Arbitration and GDPR Arbitration allow a both parties to settle the dispute outside the court where the arbitrator would decide the law to b e applied to the dispute?. However, arbitration will not exempt their obligation under the GDPR if the issue is related to GDPR compliance?
Arbitration is a private dispute resolution process For grievances between private parties, they can agree to resolve them through arbitration. For breaches of public law (like GDPR) the state is the one against whom the offence is committed. Arbitration is not available to resolve these matters - resolution is through the courts or administrative tribunals.
Yes, but ... You can bring a suit in an Australian court of competent jurisdiction. You would then need to find and serve the defendant in compliance with both Australian law and the law of the jurisdiction they are in. They can then raise a jurisdictional challenge that the Australian court is not the appropriate forum - they might be right depending on where the substance of the contract happened, whether the contract has a nomination of venue clause and if the contract is subject to an arbitration agreement. If the Australian court decides it does have jurisdiction it would have to decide which law applies - this is likely to be a mix of law because some laws in both jurisdictions are likely not excludable by contract. If you win, you would then have to get the judgement enforced somewhere the defendant has assets. Not paying a judgement is not a crime so the defendant will be of no interest to law enforcement - getting money from them is your problem. tl;dr Cross-national litigation is way more expensive in time and money and way less certain in outcome beyond the inherent uncertainty in any lawsuit. This is not something you can expect to succeed at without lawyers in both countries so you will be spending tens of thousands for an uncertain outcome. If you are chasing millions this may be worth it but if you are - don’t do million dollar deals by email in the future.
If such a company oversteps one of these parameters for lawful operation, are arbitration clauses binding in respect of these breaches, in removing judicial recourse for the customer in court, rather than in arbitration venues? In this situation, the arbitration clause (assuming it was actually entered into) is binding and there is no meaningful judicial recourse through a civil lawsuit. It does not bar criminal prosecutions or administrative agency action. And what . . . scenarios give rise to causes of action that can immutably transcend arbitration clauses? Civil actions seeking redress from sexual assaults are exempt from arbitration in the U.S., pursuant to H.R. 4445, the Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act, which was signed into law on March 3, 2022.
The tricky bit from a GDPR standpoint is that the US has a law that says a US-based company must hand over data to US government agencies even if the data is stored outside the US. This is US specific and a case where the US government gives itself jurisdiction outside the US but the EU can't directly do anything against it (outside of international negotiations). As you noticed this means if you store data at a US data processor there is no real difference whether the data is physically stored in the US or the EU. So to avoid transferring EU consumer data to the US several steps are needed. First the servers have to be physically located in the EU and second the company needs to be non-US based, EU based seems the obvious choice. AFAIK constructions of a US-based company creating a fully owned EU-based subsidary are currently used to achieve the second part. Whether this is sufficient may have to be decided in court.
The university has a legal obligation to collect certain data from attendees, including employees an visitors. It has decided to keep these records in digital form, and offers a smartphone app as a convenience. The university has outsourced the data processing activity to a third party. This is perfectly legal under the GDPR, if that third party is contractually bound to only process the data as instructed, and not for their own purposes. Whereas the university acts as a data controller (Verantwortlicher), the third party would be a data processor (Auftragsverarbeiter). I have some doubts though whether an app or a website is indeed the solution that offers the best data protection, especially taking into account the GDPR's data minimization principle. Requiring updates when entering or leaving any room is potentially excessive. Given the sensitivity of the data, the university should have performed a data protection impact assessment to weigh the consequences of this measure. At least for employees, the measure would likely have to be approved by the union (Personalrat) as well.
Not legal advice - you should consult an attorney who knows your local jurisdiction. That's a general statement, but especially true here because the GDPR does not include personal liability for directors (or others) in the event of a data breach, but domestic laws may indeed do just that. The UK is one example where certain circumstances can lead to criminal liability for directors of a firm in the event of a breach. That said, your company should care. The fines for knowingly allowing a breach or not reporting it properly in a timely manner have been made more significant than the prior Directive. There are things you could do to potentially mitigate consequences in the event of a breach and a fine being levied on the company, such as aligning with best practices and getting certifications. In sum, the actual punishments for noncompliance will vary by jurisdiction, but any business that handles data in the EU should undoubtedly be ensuring it is aware of what, if any, obligations it has and taking steps to comply before May's deadline.
They get paid either way I’m an arbitrator, adjudicator, and mediator and I’ll make this very clear: I don’t give a rat’s arse who wins. When I’m acting as a mediator I can go even further: I don’t give a rat’s arse if the dispute even gets resolved. My job is to do my job. To manage the process and, if making a decision is part of the process, make a decision. My paycheque is totally unaffected by who I decide for. Future employment prospects depend on you being good at the job. Bias is not being good at the job. Oh, yeah. Also, it’s the law that I’m impartial. In any event, most arbitration clauses give the parties no input in the selection of the arbitrator (e.g. by nominating the president of a professional association of arbitrators to appoint them) or require them to agree on the arbitrator.
Let's assume that I created a mobile app for iPhone that is tracking rides on a bike [...] So the app is processing that data in the way I programmed it but I as a person do not have access to that data. I assume in such case I am not the data controller according to GDPR because I do not have access to that data is that correct? Yes, as far as I can see that is correct. The GDPR defines a data controller as someone who "determines the purposes and means of the processing of personal data" - you just provide a tool, you don't control for what purposes your customers use their ride data. This is also discussed in this question: How does the GDPR apply to software developed by one company and used by another? What if additionally to that I will program my app for example in such way that it will sometimes send current GPS coordinate to an online service controlled by external company such as Apple [...] But still my app would send this data directly to Apple server so I will still not have any access to that data. Does this change anything and does GDPR now apply to me? Yes, and yes. In that case, you are telling Apple to process data for you, so you would become the data controller (because you "determine[s] the purposes and means of the processing of personal data"), and Apple is a data processor for you. That means also the usual mechanisms kick in - you need to inform your users about this processing, you need to make sure Apple plays by the rules, etc. etc. I also do not know if Apple save this request on their servers or if they just automatically convert received gps coordinates to a name and return the answer without saving the request. This is exactly the kind of situation the GDPR is meant to address. Under GDPR, saying "I do not know what X does with the data" is not an option. This is something many companies tried in the past, that is why GDPR explicitly assigns responsibility to the data controller (i.e., you). As explained in a EU document, What is a data controller or a data processor?: The duties of the processor towards the controller must be specified in a contract or another legal act. For example, the contract must indicate what happens to the personal data once the contract is terminated. A typical activity of processors is offering IT solutions, including cloud storage. [...] So, no, you cannot just say "I do not know if Apple saves this request". Instead, you must make a contract with Apple which says whether (and how, and for how long...) they save the request, and you must inform your users about this in your privacy policy. And if Apple refuse to make such a contract with you, you must find a different company to work with.