PHAEDRA II - IMPROVING P RACTICAL AND H ELPFUL CO-OPER A TION BETW E EN D ATA P R OTECTION A UTHORITIES II http://www.phaedra-project.eu/ The role of DPAs in supervising police and criminal justice authorities processing personal data Paul de Hert and Juraj Sajfert
Directive (EU) 2016/680 Ma Main in obje ject ctive ives: s: • Hig igh le leve vel l of pro rotect ctio ion of personal data, taking account of the specific context of police and criminal justice • Smo Smoother r exch xchange of in informa rmatio ion between Member States' police and judicial authorities • Imp mpro rove ve co coopera ratio ion in the fight against terrorism and other serious crime in Europe
Directive (EU) 2016/680 • Ma Main in ch changes: s: • A Dire irect ctive ive for the former third pillar • Covers dome mest stic ic pro roce cessin ssing (added value in relation to FD 2008/977/JHA) • Data protection by desig sign and data protection by default lt – data protection starting and not an ending point of personal data processing • Increased accountability of LEA (e.g. mandatory DP DPIA A and DPO POs, notifications of perso rsonal l data bre reach ches)
Independent administrative supervision • Comp mple lete independence - Article 8(3) Charter of Fundamental Rights - case law of CJEU • Choice ice between „police” DPAs or „general” DPAs - - should the DPA that has been set up under GDPR supervise also police and criminal justice authorities?
DPAs’ competence Su Supervisio rvision of police and criminal justice authorities wit ithin in a Me Memb mber r St State Excluded: • courts acting in their judicial capacity • optionally, independent judicial authorities when acting in their judicial capacity • How will the independent supervision be ensured?
DPAs’ powers EFFECTIVE POWERS • Investigative powers – access to data • Corrective powers – „such as, for example” • Advisory powers – prior consultation and policy advice • No power to initiate court proceedings
DPAs handling complaints • The DPA in in the Me Memb mber r St State of the controller/ processor handles the case alone • „Post-box DPA” – choice of the data subject • Mandated NGO can represent data subject • No No one-stop-shop, consistency mechanism etc. • Bu But, mutual assistance • What is the role of the European Data Protection Board?
Conclusion • Comp mple lete in independence ce of DPAs • Limit imited area of administrative supervision (courts and independent prosecutors partly excluded) • Ef Effect ctive ive powers, but which powers? • Ve Very ry limit limited cross-border DPA activites
Recommend
More recommend
