PL EN
Book a meeting
Chapter 7The Regulator
  1. Chapter 1Basic Compliance
  2. Chapter 2Data Subject’s Rights
  3. Chapter 3Security
  4. Chapter 4Data Processing
  5. Chapter 5Managing Incidents and Data Breaches
  6. Chapter 6Data Protection Officer (DPO)
  7. Chapter 7The Regulator
  8. Chapter 8Legal Remedies, Liability, Administrative Sanctions
  9. Appendix IPersonal Data Protection Policy
  10. Appendix IIData Processing Agreement
  11. Appendix IIIJoint Controllership Agreement
Section 7.1
  1. 7.1The Supervisory Authority: Status, Role and Obligations
  2. 7.2Independent Status
  3. 7.3Appointment and General Conditions for the Members of the Supervisory Authority
  4. 7.4Competence of the Supervisory Authority
  5. 7.5Tasks of the Supervisory Authority
  6. 7.6Powers of the Supervisory Authority
  7. 7.7Activity Reports
  8. 7.8The Role of the Supervisory Authority Within the Cooperation and Consistency Mechanism

The Supervisory Authority: Status, Role and Obligations

Adrianna Michałowicz & Dominik Lubasz

#1.1 Preliminary Remarks

Article 51 of General Data Protection Regulation (GDPR) requires Member States to establish at least one supervisory authority in order to guarantee the proper functioning of data protection system in the European Union (EU). The legal source of this obligation may be found in Article 16(2) of the Treaty on the Functioning of the EU and Article 8(3) of Charter of Fundamental Rights of the EU which stipulate that compliance with data protection rules shall be subject to the control of independent authorities.

The obligation to establish independent supervisory authorities existed already under Directive 95/46/EC. Provisions currently in force, however, enlarge the scope of powers given to supervisory authorities. This is because supervisory authorities are playing essential role in protecting natural persons with regard to the processing of their personal data. According to Article 51(1) of GDPR, the basic task of supervisory authorities is to monitor the application of the regulation, which means that supervisory authorities are eligible to carry out control, inspection, audit and take every action necessary to ensure compliance with GDPR. They are required as well to contribute to the consistent application of GDPR throughout the Union (Article 51(2)).

Article 51(1) of GDPR leaves a choice for Member States to decide whether to establish one or more public authorities, depending on their constitutional, organisational and administrative structure. If a Member State chooses to set up more than one public authority, it has to guarantee at the same time consistent application of GDPR, especially with regard to the execution of data subjects’ rights. It should also establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism, particularly designate the supervisory authority that will act as a single contact point for the effective participation of those authorities in the mechanism and cooperation between them, the European Data Protection Board and the European Commission.

#1.2 Independence