The Set Up of Data Protection Authorities as a New Regulatory Approach

Embedded in a dissertation project that is dedicated to a comparative analysis of data protection authorities (DPAs; EU Directive 1995),1 this chapter aims to shed light on the conception of DPAs as a new regulatory approach by the European Union (EU). Since there is little research on DPAs from a political science perspective, the theoretical foundations of and empirical findings about independent regulatory agencies (IRAs) can help to serve as a template model providing a framework for analysis of DPAs.2 IRAs represent a crucial instrument of the regulatory state, which is characterised by ongoing deregulation, increased delegation and reregulation processes (Majone 1994, 1996, 1997). They comprise a relatively new attempt to cope with societal challenges that elude traditional models of governance. The EU Data Protection Directive makes use of this instrument, stipulating mandatory supervisory authorities, which have to fulfil a variety of different functions. DPAs are not only expected to serve as ombudsmen, auditors, consultants, educators, policy advisers and negotiators, but they should also be able to enforce changes in behaviour, when private or public actors violate data protection legislation (Bennet and Raab 2006, p. 135). Most importantly, contrary to most IRAs, DPAs are not only assigned to supervise private entities such as companies of various business sectors, but they are also expected to watch over public authorities, i.e. executive, legislative and judicial