GDPR unifies the scope and form of competences of supervisory authorities.
Recital 129 of GDPR explains that supervisory authorities should have in each Member State the same tasks and effective powers in order to ensure consistent monitoring and enforcement of GDPR throughout the Union, but Member States may specify additional tasks related to the protection of personal data. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards, impartially, fairly and within a reasonable time. Measures applied by supervisory authorities should be appropriate, necessary and proportionate; should take into account the circumstances of an individual case; respect the right of every person to be heard before any individual measure which would adversely affect them is adopted; and avoid superfluous costs and excessive inconveniences for the persons concerned. These measures should be in writing, be clear and unambiguous, and contain obligatory elements like: indication of the supervisory authority that has issued the measure, date, signature of the head or a member of the supervisory authority, reasons for the measure and information about the right of an effective remedy.
Taking into account the structure of Article 58 of GDPR, powers conferred on supervisory authorities may be divided into five categories:
- 1)investigative powers,
- 2)corrective powers,
- 3)authorisation and advisory powers,
- 4)powers related to judicial remedies,
- 5)additional powers provided by national law of a Member State.
Article 58(1) of GDPR grants the supervisory authority investigative competences related to exercising control over data processing. Most of those powers refer to the activities taken by controller and processor, who are the addressees of orders or requests and should satisfy them by, for e.g., providing information, or allowing access to personal data, information, premises and resources. Supervisory authorities are also authorised to carry out data protection audits and verify certifications issued pursuant to Article 42(7) of GDPR.
Corrective powers indicated in Article 58(2) of GDPR are various and depend on whether data processing operations are only planned or already in place. They may be exercised in the form of warnings, reprimands, orders, fines, limitation or ban on processing. As regards the certification procedure, the supervisory authority is entitled to withdraw a certification.
A wide range of authorisation and advisory powers has been conferred on supervisory authorities according to Article 58(3) of GDPR. These competences relate to specific obligations under GDPR and in particular refer to prior consultations, codes of conduct, certification, standard contractual clauses and binding corporate rules. They can take different forms like issuing permits, providing advice, opinions, accreditation or approvals.
Member States are required to provide by law the supervisory authority with the power to notify violations of GDPR to the judicial authorities, as well to commence or engage otherwise in legal proceedings, in order to enforce the provisions of GDPR. Supervisory authorities may be also attributed additional powers by national laws of Member States.
The activities of the supervisory authority indicated in Article 58 of GDPR are subject to control and appropriate safeguards. This is why Article 58(4) emphasises the need and obligation for Member States to grant effective judicial remedy and due process regarding the execution of powers by supervisory authorities.