L 119/24
EN
Official Journal of the European Union
4.5.2016
possibility to submit a draft for a decision, of which the lead supervisory authority should take utmost account
when preparing its draft decision in that one-stop-shop mechanism.
(128) The rules on the lead supervisory authority and the one-stop-shop mechanism should not apply where the
processing is carried out by public authorities or private bodies in the public interest. In such cases the only
supervisory authority competent to exercise the powers conferred to it in accordance with this Regulation should
be the supervisory authority of the Member State where the public authority or private body is established.
(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the
supervisory authorities should have in each Member State the same tasks and effective powers, including powers
of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of
complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under
Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and
engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive
limitation, including a ban, on processing. Member States may specify other tasks related to the protection of
personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance
with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a
reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of
ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect
the right of every person to be heard before any individual measure which would affect him or her adversely is
taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers
as regards access to premises should be exercised in accordance with specific requirements in Member State
procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of
the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority
which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of
the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an
effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The
adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the
supervisory authority that adopted the decision.
(130) Where the supervisory authority with which the complaint has been lodged is not the lead supervisory authority,
the lead supervisory authority should closely cooperate with the supervisory authority with which the complaint
has been lodged in accordance with the provisions on cooperation and consistency laid down in this Regulation.
In such cases, the lead supervisory authority should, when taking measures intended to produce legal effects,
including the imposition of administrative fines, take utmost account of the view of the supervisory authority
with which the complaint has been lodged and which should remain competent to carry out any investigation on
the territory of its own Member State in liaison with the competent supervisory authority.
(131) Where another supervisory authority should act as a lead supervisory authority for the processing activities of
the controller or processor but the concrete subject matter of a complaint or the possible infringement concerns
only processing activities of the controller or processor in the Member State where the complaint has been
lodged or the possible infringement detected and the matter does not substantially affect or is not likely to
substantially affect data subjects in other Member States, the supervisory authority receiving a complaint or
detecting or being informed otherwise of situations that entail possible infringements of this Regulation should
seek an amicable settlement with the controller and, if this proves unsuccessful, exercise its full range of powers.
This should include: specific processing carried out in the territory of the Member State of the supervisory
authority or with regard to data subjects on the territory of that Member State; processing that is carried out in
the context of an offer of goods or services specifically aimed at data subjects in the territory of the Member
State of the supervisory authority; or processing that has to be assessed taking into account relevant legal
obligations under Member State law.
(132) Awareness-raising activities by supervisory authorities addressed to the public should include specific measures
directed at controllers and processors, including micro, small and medium-sized enterprises, as well as natural
persons in particular in the educational context.