General Data Protection Regulation

Article 55

Competence

1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.

2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.

3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.

Holdings

/
C-33/2216 Jan 2024

Österreichische Datenschutzbehörde v WK

Where a Member State has set up a single supervisory authority under Regulation 2016/679 but has not given it power to monitor a parliamentary committee of inquiry that scrutinises the executive, Article 77(1) and Article 55(1) directly give that authority power to hear complaints about that committee's processing of personal data.

C-245/2024 Mar 2022

X and Z v Autoriteit Persoonsgegevens

When a court temporarily makes documents from court proceedings containing personal data available to journalists so they can better report on those proceedings, it is acting in its "judicial capacity".