data protection and automated decisions
Data Protection and Digital Rights Authority
Oversee how Candeia processes personal data and applies digital rights, including biometrics, transfers and high-impact automated systems, independently from the areas being supervised.
Pre-Foundation · permanent institution not installedConstitutional Proposal · reference text · not promulgated
Why it exists
Those operating identity, service or security systems should not be solely responsible for overseeing their own use of data. The Authority is the proposed structure for receiving complaints, investigating practices and requiring corrections within the ecosystem.
How it oversees data and automation
Oversee data processing, international transfers, biometrics, high-impact automation and digital rights with full independence.
Oversee public and private entities subject to data law. Maintain the Public Register of High-Impact Automated Systems and receive impact assessments. Order mitigation, audits, precautionary suspension and systemic correction within its competence.
5 members: 1 elected by the Assembly by a three-fifths majority; 1 appointed by the President; 1 chosen by the Constitutional Court by a two-thirds majority; 1 by the Ombudsman; and 1 selected by public lot, all from Constitutional Appointments Commission processes/lists.
The composition must bring together expertise in data protection, fundamental rights, technology, security, regulation, accessibility, international transfers and automated systems.
Single, staggered seven-year terms.
No source controls a majority or instructs a member. The Authority selects and directs its staff and controls its enforcement and supervisory proceedings.
A separate, public annual budget protected by Art. 265.
Only for serious grounds, by decision of 6 of the 9 members of the Constitutional Court after constitutionally authorised proceedings are initiated.
Judicial review; coordination without subordination with the Civil Registry, Identity Authority, NEC, Judiciary, Court of Audit, NCTC and Intelligence Inspectorate; and financial audit without substantive interference.
Register of high-impact systems, impact assessments, aggregated reports, decisions, technical criteria, suspended transfers and corrective measures.
It does not replace a judicial warrant, electoral certification, judgment, registry fact, tax assessment or the substantive competence of another body.
What it protects in practice
- Oversee public and private entities subject to data law.
- Maintain the Public Register of High-Impact Automated Systems and receive impact assessments.
- Order mitigation, audits, precautionary suspension and systemic correction within its competence.
Data protection has its own scope
The Authority does not replace a judge, electoral certification, judgment, registry fact, tax assessment or the substantive competence of another Candeian institution.