Who Enforces EU Data Protection Law? Supervisory Authorities, the EDPB, and the EDPS Explained

What Is an EU Supervisory Authority?

A supervisory authority (SA), also known as a data protection authority (DPA), is an independent public authority that monitors the application of European data protection law through investigative and corrective powers.

Supervisory authorities provide expert advice on data protection issues and handle complaints concerning possible violations of European data protection law, including the General Data Protection Regulation (GDPR) and relevant national laws.

Each EU Member State must establish one or more supervisory authorities.

• Article 8(3) of the Charter of Fundamental Rights of the European Union requires compliance with data protection rules to be subject to control by an independent authority.
• Article 77 GDPR gives every data subject the right to lodge a complaint with a supervisory authority.

Article 8 of the Charter of Fundamental Rights of the European Union

1. Everyone has the right to the protection of personal data concerning him or her.

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.

3. Compliance with these rules shall be subject to control by an independent authority.

See, GDPR Article 51 et. sec.

Generally speaking, the main contact point for questions about data protection is the supervisory authority in the EU Member State where an organization is established. If an organization carries out cross-border processing, however, the lead supervisory authority may be the authority of the organization’s main establishment or single establishment in the European Economic Area.

The GDPR’s one-stop-shop mechanism applies only where the processing is cross-border within the meaning of Article 4(23) GDPR.

What Is the European Data Protection Board?

The European Data Protection Board (EDPB) is an independent European body with legal personality. It works to ensure that the GDPR and the Law Enforcement Directive are applied consistently throughout the European Economic Area and promotes cooperation among national supervisory authorities, including cooperation on enforcement.

• The EDPB is composed of the head of one supervisory authority from each EU Member State and the European Data Protection Supervisor (EDPS), or their representatives. Where a Member State has more than one supervisory authority, it appoints a joint representative to the Board.
• The EDPB provides guidance on the interpretation of EU data protection law, advises the European Commission, encourages consistent enforcement, and adopts binding decisions in certain disputes between supervisory authorities. Through this work, it seeks to ensure that individuals across Europe benefit from equivalent data protection rights and consistent enforcement.

See, GDPR Articles 68 et. sec.

NOTE: The EDPB is the successor to the Article 29 Working Party, the independent advisory body established under Article 29 of Directive 95/46. When the GDPR became applicable in May 2018, the EDPB replaced the Working Party and assumed many of its functions, including issuing guidance and promoting consistent interpretation of EU data protection law. Unlike the Article 29 Working Party, however, the EDPB is an EU body with legal personality and may adopt binding decisions in certain disputes between national supervisory authorities.

What Is the European Data Protection Supervisor?

The European Data Protection Supervisor (EDPS) is the independent supervisory authority responsible for protecting personal data and privacy when EU institutions and bodies process personal data. Its supervisory and enforcement work therefore concerns EU institutions and bodies, rather than private organizations or Member State authorities, which are generally supervised by national data protection authorities.

• The EDPS monitors compliance, investigates possible infringements, handles complaints, and provides guidance to EU institutions and bodies. It also advises the EU legislature on proposed legislation and policy developments that may affect privacy, assesses the data protection implications of new technologies, and participates as a member of the European Data Protection Board.
• The EDPS also supervises and monitors the implementation of the EU AI Act by EU institutions and bodies. Its work is supported by specialized units addressing supervision and enforcement, policy and consultation, technology and privacy, artificial intelligence, communications, and internal administration.

See, Article 52 of Regulation (EU) 2018/1725

Independence of Supervisory Authorities

EU data protection law has long required independent supervisory authorities. The second subparagraph of Article 28(1) of Directive 95/46 required those authorities to act with "complete independence". Today, independent supervision is both a constitutional requirement under Article 8(3) of the Charter (reproduced above) and an express requirement of Article 52 GDPR.

The Court of Justice of the European Union (CJEU) has developed the meaning of independence through its case law. The Court has held that:

• State scrutiny capable of influencing a supervisory authority’s decisions is incompatible with complete independence.
• Parliament or government may appoint the authority’s management; legislation may define its powers; and the authority may be required to report its activities to parliament. Those forms of democratic accountability do not, by themselves, deprive the authority of its independence.
• Functional independence—under which members are independent and are not bound by instructions in performing their duties—is essential but not sufficient. A supervisory authority must be protected from all direct and indirect external influence liable to affect its decisions.

Additional Resources

Case Law

• Commission v. Germany: Why Data Protection Authorities Must Be Free From State Influence. Independence requires a status that allows a supervisory authority to act freely, without instructions or pressure. It extends beyond independence from regulated entities and excludes direct or indirect external influence, including influence by the State or the Länder, that could affect the authority’s decisions. Read the Article
• Commission v Austria Why Formal Independence Is Not Enough. Functional independence is essential but not sufficient. Austria failed to satisfy the independence requirement because the managing member remained a federal official subject to supervision, the authority’s office was integrated into the Federal Chancellery, and the Federal Chancellor held an unconditional right to information covering all aspects of the authority’s work. Read the Article.
• Schrems I: When EU Data Protection Crossed the Atlantic — Demonstrates the practical importance of independent national supervisory authorities. The CJEU held that a Commission adequacy decision cannot prevent an authority from examining an individual complaint, although only the CJEU may invalidate the EU act. The case illustrates how supervisory independence, complaint handling, national judicial review, and the CJEU work together to protect data-subject rights. Read the Article.

Guidance

Article 29 Working Party Guidelines for Identifying a Controller or Processor’s Lead Supervisory Authority, WP 244 rev.01 — The EDPB has endorsed these guidelines.

Supervisory Authority Directory

The European Data Protection Board maintains the current list and contact details for the supervisory authorities of all EU Member States, together with the EEA supervisory authorities that participate in the Board’s GDPR-related work without voting rights. Germany has several federal and regional supervisory authorities; its Federal Commissioner for Data Protection and Freedom of Information serves as Germany’s joint representative on the EDPB.

• European Data Protection Board — Our Members