European Data Protection Supervisor publishes its response to the European Commission’s initiative on GDPR enforcement
May 1, 2023 |
Enforcement of breaches of the GDPR should be of interest to Australian practitioners if the mooted reforms to the Privacy Act occur. If the Commissioner is properly funded and changes temperament there could be real enforcement activity. The European Data Protection Supervisor recently responded to the European Commission’s initiative to further specify procedural rules for enforcement of the GDPR.
The amended rules highlights that the need for effective and efficient cooperation exists in cases where personal data moves from EU institutions, bodies, offices, and agencies (‘EUIs’) to public bodies or private entities, and vice-versa. The focus is on a need for effective and efficient cooperation between the EDPS and national DPAs where Member States and EUIs share responsibilities with private entities.
The announcement relevantly provides:
- the Commission’s proposal should specify that the EDPS shall, for purpose of cooperation with national DPAs in accordance with Chapter VII EUDPR, cooperate under the same modalities as Articles 61, Article 62, Article 64(2) and 66(3) GDPR.
- the proposal should specify that, for the purposes of such cooperation, the EDPS shall be considered a ‘supervisory authority’ within the meaning of those provisions
- In order to ensure that national DPAs and the EDPS can cooperate effectively in all supervision and enforcement cases where personal data flows from EUI’s to public bodies or private entities within the European Economic Area (EEA), and vice-versa, the Commission’s forthcoming proposal should specify that:
- all data protection authorities25 should cooperate actively to ensure effective supervision and consistent enforcement of all the Union’s data protection rules
- all data protection authorities should carry out such cooperation in accordance with Articles 61, 62, 64(2), and 66(3) GDPR, Article 50 LED as well as Articles 61 and 62 EUDPR; and
• the EDPS shall, for purposes of cooperation with national DPAs in accordance with Chapter VII EUDPR, be considered as a “supervisory authority” within the meaning of Chapter VII of the GDPR and Chapter VII of the LED
- regarding the amendment to add a reference to the EUDPR28 which would create dedicated workflows to cover Article 61 and Article 62 of the EUDPR and to have one system to exchange of information and to strengthen the cooperation between the EDPB Members
- amending the Annex of the IMI Regulation by adding a reference to the EUDPR would make it possible to extend the existing IMI GDPR related module to further support cooperation between the EDPS and national DPAs.
- the EDPB suggests further harmonisation in the areas of:
- the status and rights of the parties to the administrative procedures;procedural deadlines; • requirements for admissibility or dismissal of complaints;
- investigative powers of Supervisory Authorities;
- the practical implementation of the cooperation procedure.
- it proposes two specific measures to help achieve this goal in the short term, namely:
(1) To include in the COM’s forthcoming initiative a specific provision confirming that:
? all data protection authorities must cooperate actively to ensure effective supervision and consistent enforcement of all the Union’s data protection rules;
? all data protection authorities must carry out such cooperation in accordance with Articles 61, 62, 64(2), and 66(3) GDPR, Article 50 LED as well as Articles 61 and 62 EUDPR; and
? the EDPS shall, for purpose of cooperation with national DPAs in accordance with Chapter VII EUDPR, be considered as a “supervisory authority” within the meaning of Chapter VII of the GDPR and Chapter VII of the LED.
(2) To amend, in accordance with Article 11 of Regulation (EU) No 1024/2012 of the European Parliament and of the Council of 25 October 2012 on administrative cooperation through the Internal Market Information System and repealing Commission Decision 2008/49/EC (‘the IMI Regulation’), the Annex of the IMI Regulation.