Article 58
Powers

Official
Texts
Guidelines
& Caselaw
Review of
EU Regulation
Review of
Nat. Regulation
Show the recitals of the Regulation related to article 58 keyboard_arrow_down Hide the recitals of the Regulation related to article 58 keyboard_arrow_up

(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Show the recitals of the Directive related to article 58 keyboard_arrow_down Hide the recitals of the Directive related to article 58 keyboard_arrow_up

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, and powers to engage in legal proceedings; whereas such authorities must help to ensure transparency of processing in the Member States within whose jurisdiction they fall;

The GDPR

The Regulation aims, in order to ensure consistency in control and enforcement throughout the Union, that the supervisory authorities have, in each Member State, the same effective powers.

Article 58 provides quite precisely three types of powers, which the Member States must, by law, grant to their national supervisory authority:

- investigative powers (paragraph 1): to include ordering communication of information - including the processed data - needed by the supervisory authority to perform its duties (a) to carry out investigations in the form of data protection audits (b), to carry out a review on certifications issued pursuant to Article 42 (7) (c), to notify the controller or the processor of an alleged infringement of this Regulation (d); access to all personal data and to all information (e); access to any premises of the controller and the processor in compliance with Union law and national procedural law (f).

- powers to take corrective action (paragraph 2): to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation (a), to issue reprimands to a controller or a processor in case of any infringement found (b), to order the controller or the processor to comply with the data subject's requests to exercise his or her rights  (c), to order the controller or processor to bring processing operations into compliance in a specified manner and within a specified period (d), to order the controller to communicate a personal data breach to the data subject (e), to impose a temporary or definitive limitation including a ban on processing (f), to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients to whom the personal data have been disclosed (g), to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met (h), to impose an administrative fine pursuant to Article 83 (i), to order the suspension of data flows to a recipient in a third country or to an international organisation (j).

- authorisation and advisory powers (paragraph ): to advise the controller in accordance with the prior consultation procedure referred to in Article 36 (a); to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data (b); to authorise processing referred to in Article 36 (5), if the law of the Member State requires such prior authorization (c); to issue an opinion and approve draft codes of conduct (d); to accredit certification bodies (e); to issue certifications and approve criteria of certification (f); to adopt standard data protection clauses referred to in Article 28 (8) and in point (d) of Article 46 (2) (g); to authorise contractual clauses (h); to authorise administrative arrangements (i) or to approve binding corporate rules pursuant to Article 47 (j).

According to paragraph 4, the exercise of powers of the supervisory authorities must be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union (see developments in recital 129).

Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation (paragraph 5).

Finally, the Member States may provide by law that its supervisory authority shall have additional powers and the exercise of those powers shall not impair the effective operation of Chapter VII relating to the cooperation and the consistency (paragraph 6).

The Directive

Article 28 of the Directive provided for two types of powers given to supervisory authorities: a power of consultation of the national authorities drawing up administrative measures or regulations relating to the protection of the rights and freedoms of individuals with regard to the personal data processing (paragraph 2); effective powers of control expressed in investigative powers, effective powers of intervention and powers to engage in legal proceedings (paragraph 3).

However. A wide space for manoeuvring was left to Member States so that eventually, the powers of national supervisory authorities could differ widely from one Member State to another.

Potential issues

The powers provided to the national supervisory authorities are considerable - including sanctions - and probably will change the relationship profoundly between them and the controllers or the processors, in particular, where the authorities were previously organized as mere advisory and conciliation bodies. Thus they acquire coercive powers similar to those of the administrative authorities such as the competition authorities, with the well-known fear that they generate for the enterprises. They are therefore established for the future as real "policemen" of the data protection.

This extension of powers will necessarily involve a dramatic strengthening of human and financial resources available to existing authorities if we are to prevent these from remaining a dead letter. This will certainly raise some reluctance from the Member States, but will undoubtedly allow for the protection to be taken much more seriously than at present. In any event, the status of these authorities may change profoundly and give them institutional importance that they did not have before.

It should be noted that the Member States will retain discretion as to the application of fines to public authorities and organizations (see the comments on Article 83).

Group 29

Guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679 (3 October 2017)

(Endorsed by the EDPB)

The EU has completed a comprehensive reform of data protection regulation in Europe. The reform rests on several pillars (key components): coherent rules, simplified procedures, coordinated actions, user involvement, more effective information and stronger enforcement powers.

Data controllers and data processors have increased responsibilities to ensure that personal data of the individuals is protected effectively. Supervisory authorities have powers to ensure that the principles of the General Data Protection Regulation (hereafter ‘the Regulation’) as well as the rights of the individuals concerned are upheld according to the wording and the spirit of the Regulation.

Consistent enforcement of the data protection rules is central to a harmonized data protection regime. Administrative fines are a central element in the new enforcement regime introduced by the Regulation, being a powerful part of the enforcement toolbox of the supervisory authorities together with the other measures provided by article 58.

This document is intended for use by the supervisory authorities to ensure better application and enforcement of the Regulation and expresses their common understanding of the provisions of article 83 of the Regulation as well as its interplay with articles 58 and 70 and their corresponding recitals.

In particular, according to article 70, (1) (e), the European Data Protection Board (hereafter ‘EDPB’) is empowered to issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation and article 70, (1), (k) specifies the provision for guidelines concerning the setting of administrative fines.

These guidelines are not exhaustive, neither will they provide explanations about the differences between administrative, civil or criminal law systems when imposing administrative sanctions in general.

In order to achieve a consistent approach to the imposition of the administrative fines, which adequately reflects all of the principles in these guidelines, the EDPB has agreed on a common understanding of the assessment criteria in article 83 (2) of the Regulation and therefore the EDPB and individual supervisory authorities agree on using this Guideline as a common approach.

Link

CJEU caselaw

C-230/14 (1 october 2015)

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court 

Regulation
1e 2e

Art. 58

1.   Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2.   Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3.   Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6.   Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.

1st proposal close

Art. 53 

1.           Each supervisory authority shall have the power:

(a)     to notify the controller or the processor of an alleged breach of the provisions governing the processing of personal data, and, where appropriate, order the controller or the processor to remedy that breach, in a specific manner, in order to improve the protection of the data subject;

(b)     to order the controller or the processor to comply with the data subject's requests to exercise the rights provided by this Regulation;

(c)     to order the controller and the processor, and, where applicable, the representative to provide any information relevant for the performance of its duties;

(d)     to ensure the compliance with prior authorisations and prior consultations referred to in Article 34;

(e)     to warn or admonish the controller or the processor;

(f)      to order the rectification, erasure or destruction of all data when they have been processed in breach of the provisions of this Regulation and the notification of such actions to third parties to whom the data have been disclosed;

(g)     to impose a temporary or definitive ban on processing;

(h)     to suspend data flows to a recipient in a third country or to an international organisation;

(i)      to issue opinions on any issue related to the protection of personal data;

(j)      to inform the national parliament, the government or other political institutions as well as the public on any issue related to the protection of personal data.

2.           Each supervisory authority shall have the investigative power to obtain from the controller or the processor:

(a)     access to all personal data and to all information necessary for the performance of its duties;

(b)     access to any of its premises, including to any data processing equipment and means, where there are reasonable grounds for presuming that an activity in violation of this Regulation is being carried out there.

The powers referred to in point (b) shall be exercised in conformity with Union law and Member State law.

3.           Each supervisory authority shall have the power to bring violations of this Regulation to the attention of the judicial authorities and to engage in legal proceedings, in particular pursuant to Article 74(4) and Article 75(2).

4.           Each supervisory authority shall have the power to sanction administrative offences, in particular those referred to in Article 79(4), (5) and (6).

2nd proposal close

Art. 53

 1. Each Member State shall provide by law that its supervisory authority shall have at least the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller’s representative to provide any information it requires for the performance of its tasks; (aa) to carry out investigations in the form of data protection audits;

(ab) to carry out a review on certifications issued pursuant to Article 39(4);

(b) (…)

(c) (…)

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(da) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(db) to obtain access to any premises of the controller and the processor , including to any data processing equipment and means, in conformity with Union law or Member State procedural law.

1a. (…).

1b. Each Member State shall provide by law that its supervisory authority shall have the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

 (b) to issue reprimands to a controller or processor where processing operations have infringed provisions of this Regulation;

(c) (…);

(ca) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; in particular by ordering the rectification, restriction or erasure of data pursuant to Articles 16, 17 and 17a and the notification of such actions to recipients to whom the data have been disclosed pursuant to Articles 17(2a) and 17b;

(e) to impose a temporary or definitive limitation on processing (…);

(f) to order the suspension of data flows to a recipient in a third country or to an international organisation;

(g) to impose an administrative fine pursuant to Articles 79 and 79a, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.

1c. Each Member State shall provide by law that its supervisory authority shall have the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 34,

(aa) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with national law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(ab) to authorise processing referred to in Article 34(7a), if the law of the Member State requires such prior authorisation;

(ac) to issue an opinion and approve draft codes of conduct pursuant to Article 38(2);

(ad) to accredit certification bodies under the terms of Article 39a; (ae) to issue certifications and approve criteria of certification in accordance with Article 39(2a); (b) to adopt standard data protection clauses referred to in point (c) of Article 42(2);

(c) to authorise contractual clauses referred to in point (a) of Article 42 (2a);

(ca) to authorise administrative agreements referred to in point (d) of Article 42 (2a);

(d) to approve binding corporate rules pursuant to Article 43. 2. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union.

3. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and (…), where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

4. (…)

5. (…)

Directive close

Art. 28

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Each authority shall in particular be endowed with:

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.

Section 14 GDPR Implementation Law. Tasks and powers

1. The Dutch Data Protection Authority is competent to perform the tasks and exercise the powers that are conferred on the supervisory authority by or pursuant to the Regulation.

4. Sections 5:4 to 5:10a of the General Administrative Law Act apply equally to the corrective powers referred to in Article 58(2)(b) to (j) of the Regulation.


Section 15 GDPR Implementation Law. Supervision of compliance

1. The members and extraordinary members of the Dutch Data Protection Authority, the officials of the Dutch Data Protection Authority’s secretariat as well as the persons designated by order of the Dutch Data Protection Authority
are responsible for monitoring compliance with the Regulation and the processing of personal data in accordance with provisions laid down by or pursuant to the law.
2. The persons referred to in subsection 1 may enter a dwelling without the occupant’s permission.
3. The persons referred to in subsection 1 require the explicit and special authorisation of the Dutch Data Protection Authority for the purpose of exercising the power set out in subsection 2, without prejudice to Section 2 of the General Act on Entry into Dwellings.
4. No obligation of secrecy may be invoked in so far as information or cooperation is requested in connection with the data subject’s own involvement with the processing of personal data.
5. This section and Title 5.2 of the General Administrative Law Act apply equally in so far as this is required for the proper performance of the Dutch Data Protection Authority’s tasks in the context of Chapter VII of the Regulation.


Section 16 GDPR Implementation Law. Administrative enforcement order
1. The Dutch Data Protection Authority may impose an administrative enforcement order to enforce obligations laid down by or pursuant to this Act.
2. The Dutch Data Protection Authority may impose an administrative enforcement order to enforce Section 5:20(1) of the General Administrative Law Act in so far as it concerns the obligation to cooperate with a request by an official designated by or pursuant to Section 15(1).


Section 20 GDPR Implementation Law. Taking legal action against infringements of the Regulation
regarding transfer to a third country


1. If, during an investigation into the transfer of personal data to a country outside the European Union or to an international organisation, which investigation is conducted at the request of an interested party, the Dutch Data Protection Authority has well-founded reasons to assume that an adequacy decision as referred to in Article 45(1) of the Regulation, taken by the European Commission with respect to the relevant country or international organisation, or a decision regarding the adoption or approval of standard data protection clauses as referred to in Article 46(2)(c) and (d) of the Regulation does not provide sufficient safeguards for an adequate level of data protection, the Dutch Data Protection Authority may file an application with the Administrative Law Division of the Council of State for a declaratory decision that the relevant decision is valid.
2. The application must be signed and must at least include:
a. the date;
b. the grounds for the application;
c. the names of the interested party and the party that is the subject of the investigation referred to in subsection 1.
3. The application will include a copy of the interested party’s request for the enforcement of rules on the protection of personal data provided by or pursuant to the law, to which the Dutch Data Protection Authority’s application referred to in subsection 2 relates, as well as other documents that are relevant to the matter.
4. Without prejudice to Section 4:15 of the General Administrative Law Act, the time limit for issuing a decision on the enforcement request will be suspended from the day after the Dutch Data Protection Authority notifies the party making the request that subsection 1 has been applied to the day on which the Administrative Law Division of the Council of State issues a decision as referred to in subsection 6.
5. Titles 8.1 and 8.2 of the General Administrative Law Act, with the exception of Sections 8:1 to 8:10, 8:41, Divisions 8.2.2a and 8.2.4a and Sections 8:70, 8:72 and 8:74, apply equally to the handling of the request. The parties referred to in subsection 2(c) will be regarded as parties to the proceedings.
6. If the Administrative Law Division of the Council of State finds, whether or not following a reference for a preliminary ruling pursuant to Article 267 of the Treaty on the Functioning of the European Union to the Court of Justice of the European Union, that the European Commission’s decision that has been submitted to it is valid, it will issue a declaratory decision to that effect. If it finds, following a reference for a preliminary ruling to the Court of Justice of the European Union, that the decision that has been submitted to it is invalid, it will dismiss the application.
7. The Administrative Law Division of the Council of State may decide to stay the application if a question regarding the validity of the relevant decision has already been referred for a preliminary ruling and is pending before the Court of Justice of the European Union.
8. The stay of the application by the Administrative Law Division of the Council of State cannot be appealed.


Section 36 GDPR Implementation Law. Dispute resolution by Dutch Data Protection Authority or
through code of conduct


1. The interested party may also file a request with the Dutch Data Protection Authority, within the time limit set for the appeal under the General Administrative Law Act or within the time limit referred to in Section 35(2), to mediate in or advise on his or her dispute with the controller or to use a dispute resolution scheme as referred to in Article 40(2)(k) of the Regulation under an approved code of conduct as referred to in Article 40(5) of the Regulation. In that case, in derogation from Section 6:7 of the General Administrative Law Act, the appeal may still be filed or the proceedings referred to in Section 35 may still be issued after the interested party has been notified – either by the
Dutch Data Protection Authority or pursuant to the dispute resolution scheme – that the case has been closed, but not more than six weeks after such date.
2. During the appeal hearing and the proceedings referred to in subsection 1, the bodies charged with resolving the dispute may request the Dutch Data Protection Authority to issue an opinion.


Title 5.2 General Administrative Law Act. Supervision on compliance

Section 5:11

In the following title, supervisor has the following meaning: a person, charged by or pursuant to a statutory provision with supervising compliance with the provisions of or pursuant to any statutory provision.

Section 5:12

1. In the performance of his duties, a supervisor shall carry proof of identity issued by the administrative body under whose responsibility the supervisor works.
2. A supervisor shall show his proof of identity immediately upon request.
3. The proof of identity shall contain a photograph of the supervisor and shall in any case state his name and capacity. The model of the identity document shall be laid down by regulation of Our Minister of Security and Justice.

Section 5:13

A supervisor shall only use his powers to the extent that this is reasonably necessary for the performance of his duties.

Section 5:14

The powers vested in the supervisor may be limited by a statutory provision or by a decision of the administrative body that designates the supervisor a such.

Section 5:15

1. A supervisor shall be authorised to enter any place, taking into account the necessary equipment, with the exception of a dwelling without the consent of the occupant.
2. If necessary, he shall gain access with aid of the strong arm.
3. he shall be entitled to be accompanied by persons designated by him for this purpose.

Section 5:16

A supervisor is authorized to demand intelligences.

Section 5:17

1. A supervisor is authorised to demand inspection of business data and documents.
2. He is autohorised to make copies of the data and documents.
3. If copies cannot be made on the spot, he shall be entitled to take the information and documents with him for a short period of time in exchange for a written proof to be provided by him.

Section 5:18

1. A supervisor is authorised to examine goods, to submit them to inspection and to take samples of them.
2. To this end, he shall be authorised to open packages.
3. At the request of the interested party, the supervisor shall, if possible, take a second sample, unless otherwise provided by or pursuant to a statutory provision.
4. If the examination, inspection or sampling cannot take place on site, the supervisor shall be authorised to take goods with him for a short period of time for that purpose in exchange for written proof to be provided by him.
5. The samples taken shall be returned to the extent possible.
6. At the request of the interested party, he shall be informed as soon as possible of the results of the examination, the taking of goods and/or samples.

Section 5:19 

1. A supervisor shall be authorised to examine means of transportation in respect of which he has a supervisory duty. 
2. He shall be authorised to examine the cargo of means of transportation with which, in his reasonable opinion, goods are being transported in relation to which he has a supervisory duty.
3. He shall be authorised to require the driver of a means of transportation to show the documents presecribed by law in respect of which he has a supervisory duty.
4. In regard to the exercise of these powers, he shall be entitled to demand that the driver of a vehicle or the skipper of a vessel stop his means of transportation and transfer it to a place designated by him.
5. The manner in which the claim to immobilisation is made shall be determined by regulation of Our Minister of Security and Jusitce.

Section 5:20

1. Anyone is obliged to cooperatie with a supervisor within the reasonable period of time set by the supervisor in every way that the supervisor can reasonably demand in the exercise of his powers.
2. Those who are obliged to preserve confidentiality by virtue of their office, profession or statutory regulations may refuse to cooperatie, to the extent that this follows form their duty of confidentiality.

close