judicial-remedy right.

Recitals (146) and (147): Compensation and Special Jurisdiction

Compensation and exemption

A controller or processor should compensate damage from infringing processing, but should be exempt if it proves it was not in any way responsible for that damage.

The compensation standard

Data subjects should receive full and effective compensation for the damage they have suffered. Damage should be broadly interpreted in light of Court of Justice case-law.

Same processing, several actors

Each involved controller or processor should be liable for entire damage. Apportionment in joined proceedings may occur only if full and effective compensation remains ensured.

Specific rules come first

Where the GDPR provides specific jurisdiction rules for remedies or compensation, general jurisdiction rules should not prejudice those GDPR-specific rules.

Recitals (148) to (152): Penalties and Administrative Fines

Default enforcement message

Recital (148): penalties including administrative fines should be imposed for any infringement of this Regulation, alongside or instead of appropriate supervisory measures.

A narrow reprimand option

For a minor infringement, or where a likely fine is a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.

Individualised assessment

Nature, gravity, duration, intent, mitigation, responsibility, past infringements, discovery, compliance, code adherence, and other factors should all receive due regard.

National forms, equivalent effect

Denmark and Estonia may use different procedural forms for fines if the effect is equivalent. In any event, fines should be effective, proportionate and dissuasive.

Criminal penalties and double punishment

Member States may establish criminal penalties, including profit deprivation, but criminal and administrative penalties must not breach ne bis in idem.

Quiz: Penalty Assessment

Apply the qualifiers in Recitals (148) to (152), rather than treating every infringement identically.

A natural person commits a minor GDPR infringement, and the likely fine would create a disproportionate burden. Which outcome does Recital (148) describe?

A reprimand may be issued instead of a fine.
No enforcement response is permitted.
A criminal penalty is mandatory in every Member State.
The supervisory authority must ignore the infringement because it is minor.

Show Answer

Answer: A) A reprimand may be issued instead of a fine.

Recital (148) says that, in a case of a minor infringement or where the likely fine would be a disproportionate burden to a natural person, a reprimand may be issued instead of a fine. It does not erase the infringement or mandate criminal punishment.

Recitals (153) to (155): Expression, Public Documents, and Employment

Reconciliation, not automatic priority

Member States law should reconcile expression and information, including journalistic, academic, artistic and or literary expression, with GDPR personal-data protection.

Necessary derogations

Solely journalistic, academic, artistic, or literary processing should receive exemptions or derogations from certain provisions if necessary for that reconciliation.

Broad journalism; applicable national law

Journalism should be interpreted broadly. If Member State exemptions differ, the law of the Member State to which the controller is subject should apply.

Official documents

Public disclosure of personal data in official documents should be possible where Union or Member State law provides for it and reconciles access and reuse with data protection.

The employment context

Member State law or collective agreements, including works agreements, may create specific rules for listed employment-processing contexts, from recruitment through termination.

Recitals (156) to (163): Archives, Research, and Statistics

Appropriate safeguards

Archives, scientific or historical research, and statistics should be subject to appropriate safeguards. Technical and organisational measures should ensure, in particular, data minimisation.

Consider less identifiable data

Further processing is to occur after assessing feasibility of using data that do not, or no longer, identify people, provided safeguards such as pseudonymisation exist.

Scientific research is broad

the processing of personal data for scientific research purposes should be interpreted in a broad manner, including technological development, demonstration, fundamental, applied, and privately funded research.

Archives and historical research

The GDPR should apply to archival and historical research processing, including genealogical research, while the recital notes that it should not apply to deceased persons.

Statistics produce aggregate output

the result of processing for statistical purposes is not personal data, but aggregate data. Neither results nor input personal data may support decisions about a particular person.

Thought Exercise: Identify the Safeguard or Boundary

Work through three short scenarios

Scenario 1: Health registry research

A university links hospital and population registries to study long-term cardiovascular outcomes. Before continuing, it assesses whether its objective can be achieved using data that no longer identify people. It plans pseudonymisation and technical access controls.

Which Recital (156) ideas are present?
Why does a large public-health benefit not remove the need for appropriate safeguards?

Scenario 2: Statistical dashboard

A national agency publishes regional unemployment rates by age band. It does not release names or individual records. A ministry then proposes using the underlying data to decide whether a named person will receive a benefit.

Which part fits the statistical-purpose idea?
Which proposed use conflicts with Recital (162)?

Scenario 3: Former-regime archives

A public archive with a legal duty to preserve records of enduring public value holds files relating to political conduct under a former totalitarian regime.

Which Recital (158) description of an archival body fits this institution?
What fact in the recital limits the GDPR's scope regarding deceased persons?

Self-check

For Scenario 1, name data minimisation, an assessment of less identifiable processing, and appropriate safeguards such as pseudonymisation. For Scenario 2, aggregate publication fits the stated statistical output; using results or personal data to make a decision about one named person does not. For Scenario 3, identify the legal obligation to preserve and provide access to records of enduring public interest, while remembering the recital's statement that the GDPR should not apply to deceased persons.

Flashcards: Enforcement and Reconciliation

Flip each card, then explain the qualifier as well as the main rule.

Complaint right in Recital (141): Every data subject should have the right to lodge a complaint with a single supervisory authority, particularly in the Member State of habitual residence.
Representative body conditions: It is not-for-profit, constituted under Member State law, has public-interest statutory objectives, and is active in personal-data protection.
Board annulment timing: A concerned supervisory authority has two months from notification. A directly and individually concerned controller, processor, or complainant has two months from publication on the Board website.
Compensation standard: Data subjects should receive full and effective compensation for the damage they have suffered.
Alternative to a fine: For a minor infringement, or where a likely fine is a disproportionate burden to a natural person, a reprimand may be issued instead of a fine.
Fine effectiveness formula: The fines imposed should be effective, proportionate and dissuasive.
Expression reconciliation: Member States law should reconcile freedom of expression and information, including journalistic, academic, artistic and or literary expression, with personal-data protection.
Research safeguard principle: Archiving, scientific or historical research, and statistical processing should be subject to appropriate safeguards for data-subject rights and freedoms.
Statistical output: The result of processing for statistical purposes is not personal data, but aggregate data; it must not support measures or decisions about a particular natural person.
Churches and religious communities: This Regulation respects and does not prejudice the status under existing constitutional law of churches and religious associations or communities in the Member States.

Key Terms

processor: An actor referred to in these recitals as potentially responsible for processing, compensation, compliance, and proceedings.
controller: An actor referred to in these recitals as potentially responsible for processing, compensation, compliance, and proceedings.
data subject: The natural person whose personal data are processed.
aggregate data: The non-personal-data result of statistical processing described in Recital (162).
ne bis in idem: The principle that must not be breached through criminal and administrative penalties, as interpreted by the Court of Justice.
works agreement: A collective agreement that may provide specific rules for processing employees' personal data in the employment context under Recital (155).
pseudonymisation: An example of an appropriate safeguard mentioned in Recital (156) when processing for archives, research, or statistics.
data minimisation: A principle that Recital (156) says safeguards should ensure in particular through technical and organisational measures.
full jurisdiction: The national court's jurisdiction to examine all questions of fact and law relevant to the dispute before it.
preliminary ruling: An interpretation or validity question referred by a national court to the Court of Justice under Article 267 TFEU in the circumstances described in Recital (143).
action for annulment: A challenge to a Board decision before the Court of Justice under Article 263 TFEU, subject to the conditions and two-month periods described in Recital (143).
professional secrecy: A secrecy obligation for which Member States may adopt specific rules, within GDPR limits, where necessary to reconcile it with personal-data protection.
supervisory authority: The authority referred to in these recitals as receiving complaints, investigating, using powers, and in appropriate cases imposing administrative fines.
European Data Protection Board: The Board whose decisions may be challenged through an action for annulment under the conditions described in Recital (143).