Personal Data Protection and Safeguarding Draft Act June 2019 The EU General Data Protection Regulation (GDPR) requires each Member State to set up oversight authorities which “act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation".106 The GDPR further requires Member States to “provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by: — their parliament; — their government; — their head of State; or — an independent body entrusted with the appointment under Member State law".107 In a recent case at the Court of Justice of the European Union, the Court noted that “the supervisory authorities whose task it is to supervise the application, in the territory of their own Member States, of the provisions adopted by those States pursuant to the directive are to act with complete independence in exercising the functions entrusted to them".108 The Court further held that: The guarantee of the independence of national supervisory authorities is intended to ensure the effectiveness and reliability of the monitoring of compliance with the provisions concerning protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. It was established in order to strengthen the protection of individuals and bodies affected by the decisions of those authorities. The establishment in Member States of independent supervisory authorities is therefore, as stated in recital 62 in the preamble to Directive 95/46, an essential component of the protection of individuals with regard to the processing of personal data.109 Similarly, Modernised Council of Europe Convention 108 states that “The supervisory authorities shall act with complete independence and impartiality in performing their duties and exercising their powers and in doing so shall neither seek nor accept instructions”110 and “shall deal with requests and complaints lodged by data subjects concerning their data protection rights and shall keep data subjects informed of progress".111 In its modernisation process, the effective enforcement of data protection rules by independent supervisory authorities in the Contracting Parties is considered central to the Convention 108’s practical implementation. To this end, the Modernised Convention underlines the need for supervisory authorities to be vested with effective powers and functions and to enjoy genuine independence when fulfilling their mission.112 The proposed Iranian system is also less independent than many of its regional neighbours. In comparison, the Data Protection Authority in Bahrain was tasked to receive individual complaints concerning violation of the data protection law, examining them and determining their seriousness.113 A right to appeal has been introduced by way of a judicial committee established in the Commission (called the Appeals Committee), which shall be competent to adjudicate appeals submitted to it.114 In Algeria, the Data Protection Authority is formed by members elected by the President of the Republic, the judicial branch, the Parliament, the National Commission for Human Rights, as well as representatives of the Ministries of defence, foreign affairs, interior, justice, communication, health, and labour.115 Tunisia, the Organic Act on the Protection of Personal Data created the “Instance Nationale de Protection des Données à Caractère Personnel” as an autonomous legal entity with an independent budget established by the Ministry of Human Rights.116 106 107 GDPR, Art. 52 (1). GDPR, Art. 53 (1). Case C-210/16 Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH (Wirtschaftsakademie case), 5 June 2018, p 68. 109 Case C-362/14, Maximillian Schrems v Data Protection Commissioner, 6 October 2015, p 41. 110 Council of Europe, Modernised Convention for the Protection of Individuals with Regard to the Processing of Personal Data, Amending protocol to the Convention for the Protection of Individuals with Regard to the Processing of Personal Data, Article 15(5). 108 111 Article 15 (4). Handbook on European Data Protection Law, 2018 edition https://fra.europa.eu/en/publication/2018/handbook-european-dataprotection-law. 112 113 Bahrain Law No. (30) for the year 2018 Issuing the Personal Data Protection Act, Art. 30. 114 Bahrain Law No. 30, Art. 34. 115 Algeria Law on the Protection of physical persons for the processing of personal data, 10 June 2018, Art. 23. 116 Tunisia Organic Act 2004-63 on the Protection of Personal Data, 27 July 2004, Art. 75. ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 33 of 58