GDPR: Administrative Sanctions

Introduction

With less than a year to the introduction of the General Data Protection Regulation (EU) 2016/679 (the "GDPR") and given its far reaching effect on those who process personal data, it is important to consider the potential consequences for data controllers and data processors. The GDPR envisages both administrative sanctions by the relevant supervisory authority and judicial remedies which can be brought side by side. Where a data subject alleges that there has been a breach of the GDPR which has caused the data subject damage, that is either material or non-material, he or she can lodge a complaint with the relevant supervisory authority within a member state . There is also a right to seek compensation from the data controller or data processor for the damage suffered. For a fuller discussion on judicial remedies see our next article.

Supervisory Authority

The GDPR provides for the establishment of a supervisory authority in each individual member state which has responsibility for, amongst other things, monitoring and enforcing the application of the GDPR. Each supervisory authority has investigative and corrective powers which it can apply if a data controller or data processor infringe s the GDPR. Along with investigating a complaint by a data subject, a supervisory authority can also initiate an investigation of its own accord to establish whether a data controller or data processor is abiding by the GDPR. If, following investigation, it is found that a data controller or data processor is in breach of a requirement of the GDPR, the supervisory authority has the power to use its corrective powers to impose a sanction.

Ireland's Data Protection Bill

In Ireland, the Government published the General Scheme of Data Protection Bill (the "Bill") in May 2017 which, although not yet enacted and is subject to change, is the legislation proposed to transpose the GDPR into Irish law.

Investigative Powers

Article 58 of the GDPR sets out in broad terms the investigative powers of the supervisory authority. These powers include requiring a data controller or data processor to provide whatever information the supervisory authority deems necessary to carry out its supervisory functions under the GDPR. In practice, the manner in which the supervisory authority implements its investigative powers is left to each member state.

The Bill elaborates on the investigative powers set out in Article 58 of the GDPR and provides that, in conducting...