So, as I understand, now every organisation have a qualified person that deals with any data processing tasks and do the personal data gathering according to Data Protection law. But then each country has an independent authority that supervises the work of the controllers'. My question is, whether this independent authorities' main task is to supervise the work of these individual controllers' or there is a different, more important role that is given to the independent supervisor? I just need to understand the meaning of "independent supervisor". Does it imply that controllers can be somehow biased and do misdeeds for the interests of the company? Is that the main issue why some national level independent supervisor is needed?
1
-
If you think my answer has answered your question, please consider accepting it as the answer for your question.– Sam_ButlerDec 5, 2019 at 13:04
Add a comment
|
1 Answer
It is not the case that every organisation whose activities are within the scope of the EU General Data Protection Regulation must have a qualified person dealing with data processing tasks, rather, some organisations may be required to appoint a Data Protection Officer, which GDPR Article 39(1) has "at least the following tasks":
(a) to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;
(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;
(d) to cooperate with the supervisory authority;
(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.
Chapter 6 of the GDPR deals with independent supervisory authorities. A supervisory authority is defined in Article 4 as:
an independent public authority which is established by a Member State pursuant to Article 51
Article 51 requires each member state of the EU to provide for "one or more independent public authorities to be responsible for monitoring the application of this Regulation" (emphasis added).
Their independence is covered in Article 52 and Recital 121, which is to say, the authority is independent from other influences such as political or financial bias to act in one way or another. The tasks of the supervisory authority are outlined in Article 57 and too numerous to quote here, but they are not solely an enforcement agency and also have duties to help data subjects, controllers, processors and their own governments.
