at end insert—
In accordance with Article 80(2) of the GDPR, a person who satisfies the conditions in Article 80(1) and who considers that the rights of a data subject under the GDPR have been infringed as a result of data processing may bring proceedings, on behalf of the data subject and independently of the data subject’s mandate—
pursuant to Article 77 (right to lodge a complaint with a supervisory authority);
to exercise the rights referred to in Article 78 (right to an effective judicial remedy against a supervisory authority);
to exercise the rights referred to in Article 79 (right to an effective judicial remedy against a controller or processor).
An individual who considers that rights under the GDPR, this Act or any other enactment relating to data protection have been infringed in respect of a class of individuals of which he or she forms part may bring proceedings in respect of the infringement as a representative of the class (independently of the mandate of other members of the class); and—
for the purposes of this subsection “proceedings” includes proceedings for damages, and any damages recovered are to be distributed or otherwise applied as directed by the court;
in the case of a class consisting of or including children under the age of 18, an individual may bring proceedings as a representative of the class whether or not the individual’s own rights have been infringed;
the court in which proceedings are brought may direct that the individual may not act as a representative, or may act as a representative only to a specified extent, for a specified purpose or subject to specified conditions;
a direction under paragraph (c) may (subject to any provision of rules of court relating to proceedings under this subsection) be made on the application of a party or a member of the class, or of the court’s own motion; and
subject to any direction of the court, a judgment or order given in proceedings in which a party is acting as a representative under this subsection is binding on all individuals represented in the proceedings, but may only be enforced by or against a person who is not a party to the proceedings with the permission of the court.
Subsections (4A) and (4B)—
apply in respect of infringements occurring (or alleged to have occurred) whether before or after the commencement of this section;
apply to proceedings begun before the commencement of this section as if references in subsections (4A) and (4B) to bringing proceedings included a reference to continuing proceedings; and
are without prejudice to the generality of any other enactment or rule of law which permits the bringing of representative proceedings.”