The impact of the general data protection regulation on supervisory authorities

Abstract

This work explores a very specific element of the EU General Data Protection Regulation (GDPR), namely the effect it has had on the supervisory authorities, the bodies established by the same GDPR to enforce it. While a lot has been written about the more substantive elements of the GDPR, in comparison, very little has been said about the supervisory authorities and this work seeks to address this issue, by examining to what extent the GDPR has impacted these entities and whether it has rendered them more efficient. Various concepts are explored throughout, such as the notion of supervisory authority independence and the concept of centralisation of power, or supervisory convergence, with respect to the same authorities. In addition, the new roles and functions of the authorities are explored, both in their national competence as well as in their supranational capacity where they are expected to collaborate with their EU counterparts in other Member States. To this end, the new consistency and cooperation mechanisms established by the GDPR are looked into. Furthermore, the role of the European Data Protection Board, which has replaced the Article 29 Working Party, is also analysed to determine how it fits into the new data protection paradigm alongside the supervisory authorities. The dissertation posits that different aspects of supervisory authorities have been impacted to differing degrees, with the net result being more or less the same workload as before, perhaps slightly higher and albeit more worthwhile. Meanwhile their efficiency has certainly been bolstered or so it would appear at this stage. The coming months and years will serve as the ultimate guidance on the confirmation or otherwise of these conclusions.