Data Protection Authorities

The EU General Data Protection Regulation (GDPR) has a very broad scope. It applies, to some certain extent, to practically every business trading in the EU, plus charities, public bodies and individuals.

It also covers an extremely wide range of activities, applying to practically any situation in which "personal data" is "processed." The expansion of information technology and big data means our personal data is being processed all the time.

Because the law is so pervasive, it has required the empowering of independent public bodies to handle complaints, conduct investigations and issue penalties. These are the Data Protection Authorities (DPAs).

Let's take a look at what these powerful organizations can do.

What is a Data Protection Authority?

A DPA is an independent public authority which applies data protection law at national level in an EU Member State. The GDPR calls DPAs "national supervisory authorities."

DPAs are powerful institutions that can investigate and fine both private companies and public bodies. And these are some serious fines - up to €20 million or 4 percent of a company's annual turnover for the previous year (whichever is higher).

They also provide help and guidance on matters of data protection to individuals, organizations and national parliaments.

The DPAs sit on the European Data Protection Board, which coordinates the activities of the DPAs and promotes cooperation between them. The European Data Protection Supervisor also sits on the Board. The Supervisor regulates data protection within the institutions of the EU itself.

What are the Functions of a Data Protection Authority?

DPAs fulfill a range of purposes for individuals, businesses and the general public.

A private individual living in the EU (or dealing with an EU company or public body) might contact a DPA if, for example:

They want to make a complaint about how their personal data has been processed by a business
They have had problems trying to exercise their data subject rights against an uncooperative company
They have been receiving unwanted direct marketing communications (including emails, phone calls and post), or are unhappy about how a website uses cookies

A company or other organization might contact a DPA for one of the following reasons:

To report a data breach (within 72 hours);
For advice on how to process personal data safely or lawfully
In relation to a Data Protection Impact Assessment (DPIA)

A DPA must also:

Promote public and industry awareness of data protection
Monitor developments in the field of data protection and privacy
Maintain a list of prohibited data processing activities, or activities requiring pre-approval

Powers of Data Protection Authorities

A DPA has three types of powers, described at Article 58 of the GDPR:

Investigatory powers
Corrective powers
Authorization and advisory powers

Investigatory Powers

A DPA has six investigatory powers:

To order a data controller or data processor to provide any information it requires
To conduct investigations (data audits)
To review data protection certificates
To notify a data controller or data processor that it has been accused of violating the GDPR
To collect any personal data it requires from a data controller or data processor
To enter the premises of any data controller or data processor - but only in accordance with national law

Corrective Powers

A DPA has ten corrective powers:

To give warnings where there is a danger that a data controller or data processor might violate the GDPR
To issue reprimands
To order a data controller or data processor to comply with an individual who is trying to exercise one of their data subject rights
To order a data controller or data processor to comply with the GDPR, possibly providing a deadline for this
To order a data controller to tell the affected people about a data breach
To ban or restrict data processing
To order that personal data is rectified or erased, and order that anyone who has received this personal data is informed about the change
To withdraw or prohibit the issuing of data protection certificates
To issue fines
To order that personal data is no longer transferred to a particular non-EU country

Authorization and Advisory Powers

A DPA has ten authorization and advisory powers:

To help a data controller carry out a Data Protection Impact Assessment
To advise national lawmakers and governments on data protection
To authorize particularly high risk data processing activities if these are restricted under national law
To advise on, and approve, draft data protection codes of conduct
To accredit data protection certification bodies
To issue data protection certificates and approve certification criteria
To adopt standard contractual clauses, which can be used in Data Processing Agreements, and to allow international data transfers
To authorize non-standard contractual clauses
To authorize administrative arrangements between public bodies conducting international data transfers
To approve binding corporate rules, which can be used to allow international data transfers in multinational companies

Determining Your Data Protection Authority

Where a company processes personal data across multiple EU Member States, it might not be obvious which DPA it should be working with.

For example, let's say a website serves people across France, Belgium and Luxembourg. The website is hacked and personal data is leaked. Which DPA should the website owner notify?

Lead Supervisory Authority and the "One-Stop Shop" Mechanism

The "One-Stop Shop" mechanism allows companies operating across several EU Member States to select a Lead Supervisory Authority. This means choosing one DPA as the company's main point of contact in order to avoid having to deal with multiple DPAs for cross-border data processing projects.

Companies who have no EU establishment and so have nominated an EU Representative do not have access to the One-Stop Shop mechanism.

Identifying a Lead Supervisory Authority isn't exactly a free choice. A company must choose the DPA that operates in its main establishment.

Main Establishment

A company's main establishment might be obvious. If a multinational company has its headquarters in France, then France is likely to be that company's main establishment.

Accordingly, the Article 29 Working Party suggests that a company's main establishment is where it has its "central administration."

There is a slightly different method for determining the central administration of a data controller (which "determines the purposes and means of the processing of personal data") and a data processor (which "processes personal data on behalf of a data controller").

For data controllers, the central administration is defined as:

"The place where decisions about the purposes and means of the processing of personal data are taken and this place has the power to have such decisions implemented."

So, if a company has operations across multiple EU Member States, its main establishment will be in whichever Member State it makes decisions about how and why it should process personal data.

For data processors, the central administration is defined as "the place where the main processing activities take place."

However, data processors are more likely to have to deal with multiple DPAs. This is because they must cooperate with DPAs who are investigating their data controllers. Where a data processor is working with data controllers in multiple Member States, this could mean being required to interact with multiple DPAs.