Go back to the main page of the Data Protection Guidance for the organisers
Data Protection Guidance - Question 12
What is your liability as data controller?
Applies to Case Scenario 2, except as regards the use of the Commission’s file exchange service
As representative of the group of organisers, you may have to compensate signatories in case they suffer any material (i.e. direct costs) or non-material damages (i.e. reputation, image), caused by the processing and resulting in an infringement of the GDPR.
Examples:
- In case you disclose (acting intentionally or by negligence) that Mr Smith, employee and manager in the chemical industry, supports initiatives for prohibiting the use of pesticides produced by his employer: this may generate material damages such as losing job and non-material damages such as losing reputation or job opportunities
- In case you make available the collected data to the group of organisers of another initiative or to some organisation that will use it for political analysis, profiling or lobbying: this may generate non-material damages.
This liability extends to a data processor for the damage caused by processing where this data processor has not complied with GDPR obligations specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
Both yourself and the data processor will be exempted from liability for the damage caused by processing, if you can prove that you are not in any way responsible for the event giving rise to the damage.
Without prejudice to your liability as representative, the members of the group of organisers are jointly and severally liable for any damage caused in the organisation of an initiative by unlawful acts committed intentionally or with serious negligence, under applicable national law.
In case a legal entity is created to manage the initiative, the liability is transferred to the legal entity, together with the function of data controller.
PLEASE NOTE:
Under Case Scenario 1 your liability is materially diminished as the key responsibilities with regard to the processing of signatories’ data are transferred to the Commission
References:
- Article 5 of the Regulation on the European citizens' initiative
- Chapter VIII of the GDPR
