3.2. Member States

Similarly to the Data Protection Directive, the draft regulation requires each Member to designate one or more public authorities to monitor the application of the rules of the Regulation. One supervisory authority will act as a contact point and participate in the EDPB. Members of national supervisory authorities must be appointed by the parliament or the government of each EU Member and be selected from among individuals whose independence is beyond any doubt.

The draft regulation expands the role of the supervisory authorities to cooperate with each other and with the Commission. Based on the decision of the ECJ in the case of Commission v. Germany, which dealt with the independence of supervisory authorities, the Draft Regulation also expands on the independence of supervisory authorities. Each supervisory authority has competence within the territory of the Member State where it is located. The draft regulation proposes a “one-stop shop” by which a supervisory authority is granted additional competence when a controller or a processor is established in several Member States [15, art. 51]. The supervisory authority is required to prepare annual reports describing the application and enforcement of data protection rules in the individual Member States.

The draft regulation makes a distinction between duties assigned to the supervisory authorities and powers bestowed on them. Supervisory authorities have the following duties:

• monitoring the application of the provisions of the draft regulation;

• hearing and investigating complaints either on its own initiative or based on complaints by the data subject, which must be handled free of charge;

• approving binding rules;

• issuing opinions on the draft codes of conduct adopted pursuant to article 38(2);

• promoting public awareness of the risks, rules, safeguards, and rights of Individuals [15, art. 52].

Some of the key powers of the supervisory authorities are the following:

• notifying the controller or the processor of an alleged breach of the rules on processing of personal data and ordering both to remedy the situation;

• imposing a definite or temporary ban on processing;

• bringing to the attention of judicial authorities violations of the rules contained in the regulation;

• engaging in legal proceedings, in case an individual or a legal person initiates legal action against a decision of a supervisory authority;

• ordering the controller and processor to comply with the requests of data subjects;

• ordering the rectification, erasure, or destruction of data processed in violation of the draft regulation;

• imposing a ban on processing;

• suspending data flows to a recipient in a third country or to an international organization;

• issuing opinions on issues involving personal data protection [15, art. 53].

3. Designation of Data Protection Officers

An additional safeguard envisioned by the draft regulation is the designation of a data protection officer by controllers or processors when the processing of personal data is carried out by a public authority or by an enterprise that employs 250 persons or more, or when the processing requires the regular and systematic monitoring of data subjects because of its scope and purpose [15, art. 35].