1.3.2 Main Powers of the Supervisory Bodies
On UN level, tasks fulfilled by the UNHRC and its subsidiary entities are of a
reporting and advising nature. Unlike the United Nations Security Council for
instance, the UNHRC does not hold sanctioning powers. It is not to be considered
as an organ according to Chapter III of the Charter of the United Nations.
Under the UNHCR Policy, the data controller is a “UNHCR staff member,
usually the representative in a UNHCR country office”.
27 He or she bears the
main responsibility for compliance with the policy in that specific country. The
data controller should therefore designate a data protection focal point.
28 That is “in
principle, the most senior UNHCR protection staff member in a UNHCR country
office or operation, who assists the data controller in carrying out his or her
responsibilities regarding this Policy”.
29 In contrast, it is the task of the data
protection officer to provide support for the Data Controllers and to draw an annual
data protection report.
The Special Rapporteur on the Right to Privacy has the following duties
according to Resolution 28/16:
a) To gather relevant information, (. . .); b) To seek, receive and respond to information (. . .)
from (. . .) any (. . .) relevant stakeholders or parties; c) To identify possible obstacles to the
promotion and protection of the right to privacy, to identify, exchange and promote
principles and best practices at the national, regional and international levels, and to submit
proposals and recommendations to the Human Rights Council in that regard (. . .); (. . .)
(g) To report on alleged violations, wherever they may occur, of the right to privacy, as set
out in article 12 of the Universal Declaration of Human Rights and article 17 of the
International Covenant on Civil and Political Right (. . .); h) To submit an annual report to
the Human Rights Council and to the General Assembly (. . .).
The CoE Privacy Framework requires authorities to have powers of investigation
and intervention (article 15 section 2 a)) and to perform the functions relating to
transfers of data provided under article 14 [Transborder flows of personal data],
notably the approval of standardized safeguards (article 15 section 2 b)), to issue
decisions with respect to violations of the provisions of the Convention and, in
particular, to impose administrative sanctions.
Regarding sanctioning on ECOWAS level, “in case of emergency, when
processing and use of personal data leads to a violation of rights and liberties”, at
first the supervisory body is obliged to conduct “a hearing inter partes”. As next
step, it can “suspend the processing”, “block certain personal data processed” or
“temporarily or permanently prohibit any processing that is contrary to the provisions of this Supplementary Act”, article 19, paragraph 3.
27 UNHCR Policy, p. 9.
28 UNHCR Policy, p. 41.
29 UNHCR Policy, p. 9.
528
T. Hoeren
On UN level, tasks fulfilled by the UNHRC and its subsidiary entities are of a
reporting and advising nature. Unlike the United Nations Security Council for
instance, the UNHRC does not hold sanctioning powers. It is not to be considered
as an organ according to Chapter III of the Charter of the United Nations.
Under the UNHCR Policy, the data controller is a “UNHCR staff member,
usually the representative in a UNHCR country office”.
27 He or she bears the
main responsibility for compliance with the policy in that specific country. The
data controller should therefore designate a data protection focal point.
28 That is “in
principle, the most senior UNHCR protection staff member in a UNHCR country
office or operation, who assists the data controller in carrying out his or her
responsibilities regarding this Policy”.
29 In contrast, it is the task of the data
protection officer to provide support for the Data Controllers and to draw an annual
data protection report.
The Special Rapporteur on the Right to Privacy has the following duties
according to Resolution 28/16:
a) To gather relevant information, (. . .); b) To seek, receive and respond to information (. . .)
from (. . .) any (. . .) relevant stakeholders or parties; c) To identify possible obstacles to the
promotion and protection of the right to privacy, to identify, exchange and promote
principles and best practices at the national, regional and international levels, and to submit
proposals and recommendations to the Human Rights Council in that regard (. . .); (. . .)
(g) To report on alleged violations, wherever they may occur, of the right to privacy, as set
out in article 12 of the Universal Declaration of Human Rights and article 17 of the
International Covenant on Civil and Political Right (. . .); h) To submit an annual report to
the Human Rights Council and to the General Assembly (. . .).
The CoE Privacy Framework requires authorities to have powers of investigation
and intervention (article 15 section 2 a)) and to perform the functions relating to
transfers of data provided under article 14 [Transborder flows of personal data],
notably the approval of standardized safeguards (article 15 section 2 b)), to issue
decisions with respect to violations of the provisions of the Convention and, in
particular, to impose administrative sanctions.
Regarding sanctioning on ECOWAS level, “in case of emergency, when
processing and use of personal data leads to a violation of rights and liberties”, at
first the supervisory body is obliged to conduct “a hearing inter partes”. As next
step, it can “suspend the processing”, “block certain personal data processed” or
“temporarily or permanently prohibit any processing that is contrary to the provisions of this Supplementary Act”, article 19, paragraph 3.
27 UNHCR Policy, p. 9.
28 UNHCR Policy, p. 41.
29 UNHCR Policy, p. 9.
528
T. Hoeren