Article 28 Supervisory authority
- Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
These authorities shall act with complete independence in exercising the functions entrusted to them.
- Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.
- Each authority shall in particular be endowed with:
- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties;
- effective powers of intervention, such as, for example, that of delivering opinions in accordance with Article 20, before processing operations are carried out and ensuring appropriate publication of such opinions, or that of ordering the blocking, erasure or destruction of data, or of imposing a temporary or definitive ban on processing, or that of warning or admonishing the controller or that of referring the matter to national parliaments or other political institutions;
- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.
Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
- Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.
Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.
- Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.
- Each supervisory authority is competent, whatever the national law applicable to the processing in question, for exercising, on the territory of its own Member State, the powers attributed to it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.
The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.
- Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.
Article 29 Working Party on the Protection of Individuals with regard to the Processing of Personal Data
- A Working Party on the Protection of Individuals with regard to the Processing of Personal Data, hereinafter referred to as "the Working Party", is hereby set up.
It shall have advisory status and act independently.
- The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State and of a representative of the authority or authorities established for Community institutions and bodies, and of a representative of the Commission.
Each member of the Working Party shall be designated by the institution, authority or authorities which he represents. Where a Member State designates more than one supervisory authority, they shall nominate a joint representative. The same shall apply for the authorities established for Community institutions and bodies.
- The Working Party shall take decisions by a simple majority of the representatives of the supervisory authorities.
- The Working Party shall elect its chairman. The chairman's term of office shall be two years. His appointment shall be renewable.
- The Working Party's secretariat shall be provided by the Commission.
- The Working Party shall adopt its own rules of procedure.
- The Working Party shall consider items placed on its agenda by its chairman, either on his own initiative or at the request of a representative of the supervisory authorities or at the Commission's request.
- The Working Party shall:
(a) examine any question covering the application of the national measures adopted under this Directive in order to contribute to the uniform application of such measures;
(b) give the Commission an opinion on the level of protection in the Community and in third countries;
(c) advise the Commission on any proposed amendment of this Directive, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data and on any other proposed Community measures affecting such rights and freedoms;
(d) give an opinion on codes of conduct drawn up at Community level.
- If the Working Party finds that divergences likely to affect the equivalence of protection for persons with regard to the processing of personal data in the Community are arising between the laws or practices of Member States, it shall inform the Commission accordingly.
- The Working Party may, on its own initiative, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the Community.
- The Working Party's opinions and recommendations shall be forwarded to the Commission and to the committee referred to in Article 31.
- The Commission shall inform the Working Party of the action it has taken in response to its opinions and recommendations. It shall do so in a report which shall also be forwarded to the European Parliament and the Council. The report shall be made public.
- The Working Party shall draw up an annual report on the situation regarding the protection of natural persons with regard to the processing of personal data in the Community and in third countries, which it shall transmit to the Commission, the European Parliament and the Council. The report shall be made public.