genuine independence in the fulfilment of their duties.
They are an essential component of the data protection
supervisory system in a democratic society. In so far
as Article 11, paragraph 3, applies, other appropriate
mechanisms for independent and effective review
and supervision of processing activities for national
security and defence purposes may be provided for
by the Parties.
118. Paragraph 1 clarifies that more than one authority
might be needed to meet the particular circumstances
of different legal systems (e.g. federal States). Specific
supervisory authorities whose activity is limited to a
specific sector (electronic communications sector,
health sector, public sector, etc.) may also be put
in place. This also applies to the processing of personal data for journalistic purposes if it is necessary
to reconcile the right to the protection of personal
data with the right to freedom of expression. The
supervisory authorities should have the necessary
infrastructure and financial, technical and human
resources (lawyers, IT specialists) to take prompt and
effective action. The adequacy of resources should be
kept under review. Article 11, paragraph 3 allows for
exceptions to the powers of supervisory authorities
with reference to processing activities for national
security and defence purposes (where such exceptions apply, other paragraphs of this article may as
a consequence not be applicable or relevant). This is
however without prejudice to applicable requirements
in relation to the independence and effectiveness of
review and supervision mechanisms.17
119. Parties have a certain amount of discretion as
to how to set up the authorities for enabling them to
carry out their task. According to paragraph 2, however,
they must have, subject to the possibility to provide
for exceptions in line with Article 11, paragraph 3, at
least the powers of investigation and intervention
and the powers to issue decisions with respect to
violations of the provisions of the Convention. The
latter may involve the imposition of administrative
sanctions, including fines. Where the legal system of
the Party does not provide for administrative sanctions,
paragraph 2 may be applied in such a manner that the
sanction is proposed by the competent supervisory
authority and imposed by the competent national
courts. In any event, any sanctions imposed need to
be effective, proportionate and dissuasive.
120. The authority shall be endowed with powers of
investigation, subject to the possibility to provide for
exceptions in line with Article 11, paragraph 3, such
as the possibility to ask the controller and processor
for information concerning the processing of personal
data and to obtain it. By virtue of Article 15, such
information should be made available, in particular,
when the supervisory authority is approached by a
data subject wishing to exercise the rights provided
17. See footnote 14.
for in Article 9. The latter is subject to exceptions of
Article 11, paragraph 1.
121. The supervisory authority’s power of intervention, provided for in paragraph 1, may take various
forms in the Parties’ law. For example, the authority
could be empowered to oblige the controller to rectify,
delete or destroy inaccurate or illegally processed data
on its own account or if the data subject is not able
to exercise these rights personally. The power to take
action against controllers who are unwilling to communicate the required information within a reasonable
time would also be a particularly effective demonstration of the power of intervention. This power could
also include the possibility to issue opinions prior to
the implementation of data processing operations
(where processing presents particular risks to the rights
and fundamental freedoms, the supervisory authority
should be consulted by controllers from the earliest
stage of design of the processes), or to refer cases,
where appropriate, to relevant competent authorities.
122. Moreover, according to paragraph 4 every data
subject should have the possibility to request the
supervisory authority to investigate a claim concerning
his or her rights and liberties in respect of personal
data processing. This helps to guarantee the right to
an appropriate remedy, in keeping with Articles 9 and
12. The necessary resources to fulfil this duty should
be provided. According to their available resources,
the supervisory authorities should be given the possibility to define priorities to deal with the requests
and complaints lodged by data subjects.
123. The Parties should give the supervisory authority the power either to engage in legal proceedings
or to bring any violations of data protection rules to
the attention of the judicial authorities, subject to the
possibility to provide for exceptions in line with Article
11 paragraph 3. This power derives from the power to
carry out investigations, which may lead the authority
to discover an infringement of an individual’s right
to protection. The Parties may fulfil the obligation
to grant this power to the authority by enabling it to
make decisions.
124. Where an administrative decision produces legal
effects, every affected person has the right to have
an effective judicial remedy in accordance with the
applicable national law.
125. Paragraph 2,e. deals with the awareness raising
role of the supervisory authorities. In this context, it
seems particularly important that the supervisory
authority proactively ensures the visibility of its activities, functions and powers. To this end, the supervisory
authority must inform the public through periodical
reports (see paragraph 131). It may also publish opinions, issue general recommendations concerning the
correct implementation of data protection rules or
use any other means of communication. Moreover,
it must provide information to individuals and to
Convention 108+ ► Page 29