Personal Data Protection and Safeguarding Draft Act June 2019 Recommendations ● Streamline the structure of oversight bodies to ensure the independence of the Commission. This should be an independent regulatory body for the protection of personal data, which is politically, administratively, and financially independent from any public authority and is given adequate resources to conduct its activities with members elected by the parliament, the judiciary, the government, as well as from the private sector. F. Lack of Adequate Remedies Another significant problem is the lack of enforceable remedies provided for in the law available to individuals when their privacy rights are violated. Article 72 of the Draft Act sets out seven “enforcement measures that are ratifiable by the Commission and “suggestible by expert working groups”. These include: financial penalty, ban from activity or service in one or more professional ranks for a set period, ban from activity or service in all or some governmental bodies or corporations for a set period, and reducing the length of license. Article 53 on the tasks of the Supervisory Board, states that it receives “complaints from data subjects personal data safeguarding (Act)” and too generally provides that it will “follow up on them”. The Draft Act does not present any remedy for individuals to appeal against such decisions before superior or judicial bodies. According to international standards, adopting legal instruments is not sufficient to ensure the protection of personal data. To make data protection rules effective, it is necessary to establish mechanisms that enable individuals to counter violations of their rights and to seek compensation for any damage suffered. It is also important that supervisory authorities have the power to impose sanctions that are effective, dissuasive, and proportionate to the infringement in question. The importance of having effective remedies is stressed by General Comment 16 as follows: Provision must also be made for everyone effectively to be able to protect himself against any unlawful attacks that do occur and to have an effective remedy against those responsible.117 In the European region, both the CoE and the European Union law grants to individuals the right to lodge requests and complaints to the competent supervisory authority if they consider that the processing of their personal data is not being carried out in accordance with the law. The Modernised Convention 108 recognises the right of data subjects to benefit from the assistance of a supervisory authority, irrespective of their nationality or residence. A request for assistance may only be rejected in exceptional circumstances, and data subjects should not cover the costs and fees related to assistance. The Conventions in particular states that data subjects have a right to: Have a remedy under Article 12 where his or her rights under this Convention have been violated.118 Article 12 provides that each party to the Convention: Undertakes to establish appropriate judicial and non-judicial sanctions and remedies for violations of the provisions of this Convention.119 117 General Comment 16, ibid at §11. 118 Council of Europe, Modernised Convention 108, Art. 9. 119 Council of Europe, Modernised Convention 108, Art. 12. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 34 of 58