Author: Eva Souhrada-Kirchmayer
Each supervisory authority shall draw up an annual report on its activities, which may include a list of types of infringement notified and types of measures taken in accordance with Art. 58 para. 2. Those reports shall be transmitted to the national parliament, the government and other authorities as designated by Member State law. They shall be made available to the public, to the Commission and to the Board.
I. Introduction
The function of the activity report is primarily to be transparent to the public. The CJEU has seen the duty of the SA to regularly submit and publish a report on its activities as part of the accountability provided for by the principle of democracy as a counterpart to complete independence.
The purpose is, among other things, to make the work of the authority transparent. The report also serves to raise public awareness of the rights and the risks in connection with the processing of personal data, as well as to enable a review of the resource allocation and the use of funds.
II. Legislative history
Art. 59 GDPR is the successor to Art. 28 para. 5 DPD. However, there was no timeframe, as the DPD only spoke of ‘regularly’. Furthermore, the DPD did not name any addressees of the report, such as the public or the parliament, and made no suggestions regarding the content of the report.
From the perspective of good legislative technique, there is no reason to include the obligation to draw up an annual activity report in a separate article. Art. 57 provides the SAs with 22 tasks. There is no specific reason why the obligation to draw up an annual report was not included in the same Art. 57 as a further task. In proposing the obligation as a separate provision in the GDPR, the Comm probably followed the example of Regulation 45/2001 (now the EUDPR) . However, the inclusion of the activity report in a separate provision can also be interpreted as reflecting the importance of reporting the activities by SAs as part of their accountability.
The Comm-P did not contain a time component. This was only introduced by the EP during the legislative process, as it required a report at least every two years. The Council then introduced the one-year deadline, which also remained in place in the negotiations of the trialogue. The Council also introduced the possibility for Member States to transmit the report to other authorities to be determined in accordance with national law. It was only in the trialogue that the ‘may’-rule (list of reported violations and types of measures taken in accordance with Art. 58 para. 2) was added to the content of the report.
[…]