Chapter 14: Data Protection Authorities – Unlocking the EU General Data Protection Regulation

Under the GDPR, the position on this issue has materially changed (e.g., the GDPR has introduced a new obligation that did not previously exist).

Under the GDPR, the position on this issue has not materially changed (e.g., although the wording may be different in the GDPR, the nature of the relevant obligation is unchanged).

The impact of the GDPR on this issue is likely positive for most organisations (e.g., because the GDPR provides certainty in relation to a previously unclear issue).

The impact of the GDPR on this issue is likely neutral for most organisations (e.g., because the requirements under the GDPR and the Directive are essentially the same).

The impact of the GDPR on this issue is likely negative for most organisations (e.g., because the GDPR introduced a new obligation on organisations).

The impact of the GDPR on this issue is unknown at this stage (e.g., because the impact on organisations is dependent upon secondary guidance that has not yet been written).

Responsibilities of DPAs

DPAs are responsible for enforcing data protection laws at a national level, and providing guidance on the interpretation of those laws.

Art.28

Each Member State was required to appoint one or more DPAs to implement the Directive and protect the rights and freedoms of individuals.

 Rec.117; Art.51

Each Member State is required to appoint one or more DPAs to implement the Regulation and protect the rights and freedoms of individuals.

 The primary roles and responsibilities of DPAs have not significantly changed. Organisations can largely rely on their pre-existing experience of interactions with DPAs.

Jurisdiction

Each DPA is appointed at a national level, through national legislation. Its jurisdiction and enforcement powers are largely restricted to the territory of its own Member State.

Art.28

Each DPA had oversight of processing activities taking place on the territory of its own Member State only.

 Rec.124; Art.51, 55, 56

Each DPA can only exercise its powers on the territory of its own Member State but, under the "One-Stop- Shop" (see below), the DPA's regulatory actions may affect processing that occurs in other Member States.

 Organisations that operate across multiple Member States face a new set of challenges in their interactions with DPAs.

 Organisations that operate only within a single Member State, and only process personal data of residents of that Member State, are largely unaffected.

Independence

DPAs must be free from all outside influences, including government control.

Art.28(1)

Each DPA had to act with complete independence in carrying out its functions.

 Rec.117, 118 & 121; Art.52

Each DPA must act with complete independence in carrying out its functions.

 The GDPR essentially replicates the requirements set out in the Directive, albeit in greater detail.

Establishment and appointment of DPAs

In order to ensure that DPAs apply and enforce EU data protection law in a fair, uniform and impartial manner, certain minimum requirements must be met in terms of their establishment and appointment.

Art.28

Each DPA had to:

• have the skills and experience necessary to perform the role; and
• be subject to a duty of professional secrecy.

 Rec.121; Art.53-54

Each DPA must:

• be created through a transparent procedure;
• have the skills and experience necessary to perform the role; and
• be subject to a duty of professional secrecy.

 The changes in the GDPR are unlikely to impact organisations acting in a business context.

The "One-Stop-Shop"

The concept of a "One-Stop- Shop" is found in other areas of regulatory enforcement (e.g., trading standards). The aim of the One-Stop-Shop is to provide a single, uniform decision-making process in circumstances in which multiple regulators have responsibility for regulating the same activity performed by the same organisation in different Member States.

The WP29 has issued Guidelines on Lead DPAs (WP 244) (the "Lead DPA Guidelines") which provide further clarity on how to determine which DPA is the lead DPA for a given controller.

N/A

The Directive did not provide a One-Stop-Shop mechanism. As a result, it was not uncommon for a single organisation to be subject to inconsistent decisions from DPAs across multiple Member States.

 Rec. 124-128; Art.55-56; WP29 Lead DPA Guidelines

Identifying a lead DPA is only relevant where a controller or processor established in the EU is carrying out cross-border processing of personal data (as defined in Article 4(23) of the GDPR). If a controller has establishments in multiple Member States, the DPA for its "main establishment" (i.e., the place where its main processing decisions are taken) will be its lead DPA. The lead DPA has the power to regulate that controller across all Member States (to the extent its data processing activities involve cross-border data processing).

Forum-shopping is not permitted and organisations should be able to demonstrate the basis for claiming a main establishment, taking into account the following factors:

• where decisions about processing are made;
• where the power to implement those decisions lies;
• where the decision-makers with responsibility for the processing are located; and
• where the relevant entity has its corporate registrations.

 In theory, the "One- Stop-Shop" means greater harmonisation, and a more uniform application of EU data protection law, as an organisation will generally deal with a single lead DPA.

 Whilst the Lead DPA Guidelines encourage informal cooperation between lead and concerned DPAs to reach a mutually acceptable course of action, in practice, it remains to be seen whether DPAs will abide by the requirements of the "One-Stop-Shop" and refrain from attempting to regulate organisations that are subject to another DPA's jurisdiction.

Tasks of DPAs

DPAs are required to perform certain tasks, including monitoring and enforcement of EU data protection law.

Art.28(4)

The tasks of DPAs included obligations to:

• monitor and enforce the application of the Directive (as implemented under the laws of the relevant Member State); and
• hear claims brought by data subjects or their representatives, and inform data subjects of the outcome of such claims.

 Rec.122, 123; Art.55, 57

The tasks of DPAs include obligations to:

• monitor and enforce the application of the GDPR;
• promote awareness of the risks, rules, safeguards and rights pertaining to personal data (especially in relation to children);
• advise national and governmental institutions on the application of the GDPR;
• hear claims brought by data subjects or their representatives, and inform data subjects of the outcome of such claims;
• establish requirements for Impact Assessments;
• encourage the creation of Codes of Conduct and review certifications (see Chapter 12);
• authorise Model Clauses and BCRs (see Chapter 13);
• keep records of sanctions and enforcement actions (see Chapter 16); and
• fulfil "any other tasks related to protection of personal data".

 The tasks of DPAs are more broadly defined in the GDPR than in the Directive (in a significant way). However, in the overwhelming majority of cases, these changes likely make little practical difference to organisations acting in a business context.

Powers of DPAs

DPAs have the power to enforce data protection laws at a national level.

Art.28(3)

Each DPA had oversight of processing activities taking place on the territory of its own Member State only.

 Rec.129; Art.58

DPAs are empowered to oversee enforcement of the GDPR, investigate breaches of the GDPR and bring legal proceedings where necessary.

 The legal powers of DPAs are largely unchanged. At a practical level, it is likely that there will continue to be some variation between the practical enforcement powers available to DPAs, due to variations in the national laws of Member States.

Activity reports

In order to ensure fairness and transparency, DPAs are required to draw up and publish regular reports explaining their activities.

Art.28(5)

Each DPA was required to, at regular intervals, draw up a report on its activities. The report had to be made available to the public.

 Art.59

Each DPA must draw up an annual report on its activities. The report must be made available to the public.

 The GDPR essentially replicates the requirements set out in the Directive.

EU-level DPA coordination

In principle, DPAs meet together to agree on important issues and offer guidance on the correct interpretation of EU data protection law. Although this guidance is not legally binding, it is often indicative of the enforcement position that individual DPAs will take.

Art.29

The WP29 was made up of representatives of DPAs from each Member State. Its primary function was to provide advice on the interpretation and application of EU data protection law.

 Art.51(3), 68-76

The EDPB is made up of representatives of DPAs from each Member State. It provides advice, but also takes an active role in enforcing EU data protection law. Where more than one DPA is appointed in a Member State (e.g., in Germany each Bundesland has a DPA) the Member State appoints a single representative to the EDPB.

 In effect, the EDPB replaces the WP29 and assumes the WP29's functions. However, the extent to which the EDPB will play an active role in enforcement proceedings remains uncertain.

DPA cooperation

In order for EU data protection law to operate consistently across all Member States, it is important for DPAs to cooperate with one another (see Chapter 15).

Art.29

DPAs were required to cooperate to the extent necessary to implement and enforce EU data protection law.

 Rec.133, 134; Art.61-62

DPAs are required to cooperate and provide each other with mutual assistance. They also have formal legal authority to carry out joint operations.

 In cases in which organisations are under investigation in multiple Member States, these changes should make the investigation process easier to manage.

 In most other cases, these changes have no practical impact on organisations.

Consistency Mechanism

One of the most significant difficulties organisations face in dealing with DPAs is the inconsistent nature of decisions taken at the national level.

N/A

The Directive offered no formal mechanism for ensuring that DPAs reached decisions that are consistent. As a result, DPAs adopted different positions on the same issue, from time to time.

 Rec. 135-138; Art.4(23), 56, 63-67

Where an organisation engages in cross-border data processing (i.e., processing that affects data subjects in multiple Member States), a DPA that wishes to take action must consult with the other affected DPAs to ensure consistency in the application of the GDPR.

 For any organisation that operates in multiple Member States, the Consistency Mechanism is a positive development, as it should result in a more uniform application of EU data protection law to the processing operations of that organisation.