A Data Protection Authority (DPA) is an independent supervisory body responsible for monitoring compliance with data protection and privacy legislation.
Role of the DPA
The DPA fulfils the role of supervisory authority under the GDPR. Its main activities include:
- Overseeing compliance with legislation
- Issuing opinions and methodological guidance
- Handling citizen complaints
- Imposing sanctions for infringements
- Awareness-raising activities
Fines
DPAs may impose fines up to the maximum set by the GDPR. In practice:
- Large fines for major infringements can reach tens of millions of euros
- Typical fines for cookie violations range from thousands to hundreds of thousands of euros
- DPAs are gradually increasing the number of audits
Website audits
DPAs conduct audits of compliance with cookie rules. They focus particularly on:
- Proper collection of consent
- Information in the cookie policy
- Blocking cookies prior to consent
- The ability to change preferences
Examples
The UK's Information Commissioner's Office (ICO), France's CNIL, Ireland's DPC and Germany's BfDI are among the most active DPAs in Europe.