Marit Hansen
email: marit.hansen@datenschutzzentrum.de

Data Protection Regulation

Keywords: Data Protection, European General Data Protection Regulation, Data Protection by Design, Data Protection by Default, Privacy

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

For decades, the concept of "privacy by design" is being discussed and recommended by Data Protection and Privacy Commissioners [START_REF]International Conference of Data Protection and Privacy Commissioners: Privacy by Design Resolution[END_REF]. In short, "privacy by design" means a design of systems where privacy requirements have been considered and appropriate measures to fulfil these requirements have been implemented -resulting in built-in privacy. "Privacy by design" should be applied in all phases of system development. As a rule, this method is superior to an attempt of subsequently adding some privacy features to a running system: Refraining from giving thought to privacy requirements in the design process usually yields systems that determine the data processing to a large extent with the effect that specifically data minimisation requirements won't be easy to implement in the best possible way later on. Also, tailoring an existing system to privacy needs that were ignored before may be a cumbersome and expensive task, if possible at all. However, today's reality of system design doesn't reflect that demand. "Privacy by design" is the exception and not the rule. The monetary incentives for developers to adhere to this paradigm are few, and by now there are no perceptible sanctions for the responsible entities (data controllers or data processors) using systems without builtin privacy as long as the data processing is sufficiently legally compliant otherwise [START_REF] Roussopoulos | Technology-induced challenges in Privacy & Data Protection in Europe[END_REF]. In this situation, producers of systems may regard each requirement that should be considered in addition to the bare functionality of their system as overly complex and reject any delay in the time to market. Even the often demanded "security by design" paradigm is by no means normal practice so that adversaries can frequently take advantage of vulnerabilities in IT systems.

These observations were considered by the European Union lawmakers when debating the data protection reform in the recent years. One important outcome is the General Data Protection Regulation (GDPR) [START_REF] Regulation | 679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ([END_REF] that demands not only that appropriate security measures are implemented by controllers processing personal data, but also "data protection by design and by default" (Article 25 GDPR). The GDPR, and specifically the provisions on data protection by design and by default, may become a game changer with respect to guaranteeing the rights and freedoms of human beings, including the right to privacy. Therefore this text will provide a deeper look into the General Data Protection Regulation and its demands for designing systems according to data protection requirements.

This text is organised as follows: Section 2 sketches important properties of the European General Data Protection Regulation resulting from the European data protection reform initiative. The related concept of "privacy by design" is introduced in Section 3 which provides brief information on the history and on definitions. Sections 4 and 5 dig into the legal obligations concerning data protection by design and data protection by default, respectively. Finally, Section 6 summarises the findings and gives a conclusion.

2

The General Data Protection Regulation

In 1995 the European Union adopted the Data Protection Directive 95/46/EC [START_REF]Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF] which then had to be implemented by each member state. Although the Data Protection Directive aimed at a harmonised and modern data protection regime throughout Europe, this objective was not fully achieved due to differences in the various national implementations. In 2016, more than 20 years later, the successor of the Data Protection Directive was adopted after several years of discussion and negotiation: the General Data Protection Regulation [START_REF] Regulation | 679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ([END_REF]. Lessons learnt from the experience of the former data protection regime were considered and, again, the goals of harmonisation and modernisation were pursued. The GDPR will become effective May 25, 2018. Its direct applicability in all member states will help unifying the data protection level. However, about 70 opening clauses -some mandatory, some optional -provide means for own national requirements and thereby deviation from a joint strategy across the member states [START_REF] Roßnagel | Die neue Datenschutzgrundverordnung -Ist das Datenschutzrecht nun für heutige Herausforderungen gerüstet? Policy Paper, Privacy-Forum[END_REF].

The GDPR cannot be a panacea for data protection at its best: Not everything in the GDPR is brandnew, and the 99 Articles leave room for interpretation. The chosen level of abstraction in the legal text may at first seem to lack support for those who have to comply with the GDPR. But this is an intended feature rather than a bug: Abstract rules need to be substantiated in a way that is appropriate with respect to the ever-changing risk to rights and freedoms of natural persons and accepted among the European data protection commissioners as supervisory authorities. So the GDPR defines a process for achieving consistency in the interpretation of the legal obligations concerning cross-border cases. By this, the GDPR may be future-proof for sev-eral years or even multiple decades -unlike its predecessor. However, steady negotiation on the substantiation of abstract rules is time-consuming and may be influenced by lobbyists who don't share the goal of optimal data protection.

It has to be noted that the GDPR does not only address European data controllers, but is designed to guarantee data protection in the entire European market. The market location principle laid down in Article 3 GDPR addresses organisations that offer goods or services to people in the EU or monitor their behaviour, even if the organisations are not established in the territory of the European Union. In particular those non-EU companies dominating the digital market shall comply with the data protection requirements in the GDPR.

Whether the GDPR will provide the proper instruments for achieving data protection cannot be predicted at this early stage. However, clearly the European member states have a joint starting point to take it from there. This is true for all instruments described in the GDPR, e.g. data protection by design, data protection by default, data protection impact assessment, codes of conduct, certifications, sanctions, or the involvement of courts.

In the following, we will focus on design issues demanded by the GDPR. This is in line with the statement in Recital 4 of the GDPR: "The processing of personal data should be designed to serve mankind."

Privacy by Design

Building in privacy -or, to use the same wording as the GDPR: data protection 1 -has been proposed by various stakeholders for several decades. In addition to cryptographic functionalities to achieve confidentiality or integrity, concepts for privacy technologies were proposed for more than 30 years (e.g. [START_REF] Chaum | Security without identification: Transaction systems to make big brother obsolete[END_REF]). Since the mid-1990ies the term "Privacy-Enhancing Technologies (PETs)" became known in the Data Protection Commissioners' community [START_REF] Hes | Privacy-Enhancing Technologies: The Path to Anonymity[END_REF] and was taken up by the European Commission: "The use of PETs can help to design information and communication systems and services in a way that minimises the collection and use of personal data and facilitate compliance with data protection rules. The use of PETs should result in making 1 It has to be stressed that "privacy" and "data protection" denote different, but related concepts, and there is not one single definition each. Usually the meaning of "privacy" points to the rights of an individual and is associated with self-defence against intrusion. "Data protection", as coined in European data protection law, addresses primarily organisations that have to make sure that the rights of the individuals are not infringed. Note that Article 8 of the European Convention on Human Rights and similarly Article 7 of the Charter of Fundamental Rights of the European Union provide a right to privacy: "Right to respect for private and family life". In addition, Article 8 of the Charter focuses on data protection: "Protection of personal data". For the purpose of this text it is not necessary to precisely define the boundaries because the exact privacy and/or data protection requirements to be built in would differ for various cases and cannot be elaborated in detail at this point.

breaches of certain data protection rules more difficult and/or helping to detect them." [START_REF]European Commission: Privacy Enhancing Technologies (PETs) -the existing legal framework[END_REF] When the former Ontario Privacy Commissioner Ann Cavoukian promoted the concept of "Privacy by Design" [START_REF] Cavoukian | Privacy by Design, Take the Challenge. Information and Privacy Commissioner of Ontario[END_REF] and described seven foundational principles [START_REF] Cavoukian | Privacy by Design: The 7 Foundational Principles[END_REF], she extended the scope by addressing IT systems, accountable business practices, and physical design and networked infrastructure. It is important to understand that system design must not be limited to adding a few PET modules, but needs a more comprehensive approach that encompasses in particular hardware and software, interfaces, organisational processes, and business models.

Engineers expect a more detailed operationalisation and specification for the task of building in privacy requirements. Different proposals have been made in the last few years to support engineering privacy (e.g., [START_REF] Gürses | Engineering Privacy by Design[END_REF][START_REF] Deng | A privacy threat analysis framework: supporting the elicitation and fulfillment of privacy requirements[END_REF][START_REF] Hoepman | Privacy design strategies[END_REF][START_REF] Hansen | Protection Goals for Privacy Engineering[END_REF][START_REF]Konferenz der unabhängigen Datenschutzbehörden des Bundes und der Länder: Das Standard-Datenschutzmodell -Eine Methode zur Datenschutzberatung und -prüfung auf der Basis einheitlicher Gewährleistungsziele[END_REF]), and there are studies such as [START_REF] Danezis | Privacy and Data Protection by Design -from policy to engineering[END_REF] that summarise the current status of research and point out obstacles. However, today's IT development environments refrain from making developers aware of privacy requirements.

From the legal perspective, some researchers argued that the European Data Protection Directive 95/46/EC already contained the requirement for privacy by design: "The incorporation of PETs into strategies for privacy receives some encouragement from Article 17 of the Directive, which requires data controllers to implement 'appropriate technical and organisational measures' to protect personal data, especially in network transmissions. Recital 46, which augments the meaning of Article 17, highlights the requirement that these measures should be taken 'both at the time of the design of the processing system and at the time of the processing itself', thus indicating that security cannot simply be bolted onto data systems, but must be built into them." [START_REF] Borking | Laws, PETs and other Technologies for Privacy Protection[END_REF] However, this demand for "appropriate technical and organisational measures" primarily calls for "security by design" and not so much for "data protection by design", although a few member states incorporated legal provisions for anonymisation or other data minimising functionality [START_REF] Borking | Laws, PETs and other Technologies for Privacy Protection[END_REF]18].

For instance, the German Federal Data Protection demands in § 3a concerning data minimisation: "Personal data shall be collected, processed and used, and data processing systems shall be chosen and organized in accordance with the aim of collecting, processing and using as little personal data as possible. […]" [18] All the same, this legal provision has proven ineffective since no fines can be imposed in case the controller ignores that obligation. This is different with Article 25 GDPR "Data protection by design and by default" where the supervisory authority has to ensure the imposition of administrative fines in case the obligations of the controller or the processor pursuant to Article 25 have been infringed (Article 83 (4) lit. a)). The administrative fine has to be effective, proportionate and dissuasive (Article 83 (1)) and may go up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year.

As a rule, all European language versions of the GDPR are equally valid. However, there is a noteworthy difference in the title of Article 25, as the following excerpt shows: Most of the languages reflect the "design" idea, the Swedish translation focuses on the "built-in" part. Only the German version adds "Technik" (technology) in the title of Article 25 which may be misleading because -as stated before -privacy by design must not be reduced to technology in a narrow sense, but has to reach out to entire systems and services. Probably this wording has been used in the German version of the GDPR in association with the long-standing concept "Datenschutz durch Technik" (literal translation: "data protection by technology") which was introduced in the mid-1990ies to denote the work on Privacy-Enhancing Technologies [START_REF] Hes | Privacy-Enhancing Technologies: The Path to Anonymity[END_REF] and privacy by design. Recital 78 of the German GDPR even mentions "Datenschutz durch Technik", but adds the translation "data protection by design".

• [EN]
Article 25 GDPR consists of three paragraphs: The first paragraph deals with data protection by design (cf. Section 4), the second tackles data protection by default (cf. Section 5), and the third paragraph, which won't be further discussed in this text, adds a remark on the relation to certification.

Data Protection by Design

Article 25 (1) GDPR reads as follows: "(1) Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement dataprotection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects."

For a better understanding, this long sentence is disassembled and put into context: Who shall take an action?

• The controller.

• There are also indirect effects on potential data processors, acting on behalf of the controller, as well as on producers of systems because the controller would have to choose products, services and applications in such a manner that the requirements of the GDPR are met and ensure the protection of the rights of the data subjects (cf. Article 28).

What is the objective?

• Meeting the requirements of the GDPR and protecting the rights of the persons concerned ("data subjects"). • This means in particular to implement the data protection principles that are laid down in Article 5 of the GDPR: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; accountability. What has to be done?

• Implementing appropriate technical and organisational measures in an effective manner. • Integrating the necessary safeguards into the processing.

How should it be done?

• Both at the time of the determination of the means for processing and at the time of the processing itself. • In an effective manner.

Which conditions occur?

• The state of the art.

• The cost of implementation.

• The nature, scope, context and purposes of processing.

• The risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing. The conditions are of utmost interest because they can constitute both an upper and lower bound for the actions to be taken. The data controller needs to employ these conditions to justify all decisions concerning the implementation of measures: How were the measures chosen, why were better measures omitted? In the beginning, the given conditions will probably function mainly as a limitation of what the controller has to do for data protection by design. But at least the justification has to be done and should be documented so that supervisory authorities are able to check whether the grounds for not implementing better measures are plausible.

One limiting factor will be the state of the art: In the last years the state of research in "privacy by design" has made good progress, but the transition to state-of-the-art measures is not an easy task and cannot be taken for granted. Concerning Article 25 GDPR, it will be debated in many cases whether a measure belongs to the category "state-of-the-art". However, for deciding on "state of the art" it is not sufficient to determine solely the readiness of a measure such as a Privacy-Enhancing Technologies, but also the quality for improving or ensuring data protection has to be taken into account. The metrics for such a combined maturity assessment and the evaluation procedure are by no means trivial. Instead they require expert knowledge when trust assumptions, potential side effects, or usability issues have to be considered [START_REF] Hansen | Readiness Analysis for the Adoption and Evolution of Privacy Enhancing Technologies -Methodology, Pilot Assessment, and Continuity Plan[END_REF].

In the realm of security, the category "state of the art" should already be known from Article 17 (1) of the European Data Protection Directive 95/46/EC: "Member States shall provide that the controller must implement appropriate technical and organizational measures to protect personal data […]. Having regard to the state of the art and the cost of their implementation, such measures shall ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected." [START_REF]Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and[END_REF] Similarly, Article 32 demands the usage of appropriate state-of-the-art security measures. Judging from many discussions after the adoption of the GDPR, the exact properties of when to consider a security measure state of the art have not been fully defined, although this requirement has been laid down in European data protection law at least since 1995.

Likewise, surprisingly little information is available on state-of-the-art measures concerning privacy by design. Determining good and best practices of concepts and products as well as agreeing on their classification as state of the art will certainly become a task for the supervisory authorities. Anyhow, Article 24 on the responsibility of the controller clarifies that the controller has to implement "appropriate technical and organisational measures to ensure and to be able to demonstrate" compliance with the GDPR. The factors "state of the art" and "cost of implementation" are left out in that provision.

Article 25 (1) GDPR and the accompanying Recital 78 mention a few examples (explicitly stated: "inter alia") for measures that may be appropriate:

"

[…] minimising the processing of personal data, pseudonymising personal data as soon as possible, transparency with regard to the functions and processing of personal data, enabling the data subject to monitor the data processing, enabling the controller to create and improve security features." (Recital 78 GDPR)

Thereby not only privacy-enhancing technologies, but also transparency-enhancing technologies (TETs) are addressed. Further, this recital acknowledges that the controller may have to advance the security features, e.g. in the case of sensitive data. "One size fits all" wouldn't live up the expectations of the GDPR. The improvement of security features is also demanded when vulnerabilities in the provided functionality are becoming known. This requires an ongoing risk monitoring in a data protection management system.

What is more, Recital 78 addresses producers of products, services and applications who "should be encouraged to take into account the right to data protection when developing and designing such products, services and applications" so that controllers "are able to fulfil their data protection obligations". Recital 78 gives one example that can really encourage producers to invest in privacy by design: "The principles of data protection by design and by default should also be taken into consideration in the context of public tenders." Thus, procurement processes should from now on incorporate built-in data protection.

Data Protection by Default

The text of Article 25 (2) GDPR reads as follows: "(2) The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons."

The nature of the second paragraph of Article 25 GDPR is totally different from the first paragraph since it omits the explicit mentioning of limiting factors. Still, the word "appropriate" gives room for interpretation of which measures are suitable and right for the purpose.

Again, the controller is responsible for implementing technical and organisational measures. In the first sentence, the data minimisation principle (cf. Article 5 (1) lit. c) GDPR) and the purpose limitation principle (cf. Article 5 (1) lit. c) GDPR) are repeated. The insertion of "by default" addresses the standard configuration of a data processing system.

The second sentence specifies that not only the amount of the data collected, but also the extent of their processing, the storage duration and the accessibility of the personal data are affected. Thereby the standard configuration should prevent that personal data which are not strictly necessary for the purpose are processed at all (e.g. by limiting the personal data that is asked for), that they are processed only to the extent as necessary for the purpose (e.g. by restricting the possible processing steps or by using data minimisation measures such as anonymisation or pseudonymisation functionalities), that they are erased as early as possible regarding the purpose (e.g. by automatic erasure measures), and that their accessibility is limited as much and as soon as the purpose allows (e.g. by access control mechanisms, by carefully choosing the storage location, or by encrypting the data).

The third sentence gives an example that relates to Internet publications or social networks: that, by default, personal data must not be made accessible to an indefinite number of people.

The notion of "default" incorporates the possibility to change the default setting. The last sentence of Article 25 (2) GDPR it clarifies that "the individual's intervention" may allow changing the configuration. The default setting would be the initial configuration which can be changed by the data subject to allow that more data are processed, that other processing steps are allowed, that the data can be stored for a longer time, and that they may be accessible to other parties as well. Typical cases where this may be desired by a data subject comprise sharing information on the web or in a social network, creating accounts as returning customers so that information on their mail address or on payment methods is stored for the next visit, or providing personal data for long-term personalised consumer experiences.

The GDPR interpretation of "data protection by default" differs from previous ideas in the privacy-by-design context where Cavoukian demanded:

"Privacy as the default setting: If an individual does nothing, their privacy still remains intact.

No action is required on the part of the individual to protect their privacy -it is built into the system, by default." [START_REF] Cavoukian | Privacy by Design: The 7 Foundational Principles[END_REF] This requirement sounds promising, but if "intact privacy" means that no personal data are processed at all or that there is a guarantee of no risk for the individual's privacy, many real cases with lawful and legitimate purposes would not work. As soon as the individual chooses to make use of a product or a service, this may require processing of personal data and thereby wouldn't necessarily considered as leaving the individual's privacy intact. Perhaps this notion rather addresses the individual's horizon of expectation: For users of a product or service it should be clear which personal data are needed for the purpose (e.g. basing on informed consent), and all additional data processing should be prevented unless the user intervenes and changes the setting. However, the product or service should not create the false impression that the functionality can be offered when the user sticks to a default of no-disclosure of personal data, e.g. when a governmental service will require specific attributes of the citizen for the payment of social benefits. But this will be probably meet the expectations of the user.

A more elaborate view on data protection by default was given by the European Data Protection Supervisor when commenting a previous version of Article 25 GDPR:

"The principle of data protection by default aims at protecting the data subject in situations in which there might be a lack of understanding or control on the processing of their data, especially in a technological context. The idea behind the principle is that privacy intrusive features of a certain product or service are initially limited to what is necessary for the simple use of it. The data subject should in principle be left the choice to allow use of his or her personal data in a broader way." [START_REF]Opinion of the European Data Protection Supervisor on the data protection reform package[END_REF] Here the aim is not to leave privacy intact, but to -at least initially -limit privacy intrusive features. The statement stresses that the guideline for deciding what is necessary should be the simple use of a product or service. This also means that the individual should be able to use a product or service even if disclosing or storing more personal data may mean extended functionalities or a different user experience.

Today only very few guidelines on "data protection by default" exist (one example is the workflow given in [START_REF] Hansen | Data Protection by Default in Identity-Related Applications[END_REF]). So it is difficult both for data controllers and for supervisory authorities to decide on an appropriate default setting. In any case it will have to be determined in a first step which parts are hardwired without the possibility for a change (which relates back to "data protection by design" and built-in data protection) and which parts are configurable. For the configurable part it has to be figured out when and which pre-settings are reasonable for which user groups (e.g. different settings for children and adults, or different settings for EU residents and non-EU residents when it comes to storage location) and when the configuration should be better done in an interaction with the user when installing the system.

Also it has to be given thought to usable ways of changing the configuration later on in an informed manner and without giving up all protection at once. It shouldn't be the case that the solution with the data protection default setting is barely usable, but one click away is the full version that entails no protection at all (which may infringe Article 7 (4) GDPR on freely given consent). The known challenge how to prevent that people get overwhelmed or tired from the configuration possibilities may become even harder if data controllers -not being enthusiastic about data protection by default -put the blame on data protection regulators. Thus, a static "take it or leave it" default is probably not the best solution. Instead, taking the pre-configured default as a starting point, users should be supported in choosing the best fitting configuration (see e.g. [START_REF] Ravichandran | Capturing Social Networking Privacy Preferences: Can Default Policies Help Alleviate Tradeoffs between Expressiveness and User Burden?[END_REF]), or they could even profit from the approach of "on the fly" privacy management for adapting and organising their own privacy preferences [START_REF] Angulo | Towards usable privacy policy display and management[END_REF].

Finally, data protection by default can ruffle the feathers of established Internet business models. For instance, according to Article 25 (2) GDPR user tracking on the basis of personal data (including machine identifiers) would have to be deactivated as a standard setting. This may affect the tradition of "free" services where Internet resources are paid by personal data.

Conclusion

The European General Data Protection Regulation contains legal provisions on data protection by design and by default. This obligation addresses data controllers who have to consider building in data protection functionality in their systems. In addition, it holds the potential of affecting the currently not well developed market in privacy and data protection systems and services. The GDPR offers the opportunity for bridging the gap between research and practice in the field of privacy and data protection.

Although not really new, both data protection by design and data protection by default are powerful mechanisms and may become a game changer if taken seriously by controllers, processors, producers, and supervisory authorities. However, employing these principles is a challenging task for all stakeholders involved and requires indepth knowledge of research concepts and state-of-the-art implementations. So as not to negate the leverage from the GDPR, researchers, practitioners, and supervisory authorities should collaborate and propose suitable best practice approaches. It should be made difficult to ignore the laid down rules or to shirk responsibilities and obligations regarding the system design requirements. Nevertheless a broad use of data protection design methods and measures has to rely on thoroughly discussed, tested, and workable solutions. Further, infrastructures should not only realise data protection by design themselves, but also promote and support measures built on top or employing functionality offered. This will be primarily a task for the member states or the European Union.

Although the GDPR becomes effective only in May 2018, the interdisciplinary work of computer scientists, developers, lawyers, psychologists, economists etc. should begin much earlier [START_REF] Cavoukian | Privacy by Design: The 7 Foundational Principles[END_REF]. The lack of a holistic approach for engineering and promoting privacy technologies is certainly one reason for the unsatisfactory status of their maturity and their market availability. Even good approaches can fail if the ecosystem for their usage is not sufficiently considered, business models are missing, users don't understand their value or perceive losses in comfort compared with the not-so-privacy-friendly solutions they are familiar with (see e.g. [START_REF] Harbach | On the acceptance of privacy-preserving authentication technology: The curious case of national identity cards[END_REF]). Interdisciplinary work takes time and does not happen automatically -it requires a common understanding of the problem space as well as openness for underlying incentives and values of other disciplines [START_REF] Tsormpatzoudi | Privacy by Design: From research and policy to practice -the challenge of multi-disciplinarity[END_REF]. This includes the supervisory authorities which will have to evolve to live up the tasks they have been imposed by the GDPR and to actively seize opportunities for improving the protection of rights and freedoms of all individuals.

If recommendations and ready-to-use concepts are developed and published soon enough, this facilitates data controllers to prove their compliance with the regulation from day one and, at best, set an example of international relevance regarding data protection by design and by default. It is noteworthy that the GDPR is designed to have an influence beyond Europe because it strives to protect the personal data of EU residents even outside the European Union and obliges also non-EU controllers processing personal data in Europe. What is more, whenever successful solutions are being developed, they may be demanded by all people inside and outside Europe interested in protecting their right to privacy and may be expected especially from globally acting companies. Data protection by design and by default is of particular relevance in a world that relies increasingly on digitisation and that has to defend the rights and freedoms of individuals against attacks from powerful organisations.

  Article 25: Data protection by design and by default • [FR] Article 25: Protection des données dès la conception et protection des données par défaut • [ES] Artículo 25: Protección de datos desde el diseño y por defecto • [NL] Artikel 25: Gegevensbescherming door ontwerp en door standaardinstellingen • [SV] Artikel 25: Inbyggt dataskydd och dataskydd som standard • [DE] Artikel 25: Datenschutz durch Technikgestaltung und durch datenschutzfreundliche Voreinstellungen

Acknowledgements. Work relating to this text is partially funded by the German Ministry of Education and Research within the project "Privacy-Forum -Forum Privatheit und selbstbestimmtes Leben in der digitalen Welt (Forum Privacy and Selfdetermined Life in the Digital World)". For more information see: https://www.forum-privatheit.de/.


Felix Bieker
email: fbieker@datenschutzzentrum.de

Enforcing Data Protection Law -The Role of the Supervisory Authorities in Theory and Practice

Keywords: Data Protection, Privacy, General Data Protection Regulation, Enforcement, Supervisory Authorities, Data Protection Authorities, Court of Justice of the European Union 1

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The raison d'être of data protection law in general is to protect the rights of individuals. Specifically, this is laid down in Article 1(1) of the current Data Protection Directive 95/46/EC (DPD) [START_REF]Council of 24[END_REF] as well as Article 1(2) of the upcoming General Data Protection Regulation (EU) 2016/679 (GDPR) [START_REF]679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ([END_REF]. The law thereby aims to compensate for the asymmetry in power between organisations (as controllers) and individuals (the data subjects) created by modern means of data processing [START_REF] Rost | Was meint eigentlich "Datenschutz[END_REF]. However, this does not only affect the secondary law, but is also enshrined on the level of EU primary law: Article 8 of the EU Charter of Fundamental Rights (CFR) [START_REF]Charter of Fundamental Rights of the European Union[END_REF] guarantees the right to the protection of personal data. Furthermore, Article 7 CFR protects the right to private life, which also includes the protection of personal data relating to the private life of an individual [START_REF] Ecj | /01 Österreichischer Rundfunk and Others[END_REF]. The enforcement of these rights is entrusted to supervisory authorities in each Member State. According to the Court of Justice of the European Union, which interprets Union law authoritatively, the supervisory authorities protect the rights of the individuals with regard to the protection of personal data and "are therefore the guardians of those fundamental rights" [START_REF] Ecj | 07 Commission[END_REF]. In order to fulfil this advocacy role, Article 28 DPD requires that the authorities act in complete independence and have effective investigative powers (including access to all necessary information), powers of intervention (such as ordering the erasure of data or imposing bans on processing) and the power to engage in legal proceedings when the national provisions implementing the DPD have been violated. Additionally, the data subjects themselves have the right to lodge complaints directly with a supervisory authority, in order to enforce their rights.

Since the coming into force of the DPD, there have been several judgments of the EU's Court of Justice (ECJ or the Court) concerning the interpretation of the supervisory authorities' role. The notion of independence was scrutinized with regard to the implementation in Germany [START_REF] Ecj | 07 Commission[END_REF], Austria [START_REF] Ecj | Case C-614/10 Commission[END_REF], and Hungary [START_REF] Ecj | Case C-288/12 Commission v[END_REF][START_REF] Ecj | Case C-230/14 Weltimmo[END_REF]. Additionally, the Court ruled on questions concerning the scope of application of the national rules implementing the DPD in the Member States [START_REF] Ecj | Case C-230/14 Weltimmo[END_REF][START_REF] Ecj | Case C-131/12 Google and Google Spain[END_REF] and the competence of the authorities to hear complaints of individuals under Article 28(4) DPD [START_REF] Ecj | Case C-131/12 Google and Google Spain[END_REF][START_REF] Ecj | Case C-362/14 Schrems[END_REF]. Furthermore, the supervisory authorities have been [START_REF] Ecj | Case C-230/14 Weltimmo[END_REF][START_REF] Ecj | Case C-131/12 Google and Google Spain[END_REF] and continue to be [START_REF] Ecj | Case C-210/16 Wirtschaftsakademie Schleswig-Holstein[END_REF] involved in proceedings before the ECJ in order to obtain an authoritative interpretation of the EU data protection legislation.

The upcoming secondary data protection law, the GDPR -which has already entered into force and will become applicable in the first quarter of 2018 -considerably extends the EU provisions on the supervisory authorities. As the legislator chose the form of a regulation, EU law will prescribe the role of the supervisory authorities in much greater detail.

This paper therefore analyses the jurisprudence of the ECJ to define the status quo of the law on supervisory authorities and examines in how far the forthcoming GDPR advances that status and thereby enables the supervisory authorities to fulfil their role as guardians of the rights to the protection of personal data. The requirements for the organization of the supervisory authorities will be examined [START_REF]679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ([END_REF] as well as the question of which supervisory authority is competent to enforce data protection law in a given case [START_REF] Rost | Was meint eigentlich "Datenschutz[END_REF]. Lastly, the power to hear individual claims (4) is assessed. It is concluded (5) that in order to honour their role as prescribed by EU law, the supervisory authorities have to be allocated the means and resources to fulfil their role as advocates of fundamental rights.

Organization of Supervisory Authorities

Article 28 DPD requires that the supervisory authorities "act with complete independence." As the Court held in its very first judgment concerning the role of supervisory authorities, this notion includes multiple dimensions: being without influence not just by those who are supervised -private sector companies or public authorities, as the case may be -but generally without taking any instructions or being pressured, including direct as well as indirect influence [START_REF] Ecj | 07 Commission[END_REF]. Due to their advocacy role, as public enforcers of individual rights, the supervisory authorities have a unique position within their Member States. As they oversee both private companies and (other) public authorities, they must be independent from the public sector, i.e. the State they form part of themselves. In practice, this is achieved in different ways, for instance the members of the French Commission Nationale de l'Informatique et des Libertes are appointed from various institutions, such as the parliament and the courts [13, Article 13]. In Germany, the heads of the supervisory authorities are elected by the respective federal or regional parlament [Cf. inter alia 14, § 35; 15, § 22].

However, as the ECJ found, the State itself may not only be interested in influencing a supervisory authority where its own actions are concerned, but also protect the interests of the private sector. Thus, there is no room for state scrutiny, which might allow the government to cancel or even replace decisions in the interests of public contractors in the private sector or adopt a lenient approach towards economically important companies [START_REF] Ecj | 07 Commission[END_REF].

The members of the supervisory authorities have to be functionally independent from the government. While Member States are not obliged to grant them a separate budget, there can be no overlap in personnel between the government and the authority, which could lead to direct influence of the former. However, even indirect influence such as an unconditional right to be informed about the work of the supervisory authority is seen by the ECJ as not permissible [START_REF] Ecj | Case C-614/10 Commission[END_REF].

Another form of undesirable influence is any act of the government that might coerce the authority into a certain course of action in order to avoid disadvantages in the future. This issue was contentious in a case against Hungary, where the government decided to discharge the head of the supervisory authority before the end of his regular term [START_REF] Ecj | Case C-288/12 Commission v[END_REF]. The ECJ held that these measures, which in the case at hand did not even conform to the national rules and safeguards, were liable to induce such acts of prior compliance, which contravene the authority's independence.

The forthcoming EU data protection regime incorporates the ECJ's rulings into secondary law. Under Article 52(1) GDPR the supervisory authorities remain completely independent in their work and it is now expressly stated in Article 52(2) GDPR that they may not be subject to direct or indirect influence. The functional independence from the government is explicitly laid down in Article 52(6) GDPR.

There will be specific rules for the expiry of the term of office or a resignation of members of the supervisory authorities and the requirement that they may be dismissed solely in cases of serious misconduct or if they no longer fulfil the conditions required for their position, which are to be provided by the Member States according to Article 54(1) GDPR. While the ECJ found that under Article 28 DPD the Member States did not have to provide the authorities with a separate budget, that same obligation is now laid down in Article 52(7) GDPR.

3

Enforcement of Data Protection Law and Cooperation of Supervisory Authorities

Enforcement of Data Protection Law

As each of the Member States has its own supervisory authority, their jurisdiction is linked to the applicability of the national law implementing the DPD. Therefore, the determination whether the national law is applicable in a given case is crucial. Ac-cording to Article 4 DPD this is the case when the controller carries out the processing "in the context of the activities of an establishment". In the Google Spain case, this was an issue, as Google argued that its data processing did not take place in its Spanish establishment, but at its corporate headquarters in the USA [START_REF] Ecj | Case C-131/12 Google and Google Spain[END_REF]. However, the ECJ pointed out that the DPD explicitly stated that the processing only had to occur in the context of the establishment's activities. It then ruled that when an establishment promotes and sells advertising space to make the operation profitable, this is sufficient to link the activities of the establishment and the processing of data. The Article 29 Working Party has generalized this requirement as meaning that the "activities and the data processing are 'inextricably linked'" [16, at p. 6]. Further, Recital 19 DPD refers to the effective and real exercise of an activity under a stable arrangement, while the legal form of that establishment is not decisive. Accordingly, in the Weltimmo case, the Court held that even the operation of a website in a Member State, using exclusively that State's language, fulfils the criteria of an establishment, if the processor has a representative in that country [START_REF] Ecj | Case C-230/14 Weltimmo[END_REF]. However, the nationality of the users of the website is of no relevance for determining the applicable law. Thus, different national implementations of the DPD may apply to the establishment and the main establishment, depending on their location, even though they all concern the same data processing carried out by the main establishment. This interpretation is explicitly regulated in Article 4(1)(a) clause 2 DPD, which states that where a controller is established on the territory of several Member States, it must ensure that each establishment complies with the respective national law.

As each supervisory authority is competent to enforce the national implementation of the DPD on its territory, a supervisory authority may choose to enforce the national law against any processor who is established on its territory. The Court found, however, that where the main establishment of the controller is in another Member State, the supervisory authority may not enforce its national law against that main establishment. Rather this rests within the jurisdiction of the supervisory authority of that Member State and would infringe the principles of territorial sovereignty and legality, as well as the rule of law [START_REF] Ecj | Case C-362/14 Schrems[END_REF]. Nonetheless, it follows from this and Article 4(1)(a) clause 2 DPD that the supervisory authority of a Member State may enforce the national data protection rules against the establishment even when the data processing is carried out by the main establishment located in another Member State.

The provisions on the enforcement of the data protection regime by the supervisory authorities have been left largely untouched by the current reforms. Especially the link to the enforcement in the territory of the supervisory authority's Member State under Articles 55(1) and 57(1)(a) GDPR remains unchanged. Article 3(1) GDPR on territorial scope, which replaces Article 4(1)(a) DPD, contains the same notion of processing personal data "in the context of an establishment" as interpreted by the ECJ. Furthermore, the Courts' conclusions have been partially incorporated in the Recitals. Just as Recital 19 DPD, Recital 22 GDPR states that the concept of establishment implies the real and effective exercise of activity through stable arrangements, while the legal form of these arrangements does not prejudice a finding of an establishment. The question of whether a website is aimed at persons in a particular Member State is dealt with in Recital 23 GDPR, which also proposes to consider fac-tors such as the language or currency used on the website. However, this is not done in the context of whether there is an establishment, but rather under the category of offering goods and services while the controller is not established in the EU according to Article 3(2)(a) GDPR. Although the wide scope of the DPD in the interpretation of the ECJ has been seen critically by some [START_REF] Revolidis | The Long Arm of the European Data Protection Law[END_REF][START_REF] Nwankwo | Weltimmo s. r. o. v. Nemzeti Adatvédelmi és Információszabadság Hatóság and the Concept of "Establishment" under Art[END_REF], the EU legislator has thus explicitly reiterated the Court's reasoning in the GDPR. This is not necessarily surprising, as the case law is closely linked to the wording of the DPD, which the ECJ interprets in the light of the individual rights of the primary law, in order to ensure effective and complete protection of individual rights.

Cooperation of Supervisory Authorities

As the 28 Member States set up one or multiple supervisory authorities2 in accordance with their national law, there is currently a multitude of authorities in the EU which interpret the EU data protection regime, which poses the threat of fragmentation of the application of the law in practice.

Status Quo. Article 28(6) DPD thus lays down a duty to cooperate. This includes inter alia the exchange of information. In its eponymous Article 29 the DPD set up a Working Party consisting of representatives of the supervisory authorities of each Member State as well as a representative of EU institutions and bodies and one of the Commission. While the latter have no voting rights, the Working Party adopts its decisions by a simple majority under Article 29(3) DPD. The Article 29 Working Party is charged with examining questions such as the application of national implementation measures or issuing opinions to the Commission on the level of protection in the EU and third countries. It may further put forward recommendations on any matter related to the protection of personal data in the EU.

Upcoming Changes. The system of cooperation between the respective national supervisory authorities is overhauled completely in the forthcoming legislation [on the genesis of these provisions, cf. 19]: Lead Supervisory Authority. In an effort to streamline the jurisdiction of supervisory authorities in cases where the controller or processor is in another Member State than the data subject, the supervisory authority of the (main) establishment acts as lead supervisory authority. 3 Under this one-stop-shop scheme it is the sole interlocutor of the controller or processor according to Article 56(6) GDPR. 4 While the lead authority is in charge of operations, under Article 60(1) GDPR it ultimately has to reach a consensus and therefore cooperate with the other supervisory authorities concerned. To this end, the lead authority may request assistance from other authorities under Article 61 GDPR, and -especially for purposes of carrying out investigations or monitoring the implementation of measures taken -may conduct joint operations in accordance with Article 62 GDPR.

Concerning a decision, it is for the lead supervisory authority to submit a draft to the other concerned supervisory authorities. According to Article 60(3) GDPR, their views have to be taken duly into account. Further, the other concerned supervisory authorities may express relevant and reasoned objections as provided by Article 60(4) GDPR. 5 The coordination then proceeds as follows:

─ If the lead supervisory authority does not follow the objection or regards it as not relevant and reasoned, it has to apply the consistency mechanism (explained below) and the Board has to adopt a binding decision according to Article 65(1)(a) GDPR. ─ If the lead supervisory authority agrees with the objection, it has to submit a revised draft to the other concerned supervisory authorities according to Article 60(5) GDPR. ─ If no objections are submitted within the prescribed period, a consensus is deemed to exist by Article 60( 6) GDPR and all supervisory authorities concerned are bound by the decision.

When the decision is adopted, it is for the lead supervisory authority to take action with regard to the controller or processor, while the supervisory authority to which a Recital 36 GDPR requires the effective and real exercise of activities determining the main decisions regarding the means and purposes of processing through stable arrangements. A processor's main establishment is defined in Article 4(16)(b) as the place of central administration or, in lieu of such a place, the establishment where the main processing activities take place to the extent that the processor is subject to specific obligations under the GDPR. In cases involving both, a controller and processor, the main establishment of the controller should be decisive to determine the lead supervisory authority according to Recital 36 GDPR.

complaint was lodged has to inform the complainant according to Article 60(7) GDPR.

However, there are exceptions from the one-stop-shop scheme:

─ It only applies to private companies; if public authorities or private bodies acting with public authority process data, the supervisory authority of the Member State concerned has the competence to act according to Article 55(2) GDPR. ─ Where a complaint concerns a matter which relates only to one specific establishment in one Member State or only substantially affects data subjects in one specific Member State, the supervisory authority of the Member State concerned 6 has to inform the lead supervisory authority. The latter then decides whether it invokes the cooperation procedure of Article 60 GDPR.

• If it does, the concerned supervisory authority prepares a draft for decision, which has to be taken "into account to the utmost" by the lead authority for its own decision under Article 60(3) GDPR. • If the lead supervisory authority decides not to deal with the case, the supervisory authority which informed it handles the case either with the assistance of other supervisory authorities according to Article 61 GDPR or as a joint operation under Article 62 GDPR.

The new rules for the cooperation of the supervisory authorities set up a formal system of procedures and strict deadlines of only two to four weeks. This can be attributed to the complexity of a one-stop-shop approach for the enforcement of common rules across 28 Member States. While this is intended to allow effective cooperation, the deadlines also put a burden on the supervisory authorities. They will have to be able to follow proceedings in other Member States and respond to requests within the deadlines. Aside from the substantive and often very specific questions of EU data protection law, this also requires a timely and appropriate translation of documents. Thus, considerable resources will be required to enable the authorities to actively participate in investigations, supply information to other authorities and process information received within the short prescribed time periods.

Mutual assistance. The mutual assistance procedure of Article 61 GDPR especially concerns information requests and supervisory measures, for instance requests to carry out prior authorizations and consultations, inspections and investigations. Article 61(3) GDPR introduces the idea of purpose limitation for supervisory authorities: the use of information exchanged is expressly limited to the purpose for which it was requested. The requested supervisory authority has to submit the information no later than a month after the request and may refuse requests only when it is not competent ratione materiae or the measures requested violate provisions of Union or national law. Any refusal to submit information has to be substantiated with reasons. 7 Joint operations. The joint operations mechanism under Article 62 GDPR extends to investigations and enforcement measures and gives the supervisory authorities of all Member States concerned a right to participate in such operations. They are either invited by the competent supervisory authority or can request to participate. If such a request is not granted within one month, Article 62( 7) GDPR provides that the other supervisory authorities may take provisional measures. 8 In a joint operation a supervisory authority may, in accordance with national law, grant investigative powers on a seconding supervisory authority or, if allowed by national law, confer its powers on the seconding supervisory authority as provided by Article 62(3) GDPR. Both modi are subject to the guidance and presence of members or staff of the host supervisory authority and subjects the supervisory authorities own members or staff to the national law of the host Member State. In turn, the host supervisory authority assumes responsibility for the actions of the supervisory authority acting in its Member State under Article 62(4) GDPR.

This is an interesting possibility, which has the potential to further European integration. Even though EU law is not a subset of international law, but rather its own, independent and sui generis legal order [20], the principle of the sovereignty of Member States is still paramount. In its Schrems judgment, the ECJ heavily emphasized that supervisory authorities could only exercise their jurisdiction within their own Member State and invoked this general principle [START_REF] Ecj | Case C-362/14 Schrems[END_REF]. In this regard, the GDPR goes beyond the status quo in allowing for joint operations and exercise of jurisdiction in another Member State, albeit subject to consent and supervision of the Member State concerned. However, as the Member States are reluctant to give up sovereignty with regard to other Member States, it will have to be determined in the future, whether these provisions found any practical application.

European Data Protection Board. The Article 29 Working Party will be succeeded by the European Data Protection Board, which consists of the heads of each supervisory authority of the Member States and the European Data Protection Supervisor. 9 The Board generally takes all decisions by a simple majority. Its tasks are similar to those of the Article 29 Working Party: according to Article 70 GDPR, it advises the 7 If the requested supervisory authority fails to act within the prescribed period, Article 60 [START_REF] Ecj | Case C-288/12 Commission v[END_REF] GDPR authorizes the requesting supervisory authority to take provisional measures in its Member State. However, the urgency procedure of Article 66 GDPR is triggered: While the urgent need to act is presumed, an urgent binding decision by the Board prescribed by Article 66(2) GDPR is required. 8 In that case, as under Article 60(8) GDPR for the mutual assistance procedure, the urgency mechanism of Article 66 GDPR is then triggered. 9 In Member States where there is more than one supervisory authority a joint representative is to be appointed under the national law as a single point of contact for other members of the Board (Recital 119 GDPR), which facilitates coordination.

Commission, for instance by providing it with an opinion on the adequacy assessment for the transfer of data to third countries or examines any matter of general application or affecting more than one Member State, at the request of a Board member. This particularly concerns cases where a supervisory authority does not comply with its obligation to provide mutual assistance under Article 61 GDPR or engage in joint operations as prescribed in Article 62 GDPR (as described above). The opinions of the Board have to be issued within eight weeks and are non-binding. 10Consistency Mechanism. A major change in the working of the supervisory authorities on the EU level is the consistency mechanism. It allows the Board to issue binding decisions according to Article 65(1) GDPR. This particularly concerns instances when the lead supervisory authority does not follow the objections of a supervisory authorities concerned or when the competent supervisory authority decides not to follow an opinion of the Board under Article 64 GDPR. All binding decisions are adopted with a two-thirds majority and generally within one month. 11 During the time of deliberation, the competent supervisory authority is barred from adopting its draft decision. As pointed out in Recital 142 GDPR decisions of the Board can be brought before the ECJ in an annulment action under Article 263 TFEU by supervisory authorities, as they are addressees of these decisions. As the binding decisions of the Board can be seen as an interference with the independence of the individual authorities, the possibility to bring a decision before the Court is a mitigating factor.

For cases with an urgent need to protect the rights and freedoms of data subjects there is also an urgency procedure provided by Article 66(1) GDPR, which allows the supervisory authority concerned to circumvent the consistency mechanism under exceptional circumstances and adopt immediate provisional measures in its Member State. However, these measures have to specify a period of validity, which may not exceed three months. In order to adopt final measures, the supervisory authority concerned may request an urgent opinion or decision of the Board. 12In the opposite case, where a supervisory authority concerned does not take measures although there is an urgent need to act in order to protect the rights and freedoms of data subject, any supervisory authority may request an urgent opinion or decision of the Board according to Article 66(3) GDPR.

Even though the Board is mainly based on cooperative action, certain elements such as the possibility to take a supervisory authority refusing to grant mutual assistance or refusing to let another supervisory authority join investigations before the Board or to invoke the urgency procedure where a supervisory authority fails to take action introduce an adversarial mode to the Board. In practice, these instruments will have to be handled carefully in order to allow productive cooperation between all of the supervisory authorities. However, these concerns may in practice well be outweighed by a coherent enforcement strategy of 28 Member States.

Power to Hear Individual Complaints

Individuals have the right to file a complaint with the supervisory authority, which is enshrined in EU primary law as a fundamental right in Article 8( 1) and ( 3) CFR [cf. 11]. Correspondingly, the supervisory authorities under Article 28(4) DPD/Articles 77 and 52(1)(b) and ( 4) GDPR have the power to hear these complaints. These powers therefore are not merely an end in themselves, but rather serve to implement these individual rights.

Complaints Concerning Processing within the EU

Status Quo. According to the ECJ, individuals may bring a claim to the supervisory authority when they are not successful in the exercise of their rights as data subjects, for instance under Articles 12 or 14 DPD [START_REF] Ecj | Case C-230/14 Weltimmo[END_REF]. If the competent supervisory authority finds a violation of fundamental rights, it may order the controller to take certain action. In the infamous case of Google Spain, this included the order to remove certain links from the search results of an internet search engine, when the interest of the data subject outweighs the interest of the public to this information [START_REF] Ecj | Case C-131/12 Google and Google Spain[END_REF]. Further, the Court has ruled that when a claim is lodged with an authority and it is unclear which national legislation applies, this does not change that authority's competence to hear that claim under Article 28(4) DPD [START_REF] Ecj | Case C-230/14 Weltimmo[END_REF]. However, the territorial restriction of the rules it enforces according to Article 28(1) and (3) DPD still applies. Thus, a supervisory authority which is confronted with such a claim may exercise its investigative powers even if the law applicable is that of another Member State. This means that, generally, any supervisory authority may investigate the practice of controllers in another Member State. Yet, its powers may be limited, especially regarding the imposition of penalties, as that would violate the territorial sovereignty of the other Member State and raise issues regarding the principle of legality and the rule of law [START_REF] Ecj | Case C-230/14 Weltimmo[END_REF]. In such cases, the supervisory authority can only rely on the duty of cooperation under Article 28(6) DPD for the enforcement of its actions on the territory of another Member State. If, however, there is an establishment on the territory of the supervisory authority's own Member State, it may take action against that establishment, where the required nexus to the processing as detailed above (3.1) exists, i.e. the establishment's activities are inextricably linked to the activities of the main establishment.

Upcoming Changes. Under Article 77 GDPR, individuals may now choose the supervisory authority where they want to lodge their complaints: they may select the authority of their habitual residence, place of work or the place of the alleged violation. Just like the lead supervisory authority provides a one-stop-shop for controllers and processors, the supervisory authority where the complaint is lodged is responsible to inform the individual on the progress and outcome of the complaint. 13Individuals may also challenge any legally binding decision of a supervisory authority addressing them, as they have the right to an effective judicial remedy according to Article 47 CFR. Recital 142 GDPR states that the proceedings following national law should give the courts full jurisdiction including the examination of all questions of fact and law. This clarifies that the notion of independence of the supervisory authorities, as introduced above (2), only extends to the organisations it supervises. However, as the executive has thus only limited influence and control, this must be compensated by adequate judicial supervision.

If the supervisory authority competent under Articles 55 et seq GDPR does not deal with a complaint or even when it fails to inform the individual of the progress or outcome of a complaint lodged under Article 77 GDPR within three months, individuals must have a judicial remedy against the supervisory authority. Additionally, Article 79 GDPR introduces a right for individuals to an effective judicial remedy against a controller or processor, including public authorities, before the courts of the Member State.

In order to pursue these rights, data subjects under Article 80(1) GDPR have the right to mandate a non-profit organization active in the field of data protection to exercise them on their behalf. Taking this point even further, Article 80(2) GDPR contains an opening clause allowing Member States to introduce a right of non-profit organizations to initiate proceedings under Articles 77-79 GDPR independent of a mandate by a data subject.

Complaints and the Transfer to Third Countries

The competence of the supervisory authority is not limited to actions concerning controllers within the EU. In the Schrems case, the ECJ dealt with the powers of the supervisory authorities with regard to the processing of personal data in third countries. The Court argued that while the supervisory authorities could carry out their powers within the territory of their own Member State under Article 28(1) and ( 6) DPD, the transfer of data from a Member State to a third country under Articles 25 and 26 DPD was a processing of data within the meaning of Article 2(b) DPD, which was carried out in a certain Member State [START_REF] Ecj | Case C-362/14 Schrems[END_REF]. Consequently, the national supervisory authorities under Article 28 DPD read in conjunction with Article 8(3) CFR were also responsible to monitor compliance with the DPD in the case of data transfers to a third country.

The ECJ explicitly held that adequacy decisions of the Commission under Article 25(1) and ( 6) DPD do not curtail the power of the supervisory authorities to examine the actual level of protection in that third country. 14 The Commission decision does not prejudice the examination of an individual complaint put before the supervisory authority, which must assess these with due diligence [START_REF] Ecj | Case C-362/14 Schrems[END_REF]. However, the supervisory authority itself cannot declare the Commission decision invalid. In EU law, it is within the exclusive jurisdiction of the Court to declare any acts of EU organs or institutions invalid. For the complaints before the supervisory authority there are thus two possibilities:

• If the authority rejects the claim, the individual must have the possibility of judicial remedies according to Article 28(3) subparagraph 2 DPD. • If the supervisory authority upholds the claim, it must, in turn, be able to instigate legal proceedings in compliance with Article 28(3) third indent DPD.

In either case, the competent national court seized of the matter has to submit questions concerning the validity of the decision to the ECJ by way of a preliminary reference under Article 267 TFEU.

While the GDPR brings some changes to the system of transfer of personal data to third countries in Articles 44 et seq. GDPR -mostly in the form of more detailed provisions -the general concept remains the same. Thus, the finding of the ECJ that any transfer of personal data begins with a processing within the EU still stands. The supervisory authorities further retain the power to suspend data flows to recipients in third countries according to Article 58(2)(j) GDPR and must thus be able to investigate complaints concerning an alleged violation of provisions set out in the GDPR.

The process for the adoption of adequacy decision is now set out in more detail in Article 45 GDPR: the Commission has to take into account factors such as whether the country in question respects the rule of law, human rights and fundamental freedoms, the relevant national legislation concerning public and national security and access rights of public authorities. Further, it must assess whether there are effective and enforceable data subject rights as well as effective administrative and judicial remedies for data subjects. The existence of an effective, independent supervisory authority is also required. With these provisions the legislator anticipated the requirements laid down by the Court in the Schrems judgment.

If the Commission concludes that the level of protection is adequate in a third country or a specific sector in that country, the implementing act has to provide a mechanism for periodic review, as required by the ECJ in the Schrems case, which has to be carried out at least every four years. When information reveals that the relevant country no longer meets the adequacy threshold, Article 45(5) GDPR demands that the Commission repeals, amends or even suspends its decision.

It thus becomes clear, that in the view of the EU legislator as well as the judiciary, the entire EU data protection regime must be read in the light of the fundamental rights of the individuals it aims to protect. Therefore, the protection standard established within the EU may not be undermined by a transfer to a third country which does not provide at least a level of protection that is 'essentially equivalent' to these safeguards, as the Court put it in Schrems [START_REF] Ecj | Case C-362/14 Schrems[END_REF]. Furthermore, the ECJ has emphasised the crucial role of the supervisory authorities, which must act not only independently of their Member States, but also the Commission where it acts within the framework of the data protection law. The authorities may not defer to an assessment provided by Brussels, but must examine the merits of each complaint, especially where it concerns a violation of individual rights on a massive scale. Furthermore, the Court empowers individuals to use the instrument of complaints in order to enforce their rights in a meaningful way.

Outlook

While the ECJ's judgments in the cases of inter alia Google Spain or Schrems attracted praise [START_REF] Ecj | Case C-131/12 Google and Google Spain[END_REF][START_REF] Ecj | Case C-362/14 Schrems[END_REF], but also considerable criticism [START_REF] Ecj | Case C-210/16 Wirtschaftsakademie Schleswig-Holstein[END_REF], it has been demonstrated that the GDPR incorporates many of the principles laid out by the Court. It is thus not to be expected that the ECJ will change its approach to enforce data protection law from a fundamental rights perspective under the new legislation.

The Court itself as well as the upcoming legislation emphasize the importance of lodging proceedings before the ECJ in order to ensure coherent interpretation. Yet, the supervisory authorities already find themselves in a position where they have to engage in proceedings before the ECJ, a development which is likely to continue and even expand in frequency with the GDPR, as it will be more obvious that EU law is at issue in a case -a fact that may currently be overlooked in practice, as the parties before national courts focus on the national implementation legislation.

The Court, in the few cases that reached it, has definitely played an important role in advancing the level of data protection in the EU. However, it has to be borne in mind that in most instances, i.e. the preliminary reference procedure, it takes considerable time before a case comes before the Court. Under Article 267 TFEU only national courts of last instance are obliged to refer their questions on EU law to the ECJ. So far, national courts of lower instance have been reluctant to forward questions on EU law and there might be a considerable amount of proceedings which ended before they reached the court of last resort. Remarkably, the Court, twenty years after the coming into force of the DPD, has been concerned with fundamental questions such as the application of the DPD or the concept of the controller only in recent years.

As the proceedings before the Court differ from those before national courts, they require representation of the supervisory authorities by lawyers familiar with the intricacies of EU procedural law, which incurs substantial costs for the supervisory authorities in order to resolve contentious cases. And even though in the preliminary reference procedure, which is of concern here, the language of the case is that of the referring national court according to Article 37 of the Rules of Procedure of the Court of Justice, translations of the questions submitted by the national court and its own written submissions are required in order to allow meaningful cooperation of the national supervisory authorities among each other and with the European Data Protection Supervisor, who may also submit observations to the ECJ according to Article 47(1)(i) Data Protection Regulation (EC) No 45/2001 [START_REF] Schwartmann | Datentransfer in die Vereinigten Staaten ohne Rechtsgrundlage, Konsequenzen der Safe-Harbor-Entscheidung des EuGH[END_REF]. Furthermore, the supervisory authorities in these proceedings are dependent on the questions submitted by national courts, which enjoy discretion as to how to phrase them and which questions to put forward.

If binding decisions of the Board would, in practice, be brought before the Court this would allow the supervisory authorities to have a greater influence in the proceedings. However, such proceedings would also be adversarial in nature and thus might lead to conflicts between the supervisory authorities, which also depend on each other in order to properly enforce data protection law across the EU.

Conclusions

From the case-law and the new legislation, the picture of the supervisory authorities as agents of individuals and their rights emerges. With this conception, based on the provisions of EU law, there is an agency capable of engaging in the protection of the individual's rights and effectively counter interests and ambitions of multi-national companies processing personal data. Ideally, due to their complete independence, the supervisory authorities are also capable of discursive interaction with other State actors, especially in the executive. This is the justification for awarding a public authority far-reaching independence from the executive. Where the authorities do not live up to this vision, individuals can request them to engage on their behalf by submitting complaints and, if an authority is unwilling, take them to court. A strong judicial oversight in the conception of the Court is the key to ensuring that the supervisory authorities do not take their independence as a purpose of itself -they must use it in order to fulfil their advocacy role (cf. section 2). Taking this concept of supervisory authorities as envisioned in the current and future EU law seriously in practice, will require awarding them the appropriate means and funds to exercise these powers. This has two dimensions: the supervisory authorities must be outfitted with personnel competent to assess specific substantive issues of EU law and also to be able to engage in the actual communication with 27 other Member States, which requires considerable translation efforts (cf. section 3.2).

While the new means of cooperation offer great opportunities, it will have to be seen whether the Member States, for instance, will opt for an extra-territorial enforcement of data protection among the Member States in practice. Among the supervisory authorities at least, there will be much more interaction and dependence with the introduction of the Board, which provides a powerful tool in the form of the consistency mechanism that will have to be used carefully. The Board's modus operandi has to keep a balance between cooperative and adversarial action (cf. section 3.2).

The Court on the other hand has made it clear that it will not allow for a lowering of standards with regard of transfer to third countries in particular and the enforce-ment of EU data protection law in general (cf. section 4). It has consistently strengthened the role of the authorities in its jurisprudence and in turn expects them to use their independence to fulfil their role as guardians of individual rights with regard to privacy and data protection. Furthermore, the ECJ has empowered individuals to ensure that their rights are properly enforced and thus added an additional measure of control.

This paper has received funding by the Bundesministerium für Bildung und Forschung (German Federal Ministry of Education and Research) for the project Forum Privatheit -Selbstbestimmtes Leben in der Digitalen Welt (Privacy Forum), www.forum-privatheit.de.

In the Federal Republic of Germany, for instance, there are 18 different supervisory authorities: one on the federal level and seventeen regional authorities of the Länder.

[START_REF] Rost | Was meint eigentlich "Datenschutz[END_REF] The term main establishment is defined in

Article 4(16)(a) GDPR with regard to a controller as the place of central administration within the EU, except where another establishment within the EU is tasked with deciding the purposes and means of data processing and has the power to implement such decisions, which then in turn is regarded as main establishment.

Where the processing takes place within the EU in the context of a controller's or processor's establishments in multiple Member States or where the processing takes place in the sole establishment of a controller or processor in the EU, but which substantially affects or is likely to substantially affect data subjects in more than one Member State, this is defined as cross-border data processing by Article 4(23) GDPR. If there are conflicting views on which of the concerned supervisory authorities is competent for the main establishment of a controller or processor, the Board has to adopt a binding decision under the consistency mechanism of Article 65(1)(b) GDPR.

[START_REF] Ecj | /01 Österreichischer Rundfunk and Others[END_REF] This term is defined in Article 4(24) GDPR as stating whether there is an infringement of the GDPR, whether the envisaged action is in accordance with the GDPR and clearly demonstrate the significance of risks incurred by the draft decision with data subjects' fundamental rights and freedoms or the free flow of personal data.

Article 4(22) GDPR defines the supervisory authority concerned as the one which is concerned by the processing, due to the controller's or processor's establishment on the territory of its Member State, the data subjects residing in its Member State are substantially affected or likely to be affected, or a complaint according to

Article 77 GDPR has been lodged with that supervisory authority.

However, when a supervisory authority requests an opinion, for adoption of one of the measures listed in Article 64[START_REF]Council of 24[END_REF] GDPR it has to "take utmost account" of the opinion. If it deviates from the opinion, another supervisory authority or the Commission may request the adoption of a binding decision. Article 64(1) GDPR includes the list defining when a Data Protection Impact Assessments has to be carried out under Article 35(4) GDPR, standard protection clauses under Articles 46(2)(d) and 28(8) GDPR, and the approval of binding corporate rules according to Article 47 GDPR.

If the Board fails to adopt a decision by that time the quorum is lowered to a simple majority for an additional two weeks. In the case of a split vote, the chair decides.

According to Article 66(4) GDPR urgent opinions and decisions have to be adopted within two weeks by a simple majority.

As laid down by Article 56(2) GDPR with regard to actions taken by the lead supervisory authorities, Article 60(7)-(9) GDPR concerning cooperation between supervisory authorities and Article 65(6) GDPR for decisions of the Board

The fact that the Commission's Safe Harbor Decision curtailed the supervisory authorities' powers with regard to self-certified organizations under Article 28 DPD was, as the ECJ held in Schrems, actually one of the reasons for its invalidity.


Bernd Carsten Stahl
email: bstahl@dmu.ac.uk

Privacy in the Human Brain Project : The Perspective of Ethics Management

Keywords: Human Brain Project, neuroinformatics, data protection, privacy

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

ethics management

The Human Brain Project (HBP; www.humanbrainproject.eu) is a European, Flagship initiative that facilitates and supports a global, united effort to understand the brain by providing platforms and tools along with neuroscientific and medical data, to study the brain, its diseases and to catalyze new brain-inspired technologies [START_REF] Amunts | The Human Brain Project: Creating a European Research Infrastructure to Decode the Human Brain[END_REF].

The HBP aims to create and operate a European scientific research infrastructure for brain research, cognitive neuroscience and other brain-inspired sciences. It gathers, organizes and disseminates data describing the brain and its diseases. Of particular importance for us is the stated aim that the HBP is dedicated to responsible and ethical research. In addition, the HBP is an extensive collaboration between scientists, researchers and institutions around the world. This includes is nature as an open-science initiative. The HBP is developing Information Communication (ICT) Tools that have applications in neuroscience, medicine and computing It is important to underline that the focus on responsible research and innovation (RRI) figures prominently among the aims of the project. This is explained by the fact that the project's funder, the European Commission, is keen to promote RRI in research [START_REF]European Commission: Responsible Research and Innovation -Europe's ability to respond to societal challenges[END_REF][START_REF] Owen | Responsible Innovation[END_REF][START_REF] Stilgoe | Developing a framework for responsible innovation[END_REF]. At the same time, the HBP raises a number of potential ethical and issues, ranging from the immediate and practical, like the approval of research protocols, to the more general and philosophical, like the possibility of machine consciousness or novel approaches to artificial intelligence (AI).

In order to address these issues, the HBP has a sub-project dedicated to ethics and society. The overall HBP is split in 12 sub-projects which are the organizational home to scientific, technical and administrative activities. The society and ethics sub-project, the home of RRI in the project, is divided into four sections which look at foresight research, conceptual and philosophical analysis, public engagement and ethics management [START_REF] Evers | The contribution of neuroethics to international brain research initiatives[END_REF]. This abstract highlights the role of privacy and data protection in ethics management.

Ethics management is broken down into several tasks. It covers principles and implementation of ethics management, which includes the development and maintenance of an overview of ethical issues called the HBP Ethics Map (https://www.humanbrainproject.eu/ethics-management). Working with other sections of the society and ethics sub-project as well as the scientists of the scientific and technical sub-projects, the ethics management team develops bespoke ethics issue action plans. It develops Standard Operating Procedures (SOPs) and undertakes the identification and management triage of ethical issues. In order to ensure that all work in the HBP happens in accordance with laws and regulations, the ethics compliance task maintains an HBP Ethics Registry which contains an overview of the ethical issues of all other tasks and a collection of ethics approvals of those tasks that require them. Ethics management communicates with the European Commission and its ethics reviewers in the context of regular ethics reviews. In order to have an understanding of specific issues, the ethics management group manages a so-called Rapporteur Programme which includes representatives of all other 11 sub-projects. These rapporteurs are scientists from all areas of the HBP who spend a portion of their time working on issues of RRI. This includes physical meetings, teleconferences and interaction with members of the Ethics Advisory Board, which made up of independent experts who provide advice to the HBP.

Privacy is a key issue that the HBP has to address. There are different types of human data that are potentially affected by data protection regulation and therefore subject to scrutiny during ethics review. This refers to research data that was collected from human volunteers as well as patient data. For volunteer data the processes of collecting informed consent are fairly well established which links to the possibility of using the data for research purposes. The use of patient data raises bigger obstacles. The medical informatics platform, one of the HBP subjprojects which aims to gain neuroscientific insights by mining patient data has therefore developed a complex process to allow querying patient data which is held by partner hospitals. This includes several steps of de-identification, anonymisation and aggregation of the data in order to ensure that no personally identifiable information is used. While these aspects are concerned with complying with data protection legislation, including the incoming European data protection regulation, privacy concerns in the HBP go beyond such reactive measures. The HBP strives to establish good practice in the data governance of big neuroscience and aims to put in place ideas of broader data stewardship. The ethics management function plays a central role in this.

Ethics management operates according to the principle of subsidiarity, which means that the responsibility for appropriately dealing with ethical issues remains with the local Principal Investigator. Ethics management supports these PIs and collects approvals. Most importantly, ethics management works with all stakeholders involved (researchers, ethics reviewers, EC, Ethics Advisory Board) to find ways of appropriate dealing with ethical issues. In this way ethics management seeks to develop good practice for managing ethics in large data-drive biomedical research.

Compliance management follows categorisation of ethical issues as described the Horizon 2020 ethics self-assessment manual. During the ramp-up phase, the first phase of the project which lasted from October 2013 to March 2016 the following approvals were collected: 19 "animals" 25 "Humans", 1 "Human Cells / tissues", 1 "None" (retained because of general relevance). It was interesting that no issue was collected under the heading of "privacy". This is not because of a lack of privacy-related issues, but because they generally fell under human research with privacy being only one aspect of the complex ethical issues.

In fact, privacy was recognised as a key issue in the HBP and, as a consequence, the ethics and society sub-project, together with the Ethics Advisory Board wrote an Opinion on Data Protection1 . This was based on work undertaken in all sections of ethics and society as well as prior work of several EAB members. This Opinion made the following recommendations.

• Create coherent data governance -Nominate individual responsible for data -Set up data governance committee -Include stakeholders and general public -Establish PIA and data audit -Ensure data stewardship • Adopt privacy model The ethics management team is in the process of turning these recommendations into practice. Due to the size and complexity of the project this is not a trivial exercise. The chosen approach is therefore to develop what we call an ethics issue action plan. This is a document that lists all the requirements and suggest possible ways of addressing them. It is developed by the ethics management team and then discussed with the various stakeholders. At the time of writing (January 2017) an internal meeting is being planned to discuss the different measures which include technical measures, implementation of privacy impact assessments, the appointment of a data protection officer and stakeholder engagement with a view to ensuring that the measures are consistent, realistic and fit for purpose. Ethics management is well placed for such a task, given its prior engagement with all HBP stakeholders. One key insight arising from this work is that privacy and data protection is an important issue, but it is by no means the only one. Different ethical and social issues intersect and privacy issues tend to overlap with other issues in a complex mixture of interests. It is important to create structures that can deal with these issues and that have the potential to react to external developments and learn from mistakes. Ethics management is one such structure that will help the HBP successfully deal with privacy and data protection.

Available at: https://www.humanbrainproject.eu/documents/10180/1384155/EthicsandSocie-tyOpinionDataProtectionandPrivacy.pdf/3612d948-fc33-4e57-baf3-a9cfe2cd673c, accessed 10.01.2017

Acknowledgements. This project has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 720270 (HBP SGA1).