Data Protection in the European Union
| Data Protection in the European Union | |
|---|---|
 | |
| Data Protection Authority: | EDPS |
| Regulation for EU institutions: | Regulation (EU) 2018/1725 |
| Official Language(s): | 24 EU Languages |
| European Legislation Database(s): | Link |
| European Decision Database(s): | Link |
Legislation
History
You can help us fill this section!
Regulation (EU) 2018/1725
The European institutions are bound by Regulation 2018/1725, which provides the same rights to data subjects as the GDPR.
When the provisions of Regulation 2018/1725 follow the same principles as the GDPR, they should be interpreted homogeneously. This is because Regulation 2018/1725 should be understood as the EU bodies and institution's equivalent to GDPR (Recital 5 Regulation 2018/1725), meaning that the two regulations should be applied in parallel (Recital 4 Regulation 2018/1725). This often makes GDPR case law applicable to the interpretation of Regulation 2018/1725.
A way to understand Regulation 2018/1725, is to see it as a combination of the GDPR and LED. While earlier chapters reflect principles enshrined in the GDPR, later chapters often reflect the LED.
Of particular note is Chapter IX Regulation 2018/1725 which addresses 'operational personal data' (personal data which is processed for the purposes of carrying out law-enforcement tasks). Given the specialised nature of these tasks, Regulation 2018/1725 creates carve-outs within Chapter IX for the processing of this type of data. For example, the right of access under GDPR and Regulation 2018/1725, is different to the right of access under Chapter IX. These carve outs are also reflected in the LED (Law Enforcement Directive) and in many cases Chapter IX will directly overlap in text with the LED.
Data Protection Authority
The European Data Protection Supervisor (European Data Protection Supervisor) is the data protection authority for European Union institutions, bodies, offices and agencies.
→ Details see EDPS
While the EDPS mostly relies on Regulation 2018/1725 to enforce data protection law against European Union institutions, bodies, offices and agencies, there are also specialised regulations which will apply. For example, among others, the EDPS supervises Europol which alongside Chapter IX of Regulation 2018/1725 requires the use of Regulation (EU) 2016/794 (Europol Regulation).
Judicial protection
General Court
A data subject has a right to a judicial remedy against a decision taken by the EDPS (Recital 79 and Article 64 2018/1725). In practice, this means that the General Court becomes the first instance court against a decision taken by the EDPS. Should the decision be appealed by the data subject, this will then go to the Court of Justice (CJEU) for a final decision.
Article 64 states:
1. The Court of Justice shall have jurisdiction to hear all disputes relating to the provisions of this Regulation, including claims for damages.
2. Actions against decisions of the European Data Protection Supervisor, including decisions under Article 63(3), shall be brought before the Court of Justice.
3. The Court of Justice shall have unlimited jurisdiction to review administrative fines referred to in Article 66. It may cancel, reduce or increase those fines within the limits of Article 66.
The EDPS, as an independent institution, must fund its own legal defence. As it is enforcing the law against other European Union institutions, bodies, offices and agencies, it cannot rely on, for example, the Commission's legal service. It therefore, has its own legal service who goes to Court in the institutions's behalf. The Supervision and Enforcement Unit (the unit responsible for the appealed decision) cooperates closely with the legal service.
Court of Justice of the European Union
Under Article 58 Regulation 2018/1725 the EDPS has the power to refer matters directly to the CJEU and to intervene in actions brought before the CJEU (Article 58(4) Regulation 2018/1725).
In practice, the EDPS rarely intervenes in cases that, while relevant to data protection, do not directly involve the EDPS. In these cases, the CJEU can invite the EDPS as a specialist party to give an opinion, but this is quite rare.
