Supervisory authority

A supervisory authority monitors compliance with data protection legislation and enforces these requirements against companies and public authorities. Under Article 51 GDPR, European Union Member States must provide for independent data protection supervisory authorities. Their responsibilities include investigating data protection violations, handling complaints and providing guidance on data protection matters. In the event of infringements, they may, in particular, issue orders and impose administrative fines.

What are the responsibilities of a data protection supervisory authority?

The responsibilities of data protection supervisory authorities are set out primarily in Article 57 GDPR. They monitor the application of data protection legislation and help protect the rights of data subjects.

Their main responsibilities include:

• Monitoring and enforcing compliance with the GDPR
• Handling complaints submitted by data subjects
• Investigating potential data protection infringements
• Raising awareness and providing guidance on data protection obligations
• Cooperating with other European data protection supervisory authorities

In addition, supervisory authorities advise public authorities and provide information on the data protection requirements applicable to the processing of personal data.

Under Article 52 GDPR, they must perform their tasks independently.

What powers does a data protection supervisory authority have?

Article 58 GDPR distinguishes between investigative, corrective, authorisation and advisory powers.

As part of their investigative powers, supervisory authorities may, for example, request information from companies, conduct data protection audits and, subject to the applicable legal requirements, obtain access to personal data and business premises.

If they identify a data protection infringement, they may, in particular:

• Issue warnings or reprimands
• Order compliance with data subjects' rights
• Require companies to bring their data processing activities into compliance
• Temporarily or permanently restrict the processing of personal data
• Order the erasure of unlawfully processed data
• Impose administrative fines under Article 83 GDPR

The measures taken in each individual case depend, in particular, on the nature and severity of the infringement and the applicable legal requirements.

Which data protection supervisory authority is responsible in Germany?

Germany has data protection supervisory authorities at both federal and state level. Responsibility depends, in particular, on which entity processes the personal data and which statutory rules on jurisdiction apply.

As a general rule, the data protection supervisory authorities of the German federal states (Länder) are responsible for private companies. Most public authorities at state and municipal level are also subject to the supervision of the respective state authority.

The Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit – BfDI) is primarily responsible for federal public authorities and certain other areas assigned to it by law.

Bavaria has a special arrangement: the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht) is responsible for private companies, while the Bavarian State Commissioner for Data Protection (Bayerischer Landesbeauftragter für den Datenschutz) primarily supervises public authorities in the Free State of Bavaria.

In cases involving cross-border processing of personal data within the EU, the jurisdiction and cooperation mechanisms set out in Articles 56 and 60 GDPR may become relevant.

When can data subjects contact a supervisory authority?

Under Article 77 GDPR, every data subject has the right to lodge a complaint with a data protection supervisory authority if they consider that the processing of their personal data infringes the GDPR.

Possible grounds for complaints include:

• Unlawful disclosure of personal data
• Failure to provide adequate information about stored personal data
• Unlawful video surveillance
• Unauthorised processing of health data
• Failure to comply with a legitimate request for erasure

A complaint may, in particular, be lodged with a supervisory authority in the Member State where the data subject has their habitual residence, place of work or where the alleged infringement took place.

The authority must investigate the complaint to an appropriate extent and inform the data subject of its progress and outcome.

What are the consequences of data protection infringements for companies?

If a supervisory authority identifies an infringement of the GDPR, it may take corrective measures under Article 58 GDPR.

These may include binding orders requiring changes to data processing activities or the imposition of administrative fines.

Article 83 GDPR provides for different levels of administrative fines depending on the infringement concerned. For certain infringements, fines of up to EUR 20 million or, in the case of an undertaking, up to 4% of its total worldwide annual turnover in the preceding financial year may be imposed, whichever amount is higher.

The actual amount of a fine depends on the circumstances of the individual case. Relevant factors include the nature, gravity and duration of the infringement, the degree of fault and the extent of cooperation with the supervisory authority.

Not every data protection infringement automatically results in an administrative fine. The authority must select an appropriate and proportionate measure.

Practical example: Investigation by a data protection supervisory authority

A company operates an online shop and stores customers' personal data. Due to inadequate security measures, unauthorised persons are able to access certain customer data. One of the affected customers subsequently lodges a complaint with the competent data protection supervisory authority.

The authority investigates the matter and requests information from the company about the security measures in place. During its investigation, it finds that the measures do not meet the requirements of Article 32 GDPR.

The supervisory authority may then require the company to implement appropriate security measures. Depending on the circumstances of the infringement, an administrative fine under Article 83 GDPR may also be imposed.

legal data assessment: Companies should take requests and investigations by data protection supervisory authorities seriously and provide the required information in a transparent and comprehensible manner. A documented data protection management system, appropriate technical and organisational measures and clearly defined internal responsibilities facilitate cooperation with the authority. If data protection deficiencies are identified, companies should implement the necessary corrective measures promptly.

Legal basis

Articles 51–59, Article 60, Article 77 and Article 83 GDPR; supplemented by the jurisdictional provisions of the German Federal Data Protection Act (BDSG) and the respective state data protection laws.