data controllers and processors about their rights and
obligations concerning data protection. While raising
awareness on data protection issues, the authorities
have to be attentive to specifically address children
and vulnerable categories of persons through adapted
ways and languages.
126. As provided for under paragraph 3, supervisory
authorities are, in accordance with the applicable
national law, entitled to give opinions on any legislative or administrative measures which provide for the
processing of personal data. Only general measures
are meant to be covered by this consultative power,
not individual measures.
127. In addition to this consultation foreseen under
paragraph 3, the authority could also be asked to give
its opinion when other measures concerning personal
data processing are in preparation, such as for instance
codes of conduct or technical norms.
128. Article 15 does not prevent the allocation of
other powers to the supervisory authorities.
129. Paragraph 5 clarifies that supervisory authorities
cannot effectively safeguard individual rights and freedoms unless they exercise their functions in complete
independence. A number of elements contribute to
safeguarding the independence of the supervisory
authority in the exercise of its functions, including
the composition of the authority; the method for
appointing its members; the duration of exercise and
conditions of cessation of their functions; the possibility for them to participate in relevant meetings without
undue restrictions; the option to consult technical or
other experts or to hold external consultations; the
availability of sufficient resources to the authority;
the possibility to hire its own staff; or the adoption of
decisions without being subject to external interference, whether direct or indirect.
130. The prohibition on seeking or accepting instructions covers the performance of the duties as a supervisory authority. This does not prevent supervisory
authorities from seeking specialised advice where it is
deemed necessary as long as the supervisory authorities exercise their own independent judgment.
131. Transparency on the work and activities of the
supervisory authorities is required under paragraph 7
through, for instance, the publication of annual activity reports comprising inter alia information related to
their enforcement actions.
132. Notwithstanding this independence, it must be
possible to appeal against the decisions of the supervisory authorities through the courts in accordance
with the principle of the rule of law, as provided for
under paragraph 9.
133. Moreover, while supervisory authorities should
have the legal capacity to act in court and seek enforcement, the intervention (or lack of ) of a supervisory
Page 30 ► Convention 108+
authority should not prevent an affected individual
from seeking a judicial remedy (see paragraph 124).
134. Paragraph 10 of Article 15 states that supervisory
authorities shall not be competent with respect to
processing carried out by independent bodies when
acting in their judicial capacity. Such exemption from
supervisory powers should be strictly limited to genuine judicial activities, in accordance with national law.
Chapter V – Co-operation and mutual
assistance
Article 16 – Designation of supervisory
authorities
135. Chapter V (Articles 16 to 21) forms a set of provisions on co-operation and mutual assistance between
Parties, through their various authorities, in giving
effect to the data protection laws implemented pursuant to the Convention. These provisions are obligatory
except in cases referred to in Article 20. Under Article
16, the Parties shall designate one or more authorities
and communicate their contact details, as well as their
substantive and territorial competences, if applicable,
to the Secretary General of the Council of Europe.
Subsequent articles provide for a detailed framework
for co-operation and mutual assistance.
136. While the co-operation between Parties will
generally be carried out by the supervisory authorities
established under Article 15, it cannot be excluded that
a Party designates another authority to give effect to
the provisions of Article 16.
137. The co-operation and general assistance is relevant for controls a priori as well as for controls a posteriori (for example to verify the activities of a specific
data controller). The information exchanged may be
of a legal or factual character.
Article 17 – Forms of co-operation
138. According to Article 17, supervisory authorities
within the meaning of Article 15 shall co-operate with
one another to the extent necessary for the performance of their duties and the exercise of their powers.
Given that Article 17 circumscribes the co-operation
of supervisory authorities to what is necessary “for
the performance of their duties and exercise of their
powers” and the fact that the ability of a supervisory
authority to co-operate relies on the extent of its powers, the provision does not apply to the extent that a
Party makes use of Article 11, paragraph 3, entailing
a limitation of the powers of supervisory authorities
pursuant to Article 15, paragraph 2, litterae a. to d.
139. Co-operation may take various forms, some “hard”
forms, such as enforcement of data protection laws
through mutual assistance, in which the legality of
action of each supervisory authority is indispensable,