L 119/22
EN
Official Journal of the European Union
4.5.2016
(115) Some third countries adopt laws, regulations and other legal acts which purport to directly regulate the
processing activities of natural and legal persons under the jurisdiction of the Member States. This may include
judgments of courts or tribunals or decisions of administrative authorities in third countries requiring a
controller or processor to transfer or disclose personal data, and which are not based on an international
agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union
or a Member State. The extraterritorial application of those laws, regulations and other legal acts may be in
breach of international law and may impede the attainment of the protection of natural persons ensured in the
Union by this Regulation. Transfers should only be allowed where the conditions of this Regulation for a transfer
to third countries are met. This may be the case, inter alia, where disclosure is necessary for an important ground
of public interest recognised in Union or Member State law to which the controller is subject.
(116) When personal data moves across borders outside the Union it may put at increased risk the ability of natural
persons to exercise data protection rights in particular to protect themselves from the unlawful use or disclosure
of that information. At the same time, supervisory authorities may find that they are unable to pursue
complaints or conduct investigations relating to the activities outside their borders. Their efforts to work together
in the cross-border context may also be hampered by insufficient preventative or remedial powers, inconsistent
legal regimes, and practical obstacles like resource constraints. Therefore, there is a need to promote closer
cooperation among data protection supervisory authorities to help them exchange information and carry out
investigations with their international counterparts. For the purposes of developing international cooperation
mechanisms to facilitate and provide international mutual assistance for the enforcement of legislation for the
protection of personal data, the Commission and the supervisory authorities should exchange information and
cooperate in activities related to the exercise of their powers with competent authorities in third countries, based
on reciprocity and in accordance with this Regulation.
(117) The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise
their powers with complete independence, is an essential component of the protection of natural persons with
regard to the processing of their personal data. Member States should be able to establish more than one
supervisory authority, to reflect their constitutional, organisational and administrative structure.
(118) The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject
to control or monitoring mechanisms regarding their financial expenditure or to judicial review.
(119) Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for
ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member
State should in particular designate the supervisory authority which functions as a single contact point for the
effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other
supervisory authorities, the Board and the Commission.
(120) Each supervisory authority should be provided with the financial and human resources, premises and
infrastructure necessary for the effective performance of their tasks, including those related to mutual assistance
and cooperation with other supervisory authorities throughout the Union. Each supervisory authority should
have a separate, public annual budget, which may be part of the overall state or national budget.
(121) The general conditions for the member or members of the supervisory authority should be laid down by law in
each Member State and should in particular provide that those members are to be appointed, by means of a
transparent procedure, either by the parliament, government or the head of State of the Member State on the
basis of a proposal from the government, a member of the government, the parliament or a chamber of the
parliament, or by an independent body entrusted under Member State law. In order to ensure the independence
of the supervisory authority, the member or members should act with integrity, refrain from any action that is
incompatible with their duties and should not, during their term of office, engage in any incompatible
occupation, whether gainful or not. The supervisory authority should have its own staff, chosen by the
supervisory authority or an independent body established by Member State law, which should be subject to the
exclusive direction of the member or members of the supervisory authority.
(122) Each supervisory authority should be competent on the territory of its own Member State to exercise the powers
and to perform the tasks conferred on it in accordance with this Regulation. This should cover in particular the