# Data Protection Commissioner v. Schrems and Facebook - Type: Case Law - Source: CJEU - Date: 2015-10-06 - Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362&ref=6144 - Canonical: https://overview.legal/posts/6144 - Topics: Right to Rectification, Processors, Personal Data, Controllers, Social Media, International Transfer, Supervision, Privacy Shield, Processing Agreement, Data Portability ## Summary Independence of DPA: The Directive seeks to ensure an effective, complete, and high level of protection of the fundamental rights and freedoms of natural persons. The guarantee of a DPA’s independence is intended to ensure effectiveness and reliability of the monitoring of compliance, and is an essential component of data protection. DPAs powers extend to their own Member State, but not to processing in third countries. However, DPAs are responsible for monitoring transfers from a Member State t ## Sections (8) ### ¶40 As regards the powers available to the national supervisory authorities in respect of transfers of personal data to third countries, it should be noted that Article 28(1) of Directive 95/46 requires Member States to set up one or more public authorities responsible for monitoring, with complete independence, compliance with EU rules on the protection of individuals with regard to the processing of such data. In addition, that requirement derives from the primary law of the European Union, in particular Article 8(3) of the Charter and Article 16(2) TFEU (see, to this effect, judgments in Commission v Austria, C‑614/10, EU:C:2012:631, paragraph 36, and Commission v Hungary, C‑288/12, EU:C:2014:237, paragraph 47). > Topics: Monitoring, International Transfer, Supervision, Personal Data · Applies: gdpr-art-8-par-3-en, gdpr-art-28-par-1-en, gdpr-art-16-en ### ¶41 The guarantee of the independence of national supervisory authorities is intended to ensure the effectiveness and reliability of the monitoring of compliance with the provisions concerning protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. It was established in order to strengthen the protection of individuals and bodies affected by the decisions of those authorities. The establishment in Member States of independent supervisory authorities is therefore, as stated in recital 62 in the preamble to Directive 95/46, an essential component of the protection of individuals with regard to the processing of personal data (see judgments in Commission v Germany, C‑518/07, EU:C:2010:125, paragraph 25, and Commission v Hungary, C‑288/12, EU:C:2014:237, paragraph 48 and the case-law cited). > Topics: Monitoring, Supervision, Personal Data, Processing ### ¶42 In order to guarantee that protection, the national supervisory authorities must, in particular, ensure a fair balance between, on the one hand, observance of the fundamental right to privacy and, on the other hand, the interests requiring free movement of personal data (see, to this effect, judgments in Commission v Germany, C‑518/07, EU:C:2010:125, paragraph 24, and Commission v Hungary, C‑288/12, EU:C:2014:237, paragraph 51). > Topics: Supervision, Personal Data ### ¶43 The national supervisory authorities have a wide range of powers for that purpose. Those powers, listed on a non-exhaustive basis in Article 28(3) of Directive 95/46, constitute necessary means to perform their duties, as stated in recital 63 in the preamble to the directive. Thus, those authorities possess, in particular, investigative powers, such as the power to collect all the information necessary for the performance of their supervisory duties, effective powers of intervention, such as that of imposing a temporary or definitive ban on processing of data, and the power to engage in legal proceedings. > Topics: Supervision · Applies: gdpr-art-28-par-3-en ### ¶44 It is, admittedly, apparent from Article 28(1) and (6) of Directive 95/46 that the powers of the national supervisory authorities concern processing of personal data carried out on the territory of their own Member State, so that they do not have powers on the basis of Article 28 in respect of processing of such data carried out in a third country. > Topics: Supervision, Personal Data, Processing · Applies: gdpr-art-28-par-1-en, gdpr-art-28-en ### ¶45 However, the operation consisting in having personal data transferred from a Member State to a third country constitutes, in itself, processing of personal data within the meaning of Article 2(b) of Directive 95/46 (see, to this effect, judgment in Parliament v Council and Commission, C‑317/04 and C‑318/04, EU:C:2006:346, paragraph 56) carried out in a Member State. That provision defines ‘processing of personal data’ as ‘any operation or set of operations which is performed upon personal data, whether or not by automatic means’ and mentions, by way of example, ‘disclosure by transmission, dissemination or otherwise making available’. > Topics: Personal Data, Processing · Applies: gdpr-art-2-en ### ¶46 Recital 60 in the preamble to Directive 95/46 states that transfers of personal data to third countries may be effected only in full compliance with the provisions adopted by the Member States pursuant to the directive. In that regard, Chapter IV of the directive, in which Articles 25 and 26 appear, has set up a regime intended to ensure that the Member States oversee transfers of personal data to third countries. That regime is complementary to the general regime set up by Chapter II of the directive laying down the general rules on the lawfulness of the processing of personal data (see, to this effect, judgment in Lindqvist, C‑101/01, EU:C:2003:596, paragraph 63). > Topics: International Transfer, Personal Data, Processing ### ¶47 As, in accordance with Article 8(3) of the Charter and Article 28 of Directive 95/46, the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of individuals with regard to the processing of personal data, each of them is therefore vested with the power to check whether a transfer of personal data from its own Member State to a third country complies with the requirements laid down by Directive 95/46. > Topics: Monitoring, Supervision, Personal Data, Processing · Applies: gdpr-art-8-par-3-en, gdpr-art-28-en ## Cited law provisions (6) ### GDPR — gdpr-art-8-par-3-en Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child. ### GDPR — gdpr-art-28-par-1-en Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. ### GDPR — gdpr-art-28-par-3-en Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor: ### GDPR — gdpr-art-2-en Material scope ### GDPR — gdpr-art-16-en The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ### GDPR — gdpr-art-28-en Processor --- Generated by overview.legal · https://overview.legal/posts/6144 · 2026-08-22