EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
Proceedings are typically triggered by (i) complaints lodged by data subjects (Article 77, GDPR), (ii) refer - rals or co-operation requests from other supervisory authorities in cross-border cases, or (iii) ex officio investigations. In cross-border cases, the “one-stop- shop” mechanism (Articles 56 and 60, GDPR) desig - nates a lead supervisory authority, which co-operates with other “concerned” authorities. Disputes may be escalated to the EDPB for a binding decision under Article 65, GDPR. NSAs also enforce Directive 2016/680 (law enforce - ment data processing) and, depending on national law, the ePrivacy Directive (2002/58/EC), sometimes alongside or instead of sector-specific regulators (eg, telecommunications authorities). Their decisions are binding domestically, subject to judicial review. European Data Protection Board (EDPB) Established under Articles 68–76, GDPR, the EDPB ensures consistent application of the GDPR across the Union. It issues guidelines, recommendations and best practices (Article 70 GDPR), advises the European Commission (including on adequacy decisions), and adopts binding decisions in dispute resolution under Article 65. Its guidelines are formally non-binding but highly persuasive in practice; Article 65 decisions are legally binding on the national authorities concerned. European Data Protection Supervisor (EDPS) The EDPS supervises compliance with EU data pro - tection rules by EU institutions, bodies and agencies (currently under Regulation (EU) 2018/1725). It exer - cises comparable investigative and corrective powers within the EU institutional framework and may issue reprimands, orders or administrative fines. Its deci - sions are binding on EU institutions and subject to review by the CJEU. Sectoral and Related Authorities Under the ePrivacy Directive, member states may designate specific authorities for rules on confidenti - ality of communications, cookies and direct marketing rules. The GDPR’s one-stop-shop mechanism does not automatically apply to national rules implement - ing the ePrivacy Directive, which may lead to parallel national proceedings.
In addition, for international data transfers, the Euro - pean Commission plays a key role through adequacy decisions (Article 45, GDPR), while national authori - ties retain investigative powers and may refer validity questions to the CJEU (as illustrated by Schrems case law). 1.8 Enforcement Proceedings and Fines Under EU law, investigations and enforcement actions in data protection matters are primarily governed by the GDPR, which establishes a decentralised enforce - ment system based on independent national super - visory authorities (Articles 51–59, GDPR), combined with a co-operation and consistency mechanism for cross-border processing (Articles 56, 60–66, GDPR). Initiation of Investigations Proceedings may be triggered by (i) a complaint lodged by a data subject (Article 77, GDPR), (ii) ex officio action by a NSA, or (iii) a co-operation request from other supervisory authorities in cross-border cases (Articles 60–61, GDPR). In cross-border sce - narios, the “lead supervisory authority” (usually that of the controller’s main establishment) conducts the investigation under the one-stop-shop mechanism (Article 56, GDPR), in co-operation with “concerned” authorities. If disagreement persists, the matter may be referred to the EDPB, which can adopt a binding decision under the consistency mechanism (Article 65, GDPR). Conduct of Investigations and Procedural Guarantees NSAs have extensive investigative powers, includ - ing the power to order the provision of information, carry out audits and inspections, and access to prem - ises and data (Article 58 (1), GDPR). They may adopt corrective measures (Article 58 (2) GDPR), including warnings, reprimands, orders to comply, temporary or definitive processing bans, suspension of data flows and administrative fines. The GDPR does not fully harmonise procedural time - lines for investigations; these are governed by nation - al administrative law, subject to EU law principles of effectiveness, equivalence and the right to good administration (Article 41, Charter of Fundamental Rights of the EU) and the right to an effective remedy
93 CHAMBERS.COM
Powered by FlippingBook