Module 11 - Supervision and Enforcement

Question 1

What is the role of a data protection authority?

Answer 1

• Promote and enforce GDPR.
• Promote aware.
• Conduct investigations.
• Protect human rights.

Question 2

What three categories of power do DPAs have?

Answer 2

• Advisory.
• Investigatory.
• Corrective.

MS may also grant additional (local) powers to their DPAs.

Question 3

Which DPA is competent to regulate a controller or processor?

Answer 3

• Single establishment: DPA in MS of establishment.
• Multiple establishments: DPA in place of MAIN establishment as LEAD DPA, UNLESS decisions affect DS elsewhere, in which a CONCERNED DPA may become the LEAD DPA.

Question 4

What four governance mechanisms regulate collective DPA interactions?

Answer 4

• Cooperation (e.g. amongst lead and concerned DPAs).
• Mutual assistance.
• Joint operations.
• Consistency mechanisms (e.g. EC/EDBP promoting consistent application of GDPR).

Question 5

Who staffs the European Data Protection Board?

Answer 5

• Chair.
• 1 representative from the EC.
• 1 representative from each EU MS DPA.
• 1 non-voting representative from each EEA MS.

Note: the EDBP is, hence, independent of all MS.

Question 6

What are the EDPB’s key functions?

Answer 6

• Ensuring consistent application of GDPR.
• Issuing guidance.
• Resolving disputes amongst DPAs.

Question 7

What is the role of the European Data Protection Supervisor?

Answer 7

• Supervision and enforcement of GDPR against EU institutions.
• Secretariat of EDBP.

Question 8

What sanctions apply for contravention of GDPR?

Answer 8

• Greater of EUR 20MM or 4% worldwide turnover for breaches of DS rights, transfer obligations, processing principles, DPA orders or MS law.
• Greater of EUR 10MM or 2% worldwide turnover for other breaches.