Member State. Unlike the previous regime,
18 the provisions of the Regulation on its
territorial scope (Art. 3 GDPR) do not determine the competent national supervisory
authority. The Regulation includes specific provisions on the distribution of competences between the supervisory authorities of the Member States with regard to
cross-border situations. The GDPR introduces the so-called one-stop-shop mechanism that ensure that one national data protection authority (DPA) is responsible for
the supervision of cross-border data operations carried out by a controller or
processor in the EU. The GDPR establishes a consistency mechanism for cooperation between the national supervisory authorities.
With a view to guarantee consistent enforcement of the GDPR throughout the
Union, the supervisory authorities have in each Member State the same powers. The
tasks of the DPA’s are listed in Article 57 of the GDPR and the powers are dealt with
in Article 58. The tasks include to monitor and enforce the application of the
Regulation; promote public awareness on data protection issues; perform advisory
functions; handle complaints lodged by a data subject; conduct investigations on the
application of the Regulation. The powers of the supervisory authorities are classified in Article 58 in three main groups: investigative powers (such as request and
obtain access to information an premises, carry out data protection audits, notify
alleged infringements); corrective powers (including to issue warnings and reprimands, order to comply with a data subject’s request, to impose a limitation
including a ban on processing or to impose an administrative fine); and authorisation
and advisory powers (such as to issue opinions, to issue certifications or to adopt
certain authorisations). Supervisory authorities are empowered to bring infringements of the GDPR to the attention of the judicial authorities and engage in legal
proceedings. The exercise of the powers conferred on the supervisory authority is the
subject to effective judicial remedy and due process.
2 Personal Data Processed by Electronic Means
2.1 Main Principles
The general legislative framework established in the GDPR applies also to the
protection of personal data in the context of services provided at a distance, by
electronic means. It covers the processing of personal data wholly or partly by
automated means [Arts. 2(1)], including the collection, recording, structuring, storage, alteration, retrieval, consultation, use, disclosure and making available of such
data [Art. 4(2)]. Therefore, the GDPR applies to the protection of personal data in
18 CJEU Judgment of 1 October 2015 in case C-230/14, Weltimmo s.r.o. v. Nemzeti Adatvédelmi és
Információszabadság Hatóság, ECLI:EU:C:2015:639 and CJEU Judgment of 5 June 2018 in case
C-210/16,
Unabhängiges
Landeszentrum
für
Datenschutz
Schleswig-Holstein
v. Wirtschaftsakademie Schleswig-Holstein GmbH, ECLI:EU:C:2018:388.
462
P. A. de Miguel Asensio
18 the provisions of the Regulation on its
territorial scope (Art. 3 GDPR) do not determine the competent national supervisory
authority. The Regulation includes specific provisions on the distribution of competences between the supervisory authorities of the Member States with regard to
cross-border situations. The GDPR introduces the so-called one-stop-shop mechanism that ensure that one national data protection authority (DPA) is responsible for
the supervision of cross-border data operations carried out by a controller or
processor in the EU. The GDPR establishes a consistency mechanism for cooperation between the national supervisory authorities.
With a view to guarantee consistent enforcement of the GDPR throughout the
Union, the supervisory authorities have in each Member State the same powers. The
tasks of the DPA’s are listed in Article 57 of the GDPR and the powers are dealt with
in Article 58. The tasks include to monitor and enforce the application of the
Regulation; promote public awareness on data protection issues; perform advisory
functions; handle complaints lodged by a data subject; conduct investigations on the
application of the Regulation. The powers of the supervisory authorities are classified in Article 58 in three main groups: investigative powers (such as request and
obtain access to information an premises, carry out data protection audits, notify
alleged infringements); corrective powers (including to issue warnings and reprimands, order to comply with a data subject’s request, to impose a limitation
including a ban on processing or to impose an administrative fine); and authorisation
and advisory powers (such as to issue opinions, to issue certifications or to adopt
certain authorisations). Supervisory authorities are empowered to bring infringements of the GDPR to the attention of the judicial authorities and engage in legal
proceedings. The exercise of the powers conferred on the supervisory authority is the
subject to effective judicial remedy and due process.
2 Personal Data Processed by Electronic Means
2.1 Main Principles
The general legislative framework established in the GDPR applies also to the
protection of personal data in the context of services provided at a distance, by
electronic means. It covers the processing of personal data wholly or partly by
automated means [Arts. 2(1)], including the collection, recording, structuring, storage, alteration, retrieval, consultation, use, disclosure and making available of such
data [Art. 4(2)]. Therefore, the GDPR applies to the protection of personal data in
18 CJEU Judgment of 1 October 2015 in case C-230/14, Weltimmo s.r.o. v. Nemzeti Adatvédelmi és
Információszabadság Hatóság, ECLI:EU:C:2015:639 and CJEU Judgment of 5 June 2018 in case
C-210/16,
Unabhängiges
Landeszentrum
für
Datenschutz
Schleswig-Holstein
v. Wirtschaftsakademie Schleswig-Holstein GmbH, ECLI:EU:C:2018:388.
462
P. A. de Miguel Asensio