menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Hungary) language
Contact our local member in Hungary mail_outline
Visit the website of Oppenheim account_balance

arrow_backPrevious Article
Article 55
Next Articlearrow_forward

Competence

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 55 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 55 keyboard_arrow_up

Key words related to article 55

Show the recitals of the Regulation related to article 55 keyboard_arrow_down Hide the recitals of the Regulation related to article 55 keyboard_arrow_up

(122) The general conditions for the member or members of the supervisory authority should be laid down by law in each Member State and should in particular provide that those members are to be appointed, by means of a transparent procedure, either by the parliament, government or the head of State of the Member State on the basis of a proposal from the government, a member of the government, the parliament or a chamber of the parliament, or by an independent body entrusted under Member State law. In order to ensure the independence of the supervisory authority, the member or members should act with integrity, refrain from any action that is incompatible with their duties and should not, during their term of office, engage in any incompatible occupation, whether gainful or not. The supervisory authority should have its own staff, chosen by the supervisory authority or an independent body established by Member State law, which should be subject to the exclusive direction of the member or members of the supervisory authority.

Show the recitals of the Directive related to article 55 keyboard_arrow_down Hide the recitals of the Directive related to article 55 keyboard_arrow_up

(62) Whereas the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of personal data;

The GDPR

Article 55 begins by restating the rule contained in Article 28, paragraphs 1 and 3, of the Directive that each supervisory authority shall be competent for the performance of the tasks assigned and the exercise of the powers conferred on it.

In its first version, Article 55 of the draft Regulation also provides a new competence, that of lead authority when the controller or the processor is established in several Member States, in order to ensure uniform application ("single window").

This new competence of the lead supervisory authority is now subject to a specific provision in Article 56 and will therefore be discussed under that provision. It was already noted that Article 55 makes Article 56 inapplicable where the processing is carried out by public authorities or private bodies acting on the basis of article 6, paragraph 1, point (c) (i.e. when the processing is necessary for compliance with a legal obligation to which the controller is subject) or (e) (i.e. when the processing is necessary for the performance of a task in the public interest or in the exercise of public

authority which is vested to the controller). In this case, the supervisory authority of the Member State concerned remains responsible.

Finally, pursuant to the terms of paragraph 3 of Article 55, the courts acting in their judicial capacity are not subject to the competence of the supervisory authorities to supervise processing operations but they shall still apply the material rules relating to the data protection.

The Directive

The question of the competence of the national supervisory authority was already addressed by Article 28, paragraphs 1 and 3, of the Directive. Accordingly, each supervisory authority shall have all the powers conferred on it in the territory of the relevant Member State, in order to ensure the compliance with the data protection rules of that territory.

Pursuant to this provision, each national authority is territorially competent to exercise its powers in accordance with the procedural law of the relevant Member State, whatever the national law applicable to the processing in question.

Potential issues

We do not see  a priori  any specific implementation difficulties.

arrow_back Previous Article • Article 55 • Next Article arrow_forward
arrow_back Previous Article • Article 55 Next Article arrow_forward

Summary

European Union

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the Lead Supervisory Authority - wp244rev.01 (5 April 2017)

(Endorsed by the EDPB)

Identifying a lead supervisory authority is only relevant where a controller or processor is carrying out the cross-border processing of personal data. Article 4(23) of the General Data Protection Regulation (GDPR) defines ‘cross-border processing’ as either the:

- processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or the

- processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

This means that where an organisation has establishments in France and Romania, for example, and the processing of personal data takes place in the context of their activities, then this will constitute cross-border processing.

Alternatively, the organisation may only carry out processing activity in the context of its establishment in France. However, if the activity substantially affects – or is likely to substantially affect - data subjects in France and Romania then this will also constitute crossborder processing.

Link

Guidelines on Personal data breach notification under Regulation 2016/679 - wp250rev.01 (6 February 2018)

(Endorsed by the EDPB)

The General Data Protection Regulation (the GDPR) introduces the requirement for a personal data breach (henceforth “breach”) to be notified to the competent national supervisory authority (or in the case of a cross-border breach, to the lead authority) and, in certain cases, to communicate the breach to the individuals whose personal data have been affected by the breach.

Obligations to notify in cases of breaches presently exist for certain organisations, such as providers of publicly-available electronic communications services (as specified in Directive 2009/136/EC and Regulation (EU) No 611/2013). There are also some EU Member States that already have their own national breach notification obligation. This may include the obligation to notify breaches involving categories of controllers in addition to providers of publicly available electronic communication services (for example in Germany and Italy), or an obligation to report all breaches involving personal data (such as in the Netherlands). Other Member States may have relevant Codes of Practice (for example, in Ireland). Whilst a number of EU data protection authorities currently encourage controllers to report breaches, the Data Protection Directive 95/46/EC, which the GDPR replaces, does not contain a specific breach notification obligation and therefore such a requirement will be new for many organisations. The GDPR now makes notification mandatory for all controllers unless a breach is unlikely to result in a risk to the rights and freedoms of individuals. Processors also have an important role to play and they must notify any breach to their controller.

The Article 29 Working Party (WP29) considers that the new notification requirement has a number of benefits. When notifying the supervisory authority, controllers can obtain advice on whether the affected individuals need to be informed. Indeed, the supervisory authority may order the controller to inform those individuals about the breach7. Communicating a breach to individuals allows the controller to provide information on the risks presented as a result of the breach and the steps those individuals can take to protect themselves from its potential consequences. The focus of any breach response plan should be on protecting individuals and their personal data. Consequently, breach notification should be seen as a tool enhancing compliance in relation to the protection of personal data. At the same time, it should be noted that failure to report a breach to either an individual or a supervisory authority may mean that under Article 83 a possible sanction is applicable to the controller.

Controllers and processors are therefore encouraged to plan in advance and put in place processes to be able to detect and promptly contain a breach, to assess the risk to individuals8, and then to determine whether it is necessary to notify the competent supervisory authority, and to communicate the breach to the individuals concerned when necessary. Notification to the supervisory authority should form a part of that incident response plan.

The GDPR contains provisions on when a breach needs to be notified, and to whom, as well as what information should be provided as part of the notification. Information required for the notification can be provided in phases, but in any event controllers should act on any breach in a timely manner.

In its Opinion 03/2014 on personal data breach notification9, WP29 provided guidance to controllers in order to help them to decide whether to notify data subjects in case of a breach. The opinion considered the obligation of providers of electronic communications regarding Directive 2002/58/EC and provided examples from multiple sectors, in the context of the then draft GDPR, and presented good practices for all controllers.

The current Guidelines explain the mandatory breach notification and communication requirements of the GDPR and some of the steps controllers and processors can take to meet these new obligations. They also give examples of various types of breaches and who would need to be notified in different scenarios.

Link

Retour au sommaire
arrow_back Previous Article • Article 55 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-230/14 (1 October 2015) - Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general

Judgment of the Court

C-245/20 (24 March 2022) - X and Z v Autoriteit Persoonsgegevens

Article 55(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the fact that a court makes temporarily available to journalists documents from court proceedings containing personal data in order to enable them better to report on the course of those proceedings falls within the exercise, by that court, of its ‘judicial capacity’, within the meaning of that provision.

Judgment of the Court

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 55 Next Article arrow_forward
Regulation
1e 2e

Art. 55

1.   Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.

2.   Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.

3.   Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.
1st proposal close

Art. 51

1.           Each supervisory authority shall exercise, on the territory of its own Member State, the powers conferred on it in accordance with this Regulation.

2.           Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union, and the controller or processor is established in more than one Member State, the supervisory authority of the main establishment of the controller or processor shall be competent for the supervision of the processing activities of the controller or the processor in all Member States, without prejudice to the provisions of Chapter VII of this Regulation.

3.           The supervisory authority shall not be competent to supervise processing operations of courts acting in their judicial capacity.
2nd proposal close

Art. 51

1. Each supervisory authority shall be competent to perform the tasks and exercise the powers conferred on it in accordance with this Regulation on the territory of its own Member State. (...)

2. Where the processing is carried out by public authorities or private bodies acting on the basis of points (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 51a does not apply.

3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. (...).
Directive close

Art. 28

(…).

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

(…).
Hungary
compare_arrows
visibility Old law

No (special) provision under Hungarian law.
Old law close

Legal status of the Authority

§ 38 Data Protection Act

[...]

(3) Within its scope of responsibilities conferred under Subsection (2), the Authority:

a) shall conduct inquiries upon notification;

b) may conduct ex officio administrative proceedings for data protection;

c) may conduct ex officio administrative proceedings for the control of secrets;

d) may file for court action in connection with any infringement concerning public information and information of public interest;

e) may intervene in actions brought by others;

f) maintain the data protection register;

in accordance with this Act.

(4) Within its scope of responsibilities conferred under Subsection (2), the Authority:

a) shall have powers to make recommendations for new regulations and for the amendment of legislation pertaining to the processing of personal data, to public information and information of public interest, and shall express its opinion on bills covering the same subject;

b) shall publish a report on its activities each year, by 31 March, and shall present this report to Parliament;

c) shall make recommendations in general, or to specific controllers;

d) shall give an opinion on special and ad hoc publication lists prescribed mandatory by this Act relating to the activities of the given body with public service functions;

e) shall collaborate with the bodies and persons defined in specific other legislation to represent Hungary in the common supervisory bodies of the European Union for data protection;

f) organize the conference of internal data protection officers;

g) shall lay down the technical criteria for data protection audits;

h) shall conduct data protection audit at the request of the controller.

[...]
Poland close

In force until May 25, 2018:

The Act on Personal Data Protection

 

Article 12

The duties entrusted to the Inspector General comprise, in particular:

1) supervision over ensuring the compliance of data processing with the provisions on the protection of personal data,

2) issuing administrative decisions and considering complaints with respect to the enforcement of the provisions on the protection of personal data,

3) ensuring the obligors’ fulfillment of non-pecuniary obligations arising under the decisions referred to in point 2 by the means of enforcement measures foreseen in the Act of 17 June 1966 on enforcement proceedings in administration (Journal of Laws of 2005, no. 229, item 1954 with amendments),

4) keeping the register of data filing systems and the register of administrators of information security, as well as providing information on the registered data files and the registered administrators of information security,

5) issuing opinions on bills and regulations with respect to the protection of personal data,

6) initiating and undertaking activities to improve the protection of personal data,

7) participating in the work of international organizations and institutions involved in personal data.

 

Article 14

In order to carry out the tasks referred to in Article 12 point 1 and 2, the Inspector General, the Deputy Inspector General or employees of the Bureau, hereinafter referred to as

“the inspectors”, authorized by him/her shall be empowered, in particular to:

1) enter, from 6 a.m. to 10 p.m., upon presentation of a document of personal authorization and service identity card, any premises where the data filing systems are being kept and premises where data are processed outside from the data filing system, and to perform necessary examination or other inspection activities to assess the compliance of the data processing activities with the Act,

2) demand written or oral explanations, and to summon and question any person within the scope necessary to determine the facts of the case,

3) consult any documents and data directly related to the subject of the inspection, and to make a copy of these documents,

4) perform inspection of any devices, data carriers, and computer systems used for data processing,

5) commission expertise and opinions to be prepared.

 

Article 19

Should the inspection reveal that the action or failure in duties of the head of an organizational unit, its employee or any other natural person acting as the controller bears attributes of an offence within the meaning of the Act, the Inspector General shall inform about it a proper prosecuting body, enclosing the evidence confirming his/her suspicions.

 

Article 19a

1. In order to perform the tasks referred to in Article 12 point 6, the Inspector General may address state authorities, territorial self-government authorities, as well as To state and municipal organizational units, private entities performing public tasks, natural and legal persons, organizational units without legal personality and other entities in order to ensure efficient protection of personal data.

2. The Inspector General may also request competent authorities to undertake legislative initiatives and to issue or to amend legal acts in cases relative to personal data protection.

3. The entity receiving the address or request referred in paragraphs 1 and 2 shall give an answer in writing to such address or request within 30 days of its receipt.

 

Article 19b

1. The Inspector General can request an administrator of information security entered into the register referred to in Art. 46c to carry out a check referred to in Art. 36a para. 2 point 1 letter a) at the controller’s, who appointed the administrator of information security, indicating the scope and date of the check.

2. After carrying out the check referred in Art. 36a para. 2 point 1 letter a), the administrator of information security, through the agency of the controller, shall submit to the Inspector General a report referred to in Art. 36a para. 2 point 1 letter a).

3. The fact that the administrator of information security has carried out a check in the case referred to in para. 1 does not exclude the Inspector General’s right to carry out a supervision referred to in Art. 12 point 1.
arrow_back Previous Article • Article 55 Next Article arrow_forward
close

2016 - www.itiplaw.eu.