Datafication 10 Flashcards
(19 cards)
2 systems to ensure compliance
1) Authorities
2) Sanctions
Supervision through Authorities
1) European Data Protection Board (EDPB
2) National Supervisory / Data Protection Authority (DPA)
European Data Protection Board (EDPB)
- independent EU body
- contributes to consistent application of data protection rules
European Data Protection Board (EDPB) - composition
1) representatives of national DPAs &
2) European Data Protection Supervisor (EDPS)
3) Supervisory authorities of EFTA EEA States (but no right to vote & (deputy) chair)
European Data Protection Board (EDPB) - Tasks / Responsibility (more in Art. 70):
- Advice EU Commission
- Issue legally binding decisions
- Issue guidelines, recommendations & best practices (annual report including reviewing practical applications of those)
National Supervisory / Data Protection Authority (DPA)
independent public authority(ies) which each Member State is required to provide
National Supervisory / Data Protection Authority (DPA) - task
- Monitor, enforce & promote public awareness
- annual report on its activities ( transparency)
National Supervisory / Data Protection Authority (DPA) - requirements
- Independency from external influence: law underlying it & organizational structure
- no conflict of interests
- sufficient resources & capabilities
- choose own sfaff
Lead Supervisory Authority
- NSA of main establishment of dc or dp is competent to act as lead
- for cross-border processing (when dc has establishments in several & processing affects ds in different member states)
Main establishment of dc or dp when establishments in > 1 Member State
= Place in EU
a) dc:
- where decisions on purposes & means of processing pd take place
- Otherwise: of its central administration
b) dp:
- of its central administration
- Otherwise: where main processing activities in context of activities of an establishment of the dp take place
e.g. main establishment Fb?
Ireland: established company in Ireland -> benefiting form GDPRs principles of free pd movement in EU
e.g. main establishment Google?
- established in California, sales offices in number of EU Member States
- Google Spain case: CJEU found Google Inc. (dp established in US) along with its establishment in Spain (Google Spain) were processing pd “in context of activities of an establishment” in Spain
- undisputed Google Spain was not (directly) involved in processing but promote & sell advertising space offered by the search -> used economically profitable
- CJEU: directive applicable to processing done by Google to protect guaranteed protection by earlier Data Protection Directive & prevent excuse by having board territorial scope
Relationship LSA & other DPAs
- LSA can request assistant from other DPAs
- DPAs can raise reasonable objects to draft decision, LSA can decide to follow or not
One stop shop (OSS) mechanism
- if company conducts cross-border data processing
- required to work primarily with the SA based in same Member State as companies main establishment (usually EU headquarters) to achieve compliance
- aim: improve harmonization & consistency application in all Member States
e.g. Google Ireland Limited by French supervisory authority fine 53 mil. Euro
- Frech DPA checked complains in other Member States if lead already appointed
- as non-claimed lead (also not Irish) they took the case
Ds (or non-profit entities on behalf of 1 or more ds) right to enforce
- lodge complaint with SA in Member State of residence, place of work or place of alleged infringement if feels like pd not handled accordingly
- effective judicial remedy against a SA (bring a decision from SA before court if Member State where SA established)
- effective judicial remedy against a dc or dp (proceedings where dp or dc has establishment or in Member state of ds)
- Sanctions
- Fines
- Art. 8: ds right to claim compensation from dc or dp for damage suffered
- Art. 58: Supervisory Authority corrective powers
Sanctions - Fines
- Requirement: effective, proportionate & dissuasive
- levels: 1. up to 10 Mio Euro or 2% of total worldwide annual turnover of preceding financial year (what is higher), 2. Up to 20 Mio. Euro or up to 4%
- Amount & Type depends on number of factors (e.g. nature of the breach, degree of fault, prior breaches, actions of dc & dp after mistake, cooperation with SA)
Sanctions - Supervisory Authority corrective powers
- Orders & warnings to dc or dp
- Order to communicate pd breach to ds
- Temporary or definitive limitation (including ban on processing)
- Order rectification, restriction, or erasure of pd
- Suspension of data flows to recipient in 3rd country or international organization
