Supervisory Authorities

Legal Framework

Article 51(1) GDPR requires each Member State to establish one or more independent public authorities responsible for monitoring GDPR application, protecting fundamental rights, and facilitating the free flow of personal data within the Union. These supervisory authorities are vested with investigative, corrective, and advisory powers under Article 58, including the authority to issue warnings, reprimands, orders to comply, and administrative fines.

The one-stop-shop mechanism, governed by Articles 56 and 60, designates a lead supervisory authority for cross-border processing activities. The lead authority is determined by the main establishment of the controller or processor in the Union. Article 56 grants the lead authority primary competence to handle cross-border cases, while Article 60 mandates cooperation between the lead authority and other concerned authorities, requiring mutual information exchange and joint operations where relevant.

Article 65 provides a dispute resolution mechanism through the European Data Protection Board (EDPB), enabling binding decisions when supervisory authorities disagree. The exercise of supervisory powers must be subject to appropriate safeguards, including effective judicial remedy and due process, as required under Union and Member State law in accordance with the Charter of Fundamental Rights.

Key Developments

In Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Schrems II), the Court of Justice confirmed that each national supervisory authority bears responsibility for monitoring compliance with EU data protection rules, including verifying whether transfers to third countries meet GDPR requirements. Critically, the Court held that a supervisory authority must examine complaints even where a lead authority has already addressed the matter, particularly when the complaint concerns a decision subject to an adequacy finding that the authority believes violates GDPR obligations.

In Google LLC v. CNIL, the Court addressed the territorial scope of supervisory authority decisions, ruling that while EU law does not require de-referencing across all global versions of a search engine, it also does not prohibit a national authority from ordering such removal. The CNIL's competence to weigh privacy rights against fundamental rights standards was affirmed, establishing that national authorities may determine the appropriate territorial reach of their remedies based on domestic fundamental rights protections.

The EDPB has issued Guidelines 06/2022 on amicable settlements between supervisory authorities and controllers, and Guidelines 03/2021 on the dispute resolution procedure under Article 65(1)(a), clarifying the procedural framework for inter-authority disagreements and settlement practices.

Practical Guidance

• Identify your lead supervisory authority early. Determine where your main establishment is located under Article 4(16) GDPR, as this authority will serve as the primary interlocutor for cross-border processing under Article 56. Document this determination, as it affects which national authority handles complaints and enforcement.

• Prepare for multi-authority engagement. Under Article 60, concerned authorities from other Member States where data subjects are affected may participate in investigations. Maintain compliance documentation that can be shared across jurisdictions without requiring country-specific reformulation.

• Monitor EDPB binding decisions. Article 65 dispute resolution outcomes create binding obligations across all concerned authorities. Track EDPB decisions relevant to your sector, as they establish interpretive standards that all national authorities must follow.

• Exercise your right to judicial remedy. Supervisory authority decisions are subject to effective judicial review under Article 78. When facing enforcement action, assess whether procedural safeguards were observed and whether the authority properly coordinated with the lead authority under Articles 60-61.

• Account for territorial reach in remediation. Following the Google v. CNIL ruling, national authorities may order remedies with extraterritorial effect. When responding to a supervisory authority order, consider whether compliance must extend beyond the ordering authority's Member State.