The role of DPAs in supervising police and criminal justice - - PowerPoint PPT Presentation

The role of DPAs in supervising police and criminal justice authorities processing personal data

Paul de Hert and Juraj Sajfert

PHAEDRA II - IMPROVING PRACTICAL AND HELPFUL CO-OPERATION BETWEEN DATA PROTECTION AUTHORITIES II http://www.phaedra-project.eu/

Directive (EU) 2016/680

Ma Main in obje ject ctive ives: s:

• Hig

igh le leve vel l of pro rotect ctio ion of personal data, taking account of the specific context of police and criminal justice

• Smo

Smoother r exch xchange of in informa rmatio ion between Member States' police and judicial authorities

• Imp

mpro rove ve co coopera ratio ion in the fight against terrorism and other serious crime in Europe

Directive (EU) 2016/680

• Ma

Main in ch changes: s:

• A Dire

irect ctive ive for the former third pillar

• Covers dome

mest stic ic pro roce cessin ssing (added value in relation to FD 2008/977/JHA)

• Data protection by desig

sign and data protection by default lt – data protection starting and not an ending point of personal data processing

• Increased accountability of LEA (e.g.

mandatory DP DPIA A and DPO POs, notifications of perso rsonal l data bre reach ches)

Independent administrative supervision

• Comp

mple lete independence

• Article 8(3) Charter of Fundamental Rights
• case law of CJEU
• Choice

ice between „police” DPAs or „general” DPAs

• should the DPA that has been set up under GDPR

supervise also police and criminal justice authorities?

DPAs’ competence

Su Supervisio rvision of police and criminal justice

authorities wit

ithin in a Me Memb mber r St State Excluded:

• courts acting in their judicial capacity
• ptionally, independent judicial authorities when acting

in their judicial capacity

• How will the independent supervision be ensured?

DPAs’ powers

EFFECTIVE POWERS

• Investigative powers – access to data
• Corrective powers – „such as, for example”
• Advisory powers – prior consultation and policy advice
• No power to initiate court proceedings

DPAs handling complaints

• The DPA in

in the Me Memb mber r St State of the controller/ processor handles the case alone

• „Post-box DPA” – choice of the data subject
• Mandated NGO can represent data subject
• No

No one-stop-shop, consistency mechanism etc.

• Bu

But, mutual assistance

• What is the role of the European Data Protection

Board?

Conclusion

• Comp

mple lete in independence ce of DPAs

• Limit

imited area of administrative supervision (courts and independent prosecutors partly excluded)

• Ef

Effect ctive ive powers, but which powers?

• Ve

Very ry limit limited cross-border DPA activites