When Super-Regulators Fight: The ‘One-Stop Shop’ Inwards The Proposed Information Protection Rule

Steve Peers

A guilty pleasance for fans of superhero comic books is the instant when our heroes interruption inward their valiant efforts to salve Blue Planet from the nefarious plans of the supervillains – together with laid about beating the hell out of each other instead. This is ordinarily triggered past times unopen to petty departure of opinion, perhaps concerning a continuity fault or intellectual belongings rights.

Similarly, the European Union vests its hopes for the effective enforcement of information protection constabulary upon national information protection authorities (DPAs): the superheroes of the information protection world. They receive got considerable powers nether the electrical flow information protection Directive, together with the proposed Regulation would also give them to a greater extent than powers. But what if they disagree alongside each other? There’s zero inward the electrical flow legislation to settle this problem, which gives each DPA the mightiness to regulate actions on its ain territory without addressing the obvious complications that final result inward a digital age, when many forms of processing of personal information (most patently via the Internet) accept house across borders.  

To bargain alongside this problem, the Commission proposal contains a conflict dominion to determine who is the atomic number 82 regulator inward cross-border cases, alongside the possibility that a ‘European Data Protection Board’ or the Commission itself tin number an view on the issue. This has been dubbed the ‘one-stop shop’ rule. However, due to legal concerns, both the Council (which is well-nigh to adopt its spot on this component division of the proposed Regulation: encounter the draft text here), together with the European Parliament (EP), which has already adopted its position on the entire text, suggest instead that the Board must last able to brand binding decisions to settle disputes.

So this is laid to travel 1 of the most meaning innovations of the novel legislation. Let’s accept a await at what the hereafter rules volition probable say well-nigh the role of national DPAs, the one-stop-shop physical care for together with the powers of the Board.

National information protection authorities

The electrical flow Directive already provides for the existence of DPAs, together with insists that they must do their powers inward ‘complete independence’. CJEU example constabulary (discussed here) has laid out a really potent interpretation of this notion, ruling that Germany, Republic of Austria together with Republic of Hungary breached it, because they provided for also much accountability to national parliaments (Germany), failed to split upwards the DPA from the ordinary civil service (Austria) together with defenestrated the DPA boss earlier his normal term of purpose expired (Hungary).

The proposed Regulation would retain together with elaborate upon this concept, together with the Council together with EP concur alongside most of the Commission’s suggestions. Admittedly, the DPAs receive got to last appointed past times world authorities inward the offset place: afterwards all, their powers don’t stalk from existence bitten past times a radioactive spider, or orphaned inward a bat-infested dorsum alley. The Council would ameliorate the proposal hence that they don’t receive got to last appointed past times the regime or parliament, but could instead last appointed past times the caput of nation or independent body. Only the final option would fully ensure their independence from the outset (although who appoints the ‘independent body’?)

Three points of work organisation here. First, the proposal would usefully demand the national DPAs to last adequately funded. That is easier said than done, for most DPAs complain of an absence of sufficient funding. For instance, the Irish Gaelic DPA occupies a small office adjacent to a corner store – but purports to regulate (among many other things) all of Facebook’s activities inward the EU.  Secondly, the Council would take away the proposed dominion requiring that DPAs last independent ‘beyond doubt’ when they are appointed; but DPAs should non last a resting set down for political hacks together with bagmen. Thirdly, the Council would take away most of the details concerning the loss of purpose of DPAs, retaining exclusively the minimum dominion of 4 years inward office. As the termination of the Hungarian DPA showed, it’s difficult to do your powers independently if y'all constantly fearfulness that at that spot may last Kryptonite inward your coffee.

As for the powers of the DPAs, the Regulation would strengthen together with elaborate upon their electrical flow advisory together with enforcement roles. In particular, the electrical flow powers to investigate, intervene together with engage inward legal proceedings would last fleshed out, past times adding powers concerning audits, access to the premises of the controller together with processor, ordering compliance alongside a information subject’s request, the suspension of information flows, or the imposition of fines.  

But alongside these slap-up powers volition come upwards exclusively limited accountability. DPAs volition receive got to position out an annual world written report (and the EP fifty-fifty wants to weaken this obligation). But that’s the exclusively way that their decisions tin last controlled, unless a cross-border complication agency that other DPAs, or the European Data Protection Board (a kind of uber-DPA) gain jurisdiction, equally discussed below. Otherwise, the exclusively bodies which tin lookout these watchmen are the courts.

Settling disputes

Although the Commission is oft defendant of favouring over-centralisation inward the EU, its proposed model for a ‘one-stop-shop’ was highly decentralised. Where a computer or controller was established inward the European Union inward to a greater extent than than 1 Member State, the supervisory say-so of the ‘main establishment’ would receive got competence to regulate all that controller’s or processor’s activity inward all Member States. There would last novel rules on cooperation betwixt supervisory authorities, inward especial equally regards usual assistance (each DPA would ordinarily receive got to comply alongside requests from unopen to other DPA) together with articulation operations.

In several cases, however, a DPA would receive got had to ship a draft mensurate to the European Data Protection Board for its opinion. In particular, this would receive got applied to measures regulating processing concerning ‘offering of goods or services to information subjects inward several Member States, or monitoring of their behaviour’, or which would ‘substantially affect’ the complimentary movement of data. Following the Board’s opinion, the Commission could give its opinion, together with hence could ultimately adopt a binding mensurate if necessary. H5N1 determination of whatever supervisory say-so is enforceable inward all Member States, except where that DPA breaches the consultation rules, inward which example its determination isn’t valid.

However, the Council together with EP both concur to strip the Commission of all dispute short town powers, together with to confer binding powers on the Board instead. In the Council’s version, the DPA of the top dog establishment or unmarried establishment of the controller or processor would non last the sole authority, but exclusively the lead supervisory say-so for transnational processing. Even then, each national supervisory say-so would last competent to bargain alongside an number which exclusively concerned an establishment inward its State, or ‘substantially affects information subjects exclusively in’ that State, unless the atomic number 82 DPA decided to stair in.

There’s a complex physical care for for trying to attain a consensus on a determination betwixt the atomic number 82 DPA together with the other DPAs involved. But inward the lawsuit of a dispute betwixt them, equally regards the content of a draft decision, or who is the atomic number 82 DPA inward the offset place, or where the procedures aren’t followed, hence the European Data Protection Board tin adopt a binding decision.  The Council would take away the rules on enforceability together with unenforceability of DPA decisions, but the EP wants to strengthen them. In the lawsuit of disputes well-nigh the Board’s decisions, the preamble sets out detailed rules on whether litigation would accept house earlier the national or European Union courts.

The European Data Protection Board

It isn’t spelled out inward the top dog text of the proposed Regulation, but the hereafter Board is clearly a super-powered version of the electrical flow ‘Article 29 working party’, an advisory trunk which is (like the hereafter Board) made upwards of members of the national DPAs. That working political party tin give opinions on national information protection law, information protection inward the European Union together with tertiary countries, the amendment of the Directive together with codes of conduct. It has indeed issued many such opinions, which tin last found on its website. They are interesting documents which fascinate information protection specialists, but which receive got non yet had whatever direct impact on the interpretation of the constabulary past times the CJEU. In the Commission’s proposal, the working political party would last renamed together with it would receive got to a greater extent than advisory powers, but its essential role would non change.

However, this puny trunk is well-nigh to last transformed at the behest of the Council together with EP, which would both confer meaning powers upon it equally regards dispute short town (discussed above), along alongside a longer listing of advisory powers. The Council would also accept the logical stair of defining the Board equally a ‘body’ of the EU, alongside limited legal personality.

Finally, it should last noted that the hereafter European Data Protection Board should non last confused alongside the electrical flow European Data Protection Supervisor (EDPS) – although I suspect that this alarm volition last inward vain for many years to come. The EDPS is created past times split upwards legislation, together with has the role of enforcing information protection constabulary against the EU’s institutions together with other bodies, equally good equally advising on the evolution of European Union information protection law. Its role inward the novel Regulation volition last really limited. The Commission wants it to receive got a spot together with a deputy chair post service on the Board, but the Council rejects the offset proposition (relegating the EDPS to an observer role instead) together with both the Council together with the EP decline the 2d one. The EDPS volition furnish the Board’s secretariat, but the Council wants to construct a firewall betwixt the 2 administrations. In effect, piece both the Board together with the EDPS volition receive got a meaning role inward the EU’s information protection architecture, at that spot volition last almost no crossover betwixt them – rather similar comic books produced past times competing publishers.

Conclusion

It is sure necessary for the European Union to ensure that DPAs receive got effective powers to ensure the application of information protection law. Although it volition silent last possible for individuals to convey legal activity straight against information processors or controllers (under other parts of the Regulation, which the Council has non yet agreed), DPAs stay the principal method of enforcing the rules. However, the draft legislation does non fully address the key practical enquiry of sufficient ensuring resources for DPAs, together with at that spot is also non plenty protection against dismissal or for the initial independence of DPA staff inward the Council’s draft position.  

As for short town of disputes, the Commission’s thought of a atomic number 82 DPA having total jurisdiction was fairly attractive, although apparently it was torpedoed past times the objections of the Council’s legal service. The replacement organisation is comparatively convoluted, together with it has 1 key weakness – the absence of procedural rights for the master complainant earlier the Board. Also, it leaves intact greater possibilities of multiple DPAs acting equally regards the same computer or controller, alongside resulting greater complications for information subjects, DPAs together with information processors together with controllers alike. It volition in all probability accept unopen to fourth dimension (and perchance fifty-fifty litigation) earlier the novel organisation volition last working effectively. Furthermore, the Council’s removal of the rules well-nigh the unenforceability of DPA decisions which are taken inward contravention of the rules could atomic number 82 to complications inward the lawsuit of rebellious DPAs. Finally, the existence of parallel bodies alongside similar names (the Board together with the EDPS) may last unavoidable, but it unlikely to assist world agreement of the EU’s information protection system.

Share this post