Personal Data Protection and Safeguarding Draft Act June 2019 The Explanatory Report further stresses the importance of ensuring remedies to data subjects as a way to ensuring effective implementation: The effectiveness of the application of the measures giving effect to the provisions of the Convention is of crucial importance. The role of the supervisory authority (or authorities), together with any remedies that are available to data subjects, should be considered in the overall assessment of the effectiveness of a Party’s implementation of the Convention’s provisions.120 The same principles are enshrined in the GDPR that require supervisory authorities to adopt measures to facilitate the submission of complaints. They must be investigated, and the supervisory authority must inform the person concerned of the outcome of the proceedings dealing with the claim. The GDPR requires Member States to grant data subjects a judicial appeal against decisions by a national authority. This applies not only to data subjects but also to controllers and processors that have been party to the proceedings before a supervisory authority.121 This right of appeal is widely accepted and implemented internationally and other countries in the region have given data subjects the right to effective remedies together with the possibility of a judicial appeal. The Tunisian data protection law states that the data protection authority (“Instance Nationale de Protection des Données à Caractère Personnel”) receives complaints and determines the necessary measures to ensure data protection.122 The Law further ensures a right to judicial review of the authority’s decisions before the Court of Appeal in Tunis within one month since the decision has been issued.123 In Qatar, the Personal Data Privacy Law provides that the Competent Department may issue a reasoned decision to oblige the controller or the processor to set right the violation complained on within a specified period by the Competent Department itself. The controller or the processor are given 60 days from the notification to appeal any decision taken before the Minister. The Minister will settle any appeal within 60 days from the date of filing.124 Similarly, in Algeria, the Data Protection Authority receives individual complaints and to order any modification it may consider necessary for the protection of personal data including to stop processing as well as the destruction of personal data. 125 Recommendations ● Give Commission binding powers to order stopping of processing, correction, release of personal information to the subject, and other powers. ● Give individuals a remedy to appeal against the Commission’s decisions before judicial bodies. 120 Council of Europe, Modernised Convention 108, Explanatory Report, par. 35. 121 GDPR, Arts. 57, 77 and 78. 122 Tunisia, Organic Act 2004-63 on the Protection of Personal Data, 27 July 2004, Art. 76. 123 Tunisia, Organic Act 2004-63 on the Protection of Personal Data, 27 July 2004, Art. 82. 124 Qatar, Personal data Privacy Law No. 13 of 2016, Art. 26. Algeria, Law 18-07 of 10 June 2018 on the protection of physical persons in the processing of personal data, Art. 25. 125 ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 35 of 58