Shaping vs applying data protection law: two core functions of data protection authorities

Data protection authorities (DPAs) are shaping and applying data protection law, and at the same time, they are advocates, ombudspersons, and administrative authorities. In this study, the author intends to describe these functions as inevitable for efficient operation of any DPA. Understanding these functions and the possible role models that can be used to implement them might help us to understand some member state measures towards national DPAs, the recent case law of the European Court of Justice relating to the ‘complete independence’ of these authorities, and might contribute to the assessment of the ongoing European Union data protection reform. The author argues that the emphasis on one function or another correlates with the state of data protection in a given jurisdiction.