European Data Protection Supervisor
1. The European Data Protection Supervisor is hereby established.
2. With respect to the processing of personal data, the European Data Protection Supervisor shall be responsible for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies.
3. The European Data Protection Supervisor shall be responsible for monitoring and ensuring the application of the provisions of this Regulation and of any other Union act relating to the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data by a Union institution or body, and for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data. To those ends, the European Data Protection Supervisor shall fulfil the tasks set out in Article 57 and exercise the powers granted in Article 58.
4. Regulation (EC) No 1049/2001 shall apply to documents held by the European Data Protection Supervisor. The European Data Protection Supervisor shall adopt detailed rules for applying Regulation (EC) No 1049/2001 with regard to those documents.
Appointment of the European Data Protection Supervisor
1. The European Parliament and the Council shall appoint the European Data Protection Supervisor by common accord for a term of five years, on the basis of a list drawn up by the Commission following a public call for candidates. The call for candidates shall enable all interested parties throughout the Union to submit their applications. The list of candidates drawn up by the Commission shall be public and shall consist of at least three candidates. On the basis of the list drawn up by the Commission, the competent committee of the European Parliament may decide to hold a hearing in order to enable it to express a preference.
2. The list of candidates referred to in paragraph 1 shall be made up of persons whose independence is beyond doubt and who are acknowledged as having expert knowledge in data protection as well as the experience and skills required to perform the duties of European Data Protection Supervisor.
3. The term of office of the European Data Protection Supervisor shall be renewable once.
4. The duties of the European Data Protection Supervisor shall cease in the following circumstances:
(a)
if the European Data Protection Supervisor is replaced;
(b)
if the European Data Protection Supervisor resigns;
(c)
if the European Data Protection Supervisor is dismissed or required to take compulsory retirement.
5. The European Data Protection Supervisor may be dismissed or deprived of his or her right to a pension or other benefits in his or her stead by the Court of Justice at the request of the European Parliament, the Council or the Commission, if he or she no longer fulfils the conditions required for the performance of his or her duties or if he or she is guilty of serious misconduct.
6. In the event of normal replacement or voluntary resignation, the European Data Protection Supervisor shall nevertheless remain in office until he or she has been replaced.
7. Articles 11 to 14 and 17 of the Protocol on the Privileges and Immunities of the European Union shall apply to the European Data Protection Supervisor.
Regulations and general conditions governing the performance of the European Data Protection Supervisor’s duties, staff and financial resources
1. The European Data Protection Supervisor shall be considered equivalent to a judge of the Court of Justice as regards the determination of remuneration, allowances, retirement pension and any other benefit in lieu of remuneration.
2. The budgetary authority shall ensure that the European Data Protection Supervisor is provided with the human and financial resources necessary for the performance of his or her tasks.
3. The budget of the European Data Protection Supervisor shall be shown in a separate budgetary heading in the section related to administrative expenditure of the general budget of the Union.
4. The European Data Protection Supervisor shall be assisted by a secretariat. The officials and other staff members of the secretariat shall be appointed by the European Data Protection Supervisor and their superior shall be the European Data Protection Supervisor. They shall be subject exclusively to his or her direction. Their numbers shall be decided each year as part of the budgetary procedure. Article 75(2) of Regulation (EU) 2016/679 shall apply to the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the European Data Protection Board by Union law.
5. The officials and the other staff members of the secretariat of the European Data Protection Supervisor shall be subject to the rules and regulations applicable to officials and other servants of the Union.
6. The seat of the European Data Protection Supervisor shall be in Brussels.
Independence
1. The European Data Protection Supervisor shall act with complete independence in performing his or her tasks and exercising his or her powers in accordance with this Regulation.
2. The European Data Protection Supervisor shall, in the performance of his or her tasks and exercise of his or her powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody.
3. The European Data Protection Supervisor shall refrain from any action incompatible with his or her duties and shall not, during his or her term of office, engage in any other occupation, whether gainful or not.
4. After his or her term of office, the European Data Protection Supervisor shall behave with integrity and discretion as regards the acceptance of appointments and benefits.
Professional secrecy
The European Data Protection Supervisor and his or her staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of the performance of their official duties.
Tasks
1. Without prejudice to other tasks set out under this Regulation, the European Data Protection Supervisor shall:
(a)
monitor and enforce the application of this Regulation by Union institutions and bodies, with the exception of the processing of personal data by the Court of Justice acting in its judicial capacity;
(b)
promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;
(c)
promote the awareness of controllers and processors of their obligations under this Regulation;
(d)
upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the national supervisory authorities to that end;
(e)
handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 67, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;
(f)
conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;
(g)
advise, on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data;
(h)
monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies;
(i)
adopt standard contractual clauses referred to in Article 29(8) and in point (c) of Article 48(2);
(j)
establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 39(4);
(k)
participate in the activities of the European Data Protection Board;
(l)
provide the secretariat for the European Data Protection Board, in accordance with Article 75 of Regulation (EU) 2016/679;
(m)
give advice on the processing referred to in Article 40(2);
(n)
authorise contractual clauses and provisions referred to in Article 48(3);
(o)
keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2);
(p)
fulfil any other tasks related to the protection of personal data; and
(q)
establish his or her Rules of Procedure.
2. The European Data Protection Supervisor shall facilitate the submission of complaints referred to in point (e) of paragraph 1 by a complaint submission form which can also be completed electronically, without excluding other means of communication.
3. The performance of the tasks of the European Data Protection Supervisor shall be free of charge for the data subject.
4. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the European Data Protection Supervisor may refuse to act on the request. The European Data Protection Supervisor shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
Powers
1. The European Data Protection Supervisor shall have the following investigative powers:
(a)
to order the controller and the processor to provide any information it requires for the performance of his or her tasks;
(b)
to carry out investigations in the form of data protection audits;
(c)
to notify the controller or the processor of an alleged infringement of this Regulation;
(d)
to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of his or her tasks;
(e)
to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union law.
2. The European Data Protection Supervisor shall have the following corrective powers:
(a)
to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;
(b)
to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;
(c)
to refer matters to the controller or processor concerned and, if necessary, to the European Parliament, the Council and the Commission;
(d)
to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;
(e)
to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;
(f)
to order the controller to communicate a personal data breach to the data subject;
(g)
to impose a temporary or definitive limitation including a ban on processing;
(h)
to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 18, 19 and 20 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 19(2) and Article 21;
(i)
to impose an administrative fine pursuant to Article 66 in the case of non-compliance by a Union institution or body with one of the measures referred to in points (d) to (h) and (j) of this paragraph, depending on the circumstances of each individual case;
(j)
to order the suspension of data flows to a recipient in a Member State, a third country or to an international organisation.
3. The European Data Protection Supervisor shall have the following authorisation and advisory powers:
(a)
to advise data subjects in the exercise of their rights;
(b)
to advise the controller in accordance with the prior consultation procedure referred to in Article 40, and in accordance with Article 41(2);
(c)
to issue, on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data;
(d)
to adopt standard data protection clauses referred to in Article 29(8) and in point (c) of Article 48(2);
(e)
to authorise contractual clauses referred to in point (a) of Article 48(3);
(f)
to authorise administrative arrangements referred to in point (b) of Article 48(3);
(g)
to authorise processing operations pursuant to implementing acts adopted under Article 40(4).
4. The European Data Protection Supervisor shall have the power to refer the matter to the Court of Justice under the conditions provided for in the Treaties and to intervene in actions brought before the Court of Justice.
5. The exercise of the powers conferred on the European Data Protection Supervisor pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedies and due process, set out in Union law.
Obligation of controllers and processors to react to allegations
Where the European Data Protection Supervisor exercises the powers provided for in points (a), (b) and (c) of Article 58(2), the controller or processor concerned shall inform the European Data Protection Supervisor of its views within a reasonable period to be specified by the European Data Protection Supervisor, taking into account the circumstances of each case. The reply shall also include a description of the measures taken, if any, in response to the remarks of the European Data Protection Supervisor.
Activities report
1. The European Data Protection Supervisor shall submit an annual report on his or her activities to the European Parliament, to the Council and to the Commission and at the same time make it public.
2. The European Data Protection Supervisor shall forward the report referred to in paragraph 1 to the other Union institutions and bodies, which may submit comments with a view to possible examination of the report by the European Parliament.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
