The Commissioner for Information of Public Importance and Personal Data Protection is an autonomous public authority, who exercises his/her powers independently and whose competences are set by Article 44 of the Law on Personal Data Protection. For the purpose of exercising the duties within his/hers sphere of competence, the Commissioner basically has two types of powers: those relating to his/her capacity of a second-instance authority responsible for protecting the right to data protection in appeal proceedings and those relating to his/her capacity of a supervisory authority responsible for enforcing the law.
The Commissioner shall decide on appeals within 30 days of lodging at the latest. He/she shall first forward appeals to data controller for reply, i.e. presentation of case, and, where necessary shall take such actions to establish the facts as may be necessary in order to rule on an appeal. For that purpose, data controller shall give to the Commissioner or a person specifically authorized by the Commissioner access to data or data files, his/her general enactments and premises and equipment he/she uses.
In deciding upon an appeal, the Commissioner may reject all untimely or incomplete appeals or reject ungrounded appeals. If the Commissioner establishes that the appeal is grounded, he/she shall order the data controller to act upon request within a specified period of time.
The Commissioner's rulings on appeals shall be binding, final and enforceable. Where necessary, the Government shall ensure that the Commissioner's rulings are enforced.
For more information on the Commissioner's inspection powers, use heading "Inspection".
