1. The role of DPAs in supervising police and criminal justice authorities processing personal data Paul de Hert and Juraj Sajfert PHAEDRA II - I MPROVING P RACTICAL AND H ELPFUL CO - OPER A TION BETW E EN D ATA P R OTECTION A UTHORITIES II http://www.phaedra-project.eu/

2. Directive (EU) 2016/680 Main objectives: High level of protection of personal data, taking account of the specific context of police and criminal justice Smoother exchange of information between Member States' police and judicial authorities Improve cooperation in the fight against terrorism and other serious crime in Europe

3. Directive (EU) 2016/680 Main changes: A Directive for the former third pillar Covers domestic processing (added value in relation to FD 2008/977/JHA) Data protection by design and data protection by default – data protection starting and not an ending point of personal data processing Increased accountability of LEA (e.g. mandatory DPIA and DPOs, notifications of personal data breaches)

4. Independent administrative supervision Complete independence - Article 8(3) Charter of Fundamental Rights - case law of CJEU Choice between „police” DPAs or „general” DPAs - should the DPA that has been set up under GDPR supervise also police and criminal justice authorities?

5. DPAs’ competence Supervision of police and criminal justice authorities within a Member State Excluded: courts acting in their judicial capacity optionally, independent judicial authorities when acting in their judicial capacity How will the independent supervision be ensured?

6. DPAs’ powers EFFECTIVE POWERS Investigative powers – access to data Corrective powers – „such as, for example” Advisory powers – prior consultation and policy advice No power to initiate court proceedings

7. DPAs handling complaints The DPA in the Member State of the controller/processor handles the case alone „Post-box DPA” – choice of the data subject Mandated NGO can represent data subject No one-stop-shop, consistency mechanism etc. But, mutual assistance What is the role of the European Data Protection Board?

8. Conclusion Complete independence of DPAs Limited area of administrative supervision (courts and independent prosecutors partly excluded) Effective powers, but which powers? Very limited cross-border DPA activites