Legal safeguards for personal data protection and privacy in the digital age

Human beings have always been an end in themselves: they are the raison d’être of States and of national and international society.¹

1. Universal Declaration of Human Rights. ↩

Fundamental rights are the highest principles of any legal system. States must set out and establish the conditions and the necessary framework for the recognition and effective enjoyment of these rights in any space or territory where human beings are active or present.

The law must always be an effective means for treating human beings as an end in themselves. All persons, both governors and governed, and in all contexts, whether physical or virtual, must pursue their full realization.

As far as the Human Rights Council is concerned, the United Nations High Commissioner for Human Rights has already recognized that the right to privacy is an expression of human dignity and is linked to the protection of autonomy and personal identity.²

2. A/HRC/48/31, para. 7. ↩

The Global Privacy Assembly has recognized that the rights to privacy and data protection buttress democratic processes. It has also observed that robust data protection laws place a reasonable limit on various negative situations, such as intrusive government influence on private life, undue external influence, data profiling, automated decisions and discrimination, which technologies such as artificial intelligence can amplify.³

3. See https://globalprivacyassembly.org/wp-content/uploads/2019/10/Resolution-on-privacy-as-a-fundamental-human-right-2019-FINAL-EN.pdf. ↩

The Joint Statement on Privacy and Democratic Rights, signed by the Office of the Privacy Commissioner of Canada and the Special Rapporteur on the right to privacy,⁴ recognizes that the rights to privacy and personal data protection specifically and mutually support equality and democratic values and provide a guarantee for the respect of other fundamental rights and freedoms.

4. See https://priv.gc.ca/en/opc-news/speeches/2023/js-dc_20231208/. ↩

The digital age, regardless of the great benefits it brings for the development of humanity, must not diminish the rights and dignity of human beings.

At the 45th session of the Global Privacy Assembly, held in 2023, privacy authorities recognized that developments in technology, innovation and digitalization lead to new activities and business models which increasingly rely on processing of large volumes of personal data in new and progressively more complex ways.⁵ They also noted that the exchange of data by States and individuals and various forms of data processing are increasing daily through the use of technologies whose capacities are growing exponentially and dynamically.

5. See https://globalprivacyassembly.org/wp-content/uploads/2023/10/3.-Resolution-Achieving-global-DP-standards.pdf. ↩

Privacy authorities also expressed concern that certain technological developments can pose new challenges for the implementation of data protection and privacy laws and can cause significant negative effects, such as discriminatory and biased outcomes for individuals, or affect their ability to exercise their data protection and privacy rights. This concern is particularly acute in relation to more intrusive processing of personal data, including sensitive data, especially those of children and vulnerable people.⁶

6. Ibid. ↩

In this context, data subjects find themselves in a position of defencelessness owing to their limited knowledge of the use that third parties make of information concerning them, since in practice they are unable to follow up on or monitor this use. This has repercussions for their ability to control their data – the essence of the fundamental right to personal data protection.

In principle, States have a direct positive role to play in ensuring that rights and freedoms do not lose their essential content in the course of activities carried out in various sectors and by individuals.

It is necessary for States to establish a system to safeguard the right to personal data protection so that data subjects are aware of the processing to which their personal data are subjected, can exercise proper control over their data and, in the event of a violation, can opt for a remedy with a view to the reparation or restitution of the right or compensation for the damage caused, as the case may be.

In the digital age, not only must State respect and refrain from violating the rights to privacy and data protection, but their obligations also include positive measures to promote the effective enjoyment of these rights.⁷

7. A/HRC/39/29, para. 23. ↩

The mere recognition of a legal standard on the right to personal data protection does not guarantee the effectiveness or enjoyment of that right without the existence of an accessible and effective protection system. Such protection systems are usually composed of a set of administrative and judicial remedies and, in some cases, alternative means of dispute resolution.

To safeguard their dignity, human beings must have sufficient means and mechanisms at their disposal to be able to assert their rights before those responsible for processing their personal data and various governmental bodies. The effectiveness of these rights is directly related to the existence of instruments that ensure their exercise.

To achieve the stated goal, States should, among other measures, establish an appropriate legal and regulatory framework, including suitable laws and regulations.

As the member authorities of the Global Privacy Assembly have recognized, jurisdictions across the world are increasingly enacting new privacy and personal data protection laws, and reviewing older ones, often building on similar elements.⁸ It has also been noted that, given the variety of jurisdictions and legal systems, data protection and privacy laws differ in their approach and details, although they also present common traits.

8. See https://globalprivacyassembly.org/wp-content/uploads/2023/10/3.-Resolution-Achieving-global-DP-standards.pdf. ↩

This report contains an analysis of five data protection and privacy laws from five continents. The aim is to identify and compare the measures defined in each law so that data subjects can exercise control over the use of their data, be aware of the legal mechanisms available to them for the protection and restitution of their rights and, if necessary, seek reparation for damage caused by the improper use of information concerning them.

The analysis is structured so that each thematic point is accompanied by a comparative table on the content of the relevant laws.

The judicial institutions and their characteristics identified in the analysis are those established in the relevant data protection and privacy laws, without prejudice to the existence of other mechanisms that may be recognized in other bodies of law or provisions that do not form the basis of this report.

The continents, countries and laws chosen as the object of this study are:
Oceania: Australia
The Privacy Act 1988⁹
The Australian Privacy Principles (APPs)¹⁰
The Americas: Ecuador
Organic Act on Personal Data Protection¹¹
Europe: Spain¹²
Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data¹³
Organic Act No. 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights¹⁴
Asia: Singapore
The Personal Data Protection Act¹⁵
Africa: South Africa
Protection of Personal Information Act¹⁶

9. See https://www.legislation.gov.au/Details/C2023C00130. ↩
10. These are principles (and rights) that are annexed to and referenced in the Privacy Act of 1988. They are a cornerstone of personal data regulation in Australia. As the Principles have their own numbered articles, they are referenced in this analysis as a separate law. ↩
11. See https://www.consejodecomunicacion.gob.ec/wp-content/uploads/downloads/2021/07/lotaip/Ley%20Org%C3%A1nica%20de%20Protecci%C3%B3n%20de%20Datos%20Personales.pdf (in Spanish). ↩
12. In the case of Spain, two laws have been considered for the following reasons. Direct implementation of the European Union regulation, which has been in force since 25 May 2018, is mandatory in the countries of the European Union. Spain was thus required to draft a new Organic Act in order to adapt its legal system to the European regulation. As its preamble explains, the purpose of Organic Act No. 3/2018 is twofold: firstly, to adapt the Spanish legal system to the European Union regulation and to supplement its provisions, on the understanding that the fundamental right of natural persons to personal data protection must be exercised in accordance with the European Union regulation and the Act; and, secondly, to guarantee the digital rights of citizens. ↩
13. See https://www.boe.es/doue/2016/119/L00001-00088.pdf (in Spanish). ↩
14. See https://www.boe.es/eli/es/lo/2018/12/05/3/con (in Spanish). ↩
15. The Personal Data Protection Act of Singapore applies to the private sector and does not cover the processing of personal data in the public sector. See https://sso.agc.gov.sg/SL/PDPA2012-S63-2021?DocDate=20210930. ↩
16. See https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013popi.pdf. ↩

Processing of personal data must be carried out respectfully and in accordance with a series of principles and requirements, thus ensuring that it is done properly while guaranteeing privacy and the unhindered development of personality, among other rights.¹⁷

17. See A/77/196. ↩

To achieve this goal, data subjects must be able to exercise control over their personal information, which is why data protection and privacy laws grant them a number of rights.

The right to information is the right of all data subjects whose data have been collected to obtain from the data controller certain information about the context and circumstances of the processing.

All of the laws considered in this analysis provide for this right, as can be seen in the comparative table (table 1) below, with the exception of that of Singapore, which considers it an obligation of the data controller.¹⁸

18. Section 20 of the Personal Data Protection Act (“Notification of purpose”) provides that, before personal data are collected, used or disclosed, the controller must inform the individual of the purpose of doing so. It must also provide the contact information of an individual who is able to answer the data subject’s questions. ↩

The timeliness with which the information is provided, the amount of data disclosed and the medium and form used are all important for the effective enjoyment of this right.

The laws of Australia, Ecuador, South Africa and Spain make a distinction as to whether the data was collected directly from the subject or from another source. Likewise, in Australia and Spain, there is a difference in the information that is provided, depending on its source.

In Australia, Ecuador, South Africa and Spain, the law stipulates when such information must be provided. These laws, except that of Australia, distinguish between data collected from the subject (in which case, information must be provided prior to or at the time of collection) and data collected from another source (information must be provided as soon as possible, within one month, or at the time of the first communication, depending on the country).

In Ecuador and Spain, the law provides that the information must be provided to the data subject in clear and simple language. The data controller must take appropriate steps to provide the information to the data subject in a concise, transparent, intelligible and easily accessible form. Ecuadorian legislation specifies that the presentation of information must be clear, precise, unequivocal and without technical barriers.

In the countries analysed, the data controller generally must provide information on:
The purpose of the processing
The legal basis for the processing and the identity and contact information of the data controller
The existence of any data transfers or disclosures that it intends to make
The consequences for the data subject of submitting or refusing to submit personal data
The existence of rights and how to assert them
The right to file a complaint with the supervisory authority
The period of time for which the data will be retained

Under some countries’ legislation, information must be provided on aspects such as the possibility of withdrawing consent; the existence of automated decision-making, including profiling, and information about the logic involved; and categories of personal data.

By virtue of the right of access, data subjects can obtain from the data controller confirmation of whether their personal data is being processed and can gain access to such data and to certain information on how they have been used or disclosed. All of the laws considered in the analysis provide for this right.

In principle this right is exercised free of charge, although the laws of some countries (Australia, South Africa and Spain) mention that a reasonable fee may be charged in certain cases.

In Australia, access may not affect certain rights of third parties. In Spain, the right to obtain a copy of the personal data must not adversely affect the rights and freedoms of others.

Some laws establish exceptions to the right of access. This is the case in Singapore, when the provision of the information could cause grave harm to the safety or the physical or mental health of the data subject; in South Africa, when it might interfere with the Promotion of Access to Information Act; and in Australia, when it might prejudice law enforcement activities by an enforcement body.

By virtue of this right, data subjects may obtain the rectification of inaccurate or incomplete personal data so that it reflects their actual situation. The Australian and South African laws also refer to out-of-date, irrelevant or misleading data. All of the countries covered by the analysis provide for the right of rectification.

Data controllers must notify any corrections to all parties to whom the personal data has been disclosed, with certain exceptions.

Spanish legislation also provides for the right to rectification on the Internet, which includes a requirement for data controllers of social media and equivalent services to adopt appropriate protocols to allow the exercise of the right to rectification against users who disseminate content that violates the right to honour and personal and family privacy on the Internet. Controllers attending to requests for rectification must also publish a warning, in a visible place next to the original information, clarifying that the original news item does not reflect the individual’s current situation.

This right is foreseen only in Organic Act No. 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (Spain). It empowers any person to request controllers of digital media, on a justified basis, to include a warning of an update in a visible place next to a news item concerning him or her and which does not reflect his or her current situation due to circumstances that have arisen since publication, causing him or her prejudice. This right applies in particular to cases where the original information refers to police or judicial proceedings and the data subject has benefited from a subsequent judicial decision.

Data subjects have the right to have their personal data erased in certain circumstances. This right implies the obligation of the data controller to delete them.

The laws considered in the analysis provide for the deletion of data:
(a) When they have been unlawfully processed;
(b) When they have served the purpose for which they were collected or processed;
(c) When the retention period has ended;¹⁹
(d) When their processing undermines fundamental rights or individual liberties;²⁰
(e) When consent is withdrawn or has not been given for one or more specific purposes and there is no other legal ground for the processing;
(f) To comply with a legal obligation.

19. Australia, Ecuador, Singapore and South Africa. ↩
20. Ecuador. ↩

All of the countries envisage exceptions whereby the request for deletion should not be carried out, such as where processing is necessary for the establishment, exercise or defence of legal claims, for the exercise of the right to freedom of expression and information, for compliance with a legal obligation or for the performance of a task carried out in the public interest.

In Spain and South Africa, the data controller must communicate any deletion of personal data to each recipient to whom they have been disclosed, unless this proves impossible or would require a disproportionate effort.

Spain is the only country, of those analysed, whose law makes reference to the right to be forgotten, in connection with the right to deletion under Regulation (EU) No. 2016/679. Organic Act No. 3/2018 regulates the right to be forgotten in Internet searches and social media and equivalent services.

The right to be forgotten in Internet searches implies that, after a search is carried out based on a person’s name, search engines will remove from the list of results any published links that may contain data related to that person that is inappropriate, inaccurate, irrelevant, out of date or excessive, or has become so, or when the affected party invokes personal circumstances to justify the prevalence of his or her rights over the maintenance of the links by the Internet search service.

This right does not entail the deletion of the information, nor does it prevent users from gaining access to online information using search criteria other than the person’s name.

The right to be forgotten in social media and equivalent services is the right of individuals to obtain the deletion of any personal data they may have provided for publication on social media.

This right entails the erasure of the person’s data on the grounds that they are inappropriate, inaccurate, irrelevant, out of date or excessive or have become so due to the passage of time, or when the personal circumstances of the affected party justify the prevalence of his or her rights over the maintenance of the data.

In the event that the person exercising the right is doing so in relation to data provided when he or she was a minor, the service provider must delete the data without delay at the simple request of the data subject.

Of the countries analysed, only Ecuador and Spain have legislated to recognize this rights. In Ecuador it is called the “right to suspension of processing”.

By virtue of this right, data subjects can obtain from the data controller the restriction of processing of their personal information when any of the following conditions are met:
(a) The accuracy of the personal data is contested, for a period enabling the controller to verify their accuracy;
(b) The processing is unlawful and the data subject opposes the deletion of the personal data and requests the restriction of their use instead;
(c) The controller no longer needs the personal data, but they are required by the data subject for the establishment, exercise or defence of legal claims;
(d) The data subject has objected to the processing by virtue of the right to object, in Spain, or has objected to the processing of health-related data, in Ecuador; in both cases pending verification of whether the legitimate grounds of the controller override those of the data subject.

Where the processing of personal data has been restricted in accordance with this right, such data may, with the exception of storage, be processed only with the data subject’s consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person or for reasons of important public interest.

Data subjects have the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used and machine-readable format, and to transmit them to another controller, in certain cases.

They also have the right to have their data transmitted directly from one controller to another, where technically possible. Of the countries studied, this right has been established only in Ecuador and Spain.²¹ It is applicable where:
(a) The processing is based on consent;
(b) The processing is carried out by automated means;
(c) The processing based on a contract (in Spain);
(d) There is a significant volume of personal data or the processing is necessary for compliance with obligations and the exercise of rights by the data controller, processor or subject in the area of labour and social security law (in Ecuador).

21. In Singapore, the right to data portability does not yet exist. Section 48H (1) of the Personal Data Protection Act currently provides that if portability obligations are not respected within a reasonable time, data subjects may file a complaint with the Personal Data Protection Commission. Section 26H of the Personal Data Protection (Amendment) Act of 2 November 2020, which is not yet in force, would recognize this right. ↩

Spain also regulates the right to data portability in social media and equivalent services.

This right is established in all of the countries considered. Its purpose is to ensure that data are no longer processed if an objection is expressed. In Australia and South Africa the right is regulated specifically in the sphere of marketing.

Data subjects have the right to object, at any time, on grounds relating to their particular situation, to the processing of their personal data.

Some laws, including those of Spain and Ecuador, establish exceptional circumstances in which data controllers do not have to accede to the request in which the objection is raised, such as when the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

If the purpose of the processing is direct marketing, data subjects have the right to object at any time and their personal data must no longer be processed for such purposes (Australia, Ecuador, South Africa and Spain). The Ecuadorian and Spanish laws also cover profiling.

This right is regulated in Ecuador, South Africa and Spain.

All data subjects have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them, and to express their position.

The laws of Ecuador, South Africa and Spain provide for exceptions to this right, for example, if the decision is necessary for the conclusion or performance of a contract by the data subject or if it is authorized by an applicable law which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.

In Ecuador and South Africa, data subjects may request the controller to provide a reasoned explanation of the decision taken and information on the evaluation criteria of the automated program; they may also make observations. Ecuadorian law provides that data subjects cannot be required to relinquish this right in advance in standard form contracts.

In Ecuador, the law makes specific provision for children and adolescents, whose data may not be processed without the express authorization of their legal representative, unless the data subject is aged 15 years or older or the processing is intended to safeguard an essential public interest.

Of the countries considered, only Spain has a law that regulates this right, which allows data subjects to decide what will happen to content managed by information society service providers upon their death. Thus, they can decide whether their personal profiles on social media and equivalent services should be maintained or deleted and whether certain persons should be prevented from accessing their content or requesting its modification or deletion.

The laws of all five countries expressly recognize the various rights of data subjects. Some countries are moving forward by legislating to recognize new rights, such as those that are linked to automated and digitalized processing or are exercised online or on social media. This progress can also be seen from the more detailed express recognition of certain rights.

Data subjects exercise their rights vis-à-vis data controllers through procedures that are regulated by each legal system. Various aspects of these procedures are described below.

It is for the data controller or, where appropriate, the data processor, to attend to rights requests. The laws of Ecuador, South Africa and Spain refer to “the responsible party”. In Australia, the name used varies and encompasses a broader concept than that of data controller; reference is made to the “APP entity”, meaning a public-sector agency or private-sector organization. In Singapore, the law refers to an “organization”, which has competence for the processing of personal data only in the private sector.

In all of the countries analysed, the person authorized to exercise rights is the data subject. In some countries, the law provides expressly for the possibility of representation and, specifically, the representation of minors. Spain is the only country of those studied in which the law defines the medium of response, as can be seen in table 2.

All of the countries envisage different ways of responding to rights requests. In Australia and Spain, the law provides that if the data subject’s request is refused, he or she must be informed without delay of the reasons for the failure to act and of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy. In Singapore, the refusal must be based on legal grounds.

All of the laws examined, except that of Singapore, establish a time limit for the data controller to respond, which varies substantially from one country to the next. Indeed, this deadline ranges from the earliest possible moment to 10 days to one month. In the case of South Africa, with respect to the rights to correction and deletion, a response should be provided as soon as is reasonably practicable.

The laws of Australia, Ecuador and Spain provide that the exercise of rights vis-à-vis the data controller must be free of charge. However, the Australian and Spanish laws provide for the possibility of fees in certain cases. In South Africa, in respect of the right of access, fees for providing information are at the controller’s discretion, but must be reasonable.

All of the countries studied have regulated aspects of the procedure for the exercise of rights by the data subject before the data controller. Regulated aspects include the medium of response; whether or not a fee is charged for the procedure; the duty to inform the data subject, in the event of refusal of the rights request, of the possibility to file a complaint with an administrative or judicial authority; and the deadline for responding to requests.

Several of these aspects, as recognized in the text of the laws, are seemingly intended to better ensure the protection of rights.

Legal recognition of the rights of data subjects is only the first step towards achieving the effective protection of individuals and their rights and dignity.

Legal recognition alone is not enough, as these rights are often ignored, disregarded or not respected. The problem is exacerbated in cases that involve the use of emerging technologies such as artificial intelligence, which can have considerable adverse effects for individuals, both in the present and the future, bearing in mind that technological advances should not entail their losing control over information that concerns them.

If a right is infringed owing to a failure or refusal to protect it, the situation must be remedied as soon as possible. For this reason, it is necessary for States to establish a framework of administrative and judicial remedies that are accessible to affected persons, with the aim of ensuring the timely protection, reparation and restitution of rights.

The laws of Australia, Ecuador, Singapore, South Africa and Spain establish an administrative supervisory authority in the area of data protection and privacy.

Data subjects may turn to this administrative authority in the event that the controller fails or refuses to protect their rights. In this way, the State affords the necessary protection.

Countries have different names for the supervisory authorities and the actions that may be brought before them.

In Australia, complaints are brought before the Privacy Commissioner.

In Ecuador, administrative complaints are filed with the Personal Data Protection Authority.

In South Africa, complaints must be submitted to the Information Regulator.

In Singapore, the procedure is to apply for a review by the Personal Data Protection Commission.

In Spain, complaints must be filed with the Spanish Data Protection Agency, although autonomous regional authorities may take action in certain cases.²⁷

27. Organic Act No. 3/2018, art. 57. ↩

In terms of standing,²⁸ the laws of Australia, Ecuador, Singapore and Spain²⁹ establish that data subjects have the right to bring an action. Australian law provides that when there are several affected parties, any data subject may take action.

28. Capacity to act as applicant or plaintiff. ↩
29. The data subject is termed the interesado (interested party) in the Spanish text of Regulation (EU) No. 2016/679 and the afectado (affected party) in Organic Act No. 3/2018. ↩

In South Africa, complaints may be lodged by a data subject, any person alleging interference with the personal information of a data subject, any person with sufficient personal interest or any person acting in the public interest.³⁰

30. See https://inforegulator.org.za/wp-content/uploads/2020/07/20211012-InfoReg-RulesOfProcedure-HandlingPOPIAcomplaints.pdf, rules 4.1.3 and 4.1.5. ↩

Both Ecuadorian and South African legislation provides for the representation of minors, differentiating by age group in the case of Ecuador.

In Spain, the law provides that not-for-profit bodies, organizations or associations may lodge complaints where mandated by a data subject or where the State provides for them to do so and they consider that the rights of the data subject have been infringed as a result of the processing of personal data.

The laws of all five countries provide for the need to turn to the data controller before seeking administrative protection, although in Australia this step may not be necessary in some cases.

The admissibility of administrative proceedings varies from one country to the next. In Ecuador, Singapore and Spain, administrative action may be taken when rights requests are not attended to in a timely manner; in Australia, when there has been interference with an individual’s privacy; and, in South Africa, when the data controller has violated the data subject’s rights or when an unfavourable decision is handed down by the adjudicator in an arbitration process established under the controller’s code of conduct.

As to whether complaints to the supervisory authority are free of charge, Spain is the only country where this is the case. Australian law does not specify, but there are indications that charges apply in some cases.³¹

31. Privacy Act, sects. 38A (2) (a) and 52. ↩

Spain is the only country to set a time limit for resolving the administrative procedure.

Ecuadorian law provides that the Personal Data Protection Authority may open preliminary proceedings ex officio or at the request of the data subject in order to determine the specific circumstances of the case and whether it is advisable to initiate the administrative procedure.

In Australia, South Africa and Spain, the supervisory authority may, before taking any further action, examine its own competence. If it considers that it is not competent, it may refer the complaint to the appropriate authority.

In the same countries, the authority must assess whether the complaint is admissible in the light of the circumstances.³² Once the complaint has been admitted, preliminary investigative proceedings may be conducted in order to better determine the facts and circumstances that justify the procedure.³³

32. In South Africa, Protection of Personal Information Act, sect. 77 (1) (b); in Spain, Organic Act No. 3/2018, art. 65. ↩
33. Organic Act No. 3/2018, art. 67. ↩

In Australia, the supervisory authority may in some cases restructure different aspects of the complaint in order to better achieve a better resolution of the issue.

Australia, Singapore and South Africa establish the possibility of referring the matter to an alternative dispute resolution mechanism as a preliminary measure.

Possible decisions – ways in which the authority may resolve the case – are set forth in the laws of all the countries considered, except Ecuador.

In Australia, Singapore, South Africa and Spain, the authority may close the case. In Spain, the complaint may be considered upheld if the authority does not respond by the established deadline.

In South Africa, if the Information Regulator ultimately decides to impose penalties or other measures, it may seek the advice of the Enforcement Committee, a consultative body.³⁴ The Regulator may also publish its decisions in full or in part.

34. The Enforcement Committee is a consultative body of the Information Regulator comprised of 14 independent members from different professional backgrounds. See https://inforegulator.org.za/wp-content/uploads/2020/07/Media-Statement_Information-Regulator-Establishes-Enforcement-Committee.pdf. ↩

All of the laws studied provide for measures to protect the right claimed in the complaint, as can be seen in table 3.

Under the laws of Australia and Ecuador, the supervisory authority may order measures to prevent the continuation of the infringement or the repetition of the conduct, regardless of any administrative penalties that may apply.

In all countries, the authorities can order measures such as the cessation of processing, the deletion of data or compliance with the request.

Australia is the only country where the authority, the Privacy Commissioner, may require an entity under investigation to engage an independent adviser to review the situation and provide a copy of the review to the Commissioner. It may also require the entity to prepare and publish a statement about its conduct.

Only the laws of Australia and Singapore provide for the possibility of appealing against the authority’s decisions before a higher administrative body. In both cases, the law specifies the types of decision that may be subject to appeal.

In the laws of Australia, Singapore, South Africa and Spain, administrative protection against violations of the right to personal data protection and privacy is supplemented by the possibility of challenging the decisions of the administrative authority before the courts, in accordance with the right to effective judicial protection, as can be seen in table 3.

States that have personal data protection and privacy laws usually establish a legal framework consisting not only of administrative remedies, but also judicial ones, in order to strengthen the protection of fundamental rights such as the right to personal data protection and privacy.

Of the laws studied here, those of Ecuador and Spain provide for judicial proceedings. In both cases, it is clarified that it is not necessary to first initiate administrative proceedings – that is, to turn to administrative supervisory authority – in order to take legal action before the courts.

It is for the data subject, as the affected party, to decide whether to turn to the administrative supervisory authority, as discussed in the previous chapter, or to approach the competent judicial body in order to seek a remedy for the protection of personal data that the data controller has failed to protect.

In Ecuador, data subjects may, in parallel with administrative proceedings, pursue any constitutional remedies to which they may consider themselves entitled. In Spain, the law provides for the right to a judicial remedy, without prejudice to any other administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority. It is therefore understood that administrative proceedings do not have to be initiated or completed in order to begin legal action before the courts.

In Ecuador and Spain, standing to take legal action is that of the data subject.

Regarding the courts before which action can be taken, Spanish legislation provides that the competent courts are those of the European Union member State that fulfils the conditions outlined in table 4. In the case of Ecuador, the case is referred to the competent judge, but the law does not set out the procedure in this regard.

Any person who has suffered damage as a result of a breach of personal data protection and privacy laws should be able to obtain redress for the prejudice incurred. To this end, he or she should pursue the remedies afforded by the legal system. All five countries regulate certain aspects of redress to a greater or lesser extent.

There are differences in the names given to the action that must be taken. In Ecuador, the law provides for “civil action”; in Spain, for “court proceedings for exercising the right to receive compensation”; in Singapore, for the “right of private action”; and, in South Africa, for “civil remedies”. Australian law does not name any specific action.

In terms of standing, Ecuador and South Africa establish that data subjects may institute proceedings. In South Africa, the data subject may also request the Regulator to act on his or her behalf. In Australia, the Commissioner has standing to commence proceedings, although data subjects may also do so where the Commissioner has issued an administrative decision in their favour.

In Spain, standing extends to any person, in addition to the data subject, who may have suffered material or non-material damage as a result of an infringement of Regulation (EU) No. 2016/679. Data subjects have the right to mandate a body, organization or association that meets certain requirements to exercise the right to receive compensation on their behalf.

All the laws analysed, with the exception of that of Ecuador, contain provisions establishing capacity to be sued.⁵⁰ The laws of South Africa and Spain refer to the data controller in this regard, while the Spanish law also includes data processors and representatives and provides in certain cases for joint and several liability for damage caused in order to ensure the effective compensation of data subjects.

50. Lies with the party that is required to fulfil an obligation. ↩

In Australia and Singapore, capacity to be sued lies with the APP entity and the organization that caused the damage, respectively. These entities encompass notions broader than those of data controller and data processor.

In Australia, redress may be sought for any loss or damage, including injury to feelings and humiliation. Spanish law refers to material and non-material damages; South African law to patrimonial and non-patrimonial loss; and Singaporean law to loss or damage.

In Australia, the competent court may be the Federal Court or the Federal Circuit and Family Court. The laws of Ecuador, Singapore and South Africa provide only for a civil action or civil proceedings to be brought before a competent court or tribunal. According to Spanish law, proceedings may be brought before the courts competent under the law of the European Union member State that fulfils the conditions outlined in table 5.

The legislation of Singapore, South Africa and Spain expressly establishes a causal link between the infringement and the damaging outcome. In Spain, any person who has suffered damage as a result of an infringement of Regulation (EU) No. 2016/679 has the right to receive compensation. Singaporean law stipulates that any person who suffers loss or damage as a result of a contravention has a right to relief. In South Africa, the law states that loss suffered as a result of a breach of the provisions of the Protection of Personal Information Act will give rise to action against the responsible party.

The following conclusions can be drawn from this analysis:
(a) Countries from five continents have expressly recognized in their legislation the different rights that data subjects enjoy and that allow them to control their personal information. Eleven rights were identified in the legislation of the countries analysed;
(b) Some countries are moving forward by legislating to recognize new rights, including those that are linked to automated and digitalized data processing or are exercised in the context of the Internet or of social media and similar services. This progress can also be seen from the more detailed express recognition of certain rights;
(c) Data subjects exercise personal data protection rights vis-à-vis data controllers through regulated procedures in each legal system that possess similarities and particular features;
(d) Regulated aspects of these procedures include, depending on the law in question, the ability of the data subject or his or her representative to submit requests for the exercise of a right; the types of possible response; the medium of the response; the deadline for responding; whether the procedure is free of charge; and, if a rights request is refused, the duty to inform the data subject of the possibility of submitting a complaint to an administrative or judicial authority;
(e) In respect of administrative remedies, which data subjects may pursue if the data controller fails or refuses to protect their rights, there is a degree of regulatory convergence. The laws of certain countries include specific provisions on the submission of complaints free of charge; on time limits for the resolution of procedures; and on the possibility of referral to alternative dispute resolution mechanisms;
(f) In all of the laws considered, provision is made for administrative measures to protect the claimed right; some of which are intended to prevent the continuation of the infringement or repetition of the conduct;
(g) Certain laws clearly establish the possibility of appealing against the decisions of the supervisory authority before a higher administrative body and the possibility of challenging the decisions of the supervisory authority before the courts in accordance with the right to effective judicial protection;
(h) In some countries, the law gives data subjects the option of whether to turn to the administrative supervisory authority or to directly approach the competent judicial body in order to seek a remedy for the protection of personal data that data controller has refused or failed to protect;
(i) The five countries covered by the analysis regulate, to a greater or lesser extent, aspects of the redress that may be sought by data subjects who have suffered damage or loss as a result of a breach of data protection and privacy legislation. However, only one country provides for the joint and several liability of data controllers, processors and representatives.

In the light of the foregoing, the Special Rapporteur urges States to:
(a) Establish and bring up to date appropriate legal frameworks, on a multidisciplinary basis and with the support of all stakeholders, in particular through the adoption of laws and regulations that provide accessible and appropriate remedies for the effective protection, reparation and restitution of the right to personal data protection, including compensation for damage caused by violations of the relevant laws and regulations;
(b) Acting in a sovereign capacity, identify and consider adopting aspects of other countries’ data protection and privacy legislation that may offer stronger guarantees for the effective realization of these rights in the digital age;
(c) Promote and foster human rights information and education, particularly in the area of personal data protection and privacy, as a matter of priority, at all levels and in all fields, so that data subjects are aware of, understand and can exercise their rights and, if necessary, can avail themselves of remedies to ensure their effective enjoyment.