177. In this context, it is to be noted that the CJEU has repeatedly stressed the need for independent oversight as an essential component of the protection of natural persons with regard to the processing of their personal data. The concept of independence encompasses the areas of institutional autonomy, freedom from instructions and material independence. In order to ensure a consistent monitoring and enforcement of data protection law, supervisory authorities must have effective powers, including corrective and remedial powers. 178. The EDPB agrees with the conclusion of the European Commission that, in an overall assessment, Korea can be considered to have an independent and effective supervisory system even though several bodies of the supervisory system do not meet the above requirements in themselves. For example, most of them do not have executive powers, but are limited to mere recommendations, e.g. the National Human Rights Commission or the Board of Audits and Inspections. Furthermore, most of the respective public bodies are not exclusively data protection institutions, but are usually entrusted with other tasks in the area of fundamental rights protection. 179. However, according to the European Commission's explanations, the EDPB notes that the supervision of law enforcement authorities is comprehensively and without exception guaranteed by the PIPC. Therefore the PIPC possesses investigative, remedial and enforcement powers under PIPA and other data protection laws (e.g. the CPPA) which apply to the entire area of access to personal dat a by law enforcement and national security authorities. 180. In this context, the EDPB would like to emphasize once again that in order to exercise their tasks and powers, supervisory authorities need to be equipped with sufficient human, technical and financial resources. In this regard, there is unfortunately a lack of any information on the designated supervisory bodies, in particular the PIPC. Therefore, the EDPB repeats its request to the European Commission to provide further information on the matter. 181. Overall, the EDPB would like to note that there are hardly any statements, examples or figures in the draft decision regarding the supervisory activities as well as the legal enforcement of data protection law by the supervisory bodies in the area of law enforcement and national security. These would be helpful in the context of evaluating the effectiveness of the supervisory bodies.
4.8 Judicial remedy and redress 182. The EDPB recalls that it is essential for an adequate level of data protection that data subjects are provided with comprehensive remedies and redress against unauthorized data access or processing. These legal remedies must be sufficient to enable the data subject to obtain access to the data stored about him or her and to request that it be corrected or deleted. 183. In the light of the Schrems I and Schrems II judgments by the CJEU, it is clear that in addition to the right to turn to competent authorities, effective judicial protection in the meaning of Article 47(1) of the Charter is of fundamental importance for the assumption of adequacy of the law of a third country. 184. The EDPB recognises that Korea has established various avenues for the execution of individuals’ rights of access, retention, deletion and suspension under PIPA. Those rights can be executed towards the controller itself or via a complaint lodged with the PIPC or other supervisory bodies, e.g. the National Human Rights Commission. Furthermore, the EDPB recognises the possibility to challenge controllers or public authorities’ decision in response to their request on the basis of the Administrative Litigation Act. 185. In addition, The EDPB understands from the explanations given by the European Commission that individuals may challenge the actions of law enforcement and national security authorities before
Adopted
37
