Representation of data subjects
General Data Protection Regulation · UE 2016/679
Representation of data subjects
1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.
2. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
In Luxembourg, the authority competent to receive complaints under Article 80 is the CNPD. The law of 1 August 2018 organising the CNPD frames the complaint procedure, but the Luxembourg legislator did not activate the Article 80(2) option allowing associations to act without a data subject's mandate. In practice, an association must therefore hold a valid mandate to seise the CNPD in Luxembourg, which does not reduce the risk of EU-wide coordinated actions targeting the same processing.
Luxgap practice: even without local mandate-free action, a noyb campaign targeting a standard processing activity (cookies, US transfers) exposes you via other Member States' authorities and the EDPB cooperation mechanism; map your cross-border exposure, not only your Luxembourg footprint.
