menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Poland) language
Contact our local member in Poland mail_outline
Visit the website of GKR Legal account_balance

arrow_backPrevious Article
Article 58
Next Articlearrow_forward

Powers

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 58 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 58 keyboard_arrow_up

Key words related to article 58

Show the recitals of the Regulation related to article 58 keyboard_arrow_down Hide the recitals of the Regulation related to article 58 keyboard_arrow_up

(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Show the recitals of the Directive related to article 58 keyboard_arrow_down Hide the recitals of the Directive related to article 58 keyboard_arrow_up

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, and powers to engage in legal proceedings; whereas such authorities must help to ensure transparency of processing in the Member States within whose jurisdiction they fall;

The GDPR

The Regulation aims, in order to ensure consistency in control and enforcement throughout the Union, that the supervisory authorities have, in each Member State, the same effective powers.

Article 58 provides quite precisely three types of powers, which the Member States must, by law, grant to their national supervisory authority:

- investigative powers (paragraph 1): to include ordering communication of information - including the processed data - needed by the supervisory authority to perform its duties (a) to carry out investigations in the form of data protection audits (b), to carry out a review on certifications issued pursuant to Article 42 (7) (c), to notify the controller or the processor of an alleged infringement of this Regulation (d); access to all personal data and to all information (e); access to any premises of the controller and the processor in compliance with Union law and national procedural law (f).

- powers to take corrective action (paragraph 2): to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation (a), to issue reprimands to a controller or a processor in case of any infringement found (b), to order the controller or the processor to comply with the data subject's requests to exercise his or her rights  (c), to order the controller or processor to bring processing operations into compliance in a specified manner and within a specified period (d), to order the controller to communicate a personal data breach to the data subject (e), to impose a temporary or definitive limitation including a ban on processing (f), to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients to whom the personal data have been disclosed (g), to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met (h), to impose an administrative fine pursuant to Article 83 (i), to order the suspension of data flows to a recipient in a third country or to an international organisation (j).

- authorisation and advisory powers (paragraph ): to advise the controller in accordance with the prior consultation procedure referred to in Article 36 (a); to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data (b); to authorise processing referred to in Article 36 (5), if the law of the Member State requires such prior authorization (c); to issue an opinion and approve draft codes of conduct (d); to accredit certification bodies (e); to issue certifications and approve criteria of certification (f); to adopt standard data protection clauses referred to in Article 28 (8) and in point (d) of Article 46 (2) (g); to authorise contractual clauses (h); to authorise administrative arrangements (i) or to approve binding corporate rules pursuant to Article 47 (j).

According to paragraph 4, the exercise of powers of the supervisory authorities must be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union (see developments in recital 129).

Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation (paragraph 5).

Finally, the Member States may provide by law that its supervisory authority shall have additional powers and the exercise of those powers shall not impair the effective operation of Chapter VII relating to the cooperation and the consistency (paragraph 6).

The Directive

Article 28 of the Directive provided for two types of powers given to supervisory authorities: a power of consultation of the national authorities drawing up administrative measures or regulations relating to the protection of the rights and freedoms of individuals with regard to the personal data processing (paragraph 2); effective powers of control expressed in investigative powers, effective powers of intervention and powers to engage in legal proceedings (paragraph 3).

However. A wide space for manoeuvring was left to Member States so that eventually, the powers of national supervisory authorities could differ widely from one Member State to another.

Potential issues

The powers provided to the national supervisory authorities are considerable - including sanctions - and probably will change the relationship profoundly between them and the controllers or the processors, in particular, where the authorities were previously organized as mere advisory and conciliation bodies. Thus they acquire coercive powers similar to those of the administrative authorities such as the competition authorities, with the well-known fear that they generate for the enterprises. They are therefore established for the future as real "policemen" of the data protection.

This extension of powers will necessarily involve a dramatic strengthening of human and financial resources available to existing authorities if we are to prevent these from remaining a dead letter. This will certainly raise some reluctance from the Member States, but will undoubtedly allow for the protection to be taken much more seriously than at present. In any event, the status of these authorities may change profoundly and give them institutional importance that they did not have before.

It should be noted that the Member States will retain discretion as to the application of fines to public authorities and organizations (see the comments on Article 83).

arrow_back Previous Article • Article 58 • Next Article arrow_forward
arrow_back Previous Article • Article 58 Next Article arrow_forward

Summary

European Union

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the application and setting of administrative fines - wp253 (3 October 2017)

(Endorsed by the EDPB)

The EU has completed a comprehensive reform of data protection regulation in Europe. The reform rests on several pillars (key components): coherent rules, simplified procedures, coordinated actions, user involvement, more effective information and stronger enforcement powers.

Data controllers and data processors have increased responsibilities to ensure that personal data of the individuals is protected effectively. Supervisory authorities have powers to ensure that the principles of the General Data Protection Regulation (hereafter ‘the Regulation’) as well as the rights of the individuals concerned are upheld according to the wording and the spirit of the Regulation.

Consistent enforcement of the data protection rules is central to a harmonized data protection regime. Administrative fines are a central element in the new enforcement regime introduced by the Regulation, being a powerful part of the enforcement toolbox of the supervisory authorities together with the other measures provided by article 58.

This document is intended for use by the supervisory authorities to ensure better application and enforcement of the Regulation and expresses their common understanding of the provisions of article 83 of the Regulation as well as its interplay with articles 58 and 70 and their corresponding recitals.

In particular, according to article 70, (1) (e), the European Data Protection Board (hereafter ‘EDPB’) is empowered to issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation and article 70, (1), (k) specifies the provision for guidelines concerning the setting of administrative fines.

These guidelines are not exhaustive, neither will they provide explanations about the differences between administrative, civil or criminal law systems when imposing administrative sanctions in general.

In order to achieve a consistent approach to the imposition of the administrative fines, which adequately reflects all of the principles in these guidelines, the EDPB has agreed on a common understanding of the assessment criteria in article 83 (2) of the Regulation and therefore the EDPB and individual supervisory authorities agree on using this Guideline as a common approach.

Link

Retour au sommaire
arrow_back Previous Article • Article 58 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-230/14 (1 october 2015) - Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court 

C-311/18 (19 December 2019) - Facebook Ireland et Schrems

1.   Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that that regulation applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, irrespective of whether, at the time of that transfer or thereafter, that data is liable to be processed by the authorities of the third country in question for the purposes of public security, defence and State security.

2.   Article 46(1) and Article 46(2)(c) of Regulation 2016/679 must be interpreted as meaning that the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses are afforded a level of protection essentially equivalent to that guaranteed within the European Union by that regulation, read in the light of the Charter of Fundamental Rights of the European Union. To that end, the assessment of the level of protection afforded in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country, in particular those set out, in a non-exhaustive manner, in Article 45(2) of that regulation.

3.   Article 58(2)(f) and (j) of Regulation 2016/679 must be interpreted as meaning that, unless there is a valid European Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard data protection clauses adopted by the Commission, if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law, in particular by Articles 45 and 46 of that regulation and by the Charter of Fundamental Rights, cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.

4.   Examination of Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EU of the European Parliament and of the Council, as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights has disclosed nothing to affect the validity of that decision.

5.   Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield is invalid.

Opinion of Advocate general

Judgment of the Court

C-210/16 (7 June 2018) - Wirtschaftsakademie Schleswig-Holstein

1.      Article 2(d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the concept of ‘controller’ within the meaning of that provision encompasses the administrator of a fan page hosted on a social network.

2.      Articles 4 and 28 of Directive 95/46 must be interpreted as meaning that, where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State.

3.      Article 4(1)(a) and Article 28(3) and (6) of Directive 95/46 must be interpreted as meaning that, where the supervisory authority of a Member State intends to exercise with respect to an entity established in the territory of that Member State the powers of intervention referred to in Article 28(3) of that directive, on the ground of infringements of the rules on the protection of personal data committed by a third party responsible for the processing of that data whose seat is in another Member State, that supervisory authority is competent to assess, independently of the supervisory authority of the other Member State, the lawfulness of such data processing and may exercise its powers of intervention with respect to the entity established in its territory without first calling on the supervisory authority of the other Member State to intervene.

Opinion of Advocate general

Judgment of the Court

C-645/19 (15 June 2021) - Facebook Ireland Ltd e.a. c. Gegevensbeschermingsautoriteit

1) Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a supervisory authority of a Member State which, under the national legislation adopted in order to transpose Article 58(5) of that regulation, has the power to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where necessary, to initiate or engage in legal proceedings, may exercise that power in relation to an instance of cross‑border data processing even though it is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, with respect to that data processing, provided that that power is exercised in one of the situations where Regulation 2016/679 confers on that supervisory authority a competence to adopt a decision finding that such processing is in breach of the rules contained in that regulation and that the cooperation and consistency procedures laid down by that regulation are respected.

2) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the lead supervisory authority, to initiate or engage in legal proceedings, within the meaning of that provision, that the controller or processor with respect to the cross-border processing of personal data against whom such proceedings are brought has a main establishment or another establishment on the territory of that Member State.

3) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where appropriate, to initiate or engage in legal proceedings, within the meaning of that provision, may be exercised both with respect to the main establishment of the controller which is located in that authority’s own Member State and with respect to another establishment of that controller, provided that the object of the legal proceedings is a processing of data carried out in the context of the activities of that establishment and that that authority is competent to exercise that power, in accordance with the terms of the answer to the first question referred.

4) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, has brought a legal action, the object of which is an instance of cross-border processing of personal data, before 25 May 2018, that is, before the date when that regulation became applicable, that action may, from the perspective of EU law, be continued on the basis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which remains applicable in relation to infringements of the rules laid down in that directive committed up to the date when that directive was repealed. That action may, in addition, be brought by that authority with respect to infringements committed after that date, on the basis of Article 58(5) of Regulation 2016/679, provided that that action is brought in one of the situations where, exceptionally, that regulation confers on a supervisory authority of a Member State which is not the ‘lead supervisory authority’ a competence to adopt a decision finding that the processing of data in question is in breach of the rules contained in that regulation with respect to the protection of the rights of natural persons as regards the processing of personal data, and that the cooperation and consistency procedures laid down by that regulation are respected, which it is for the referring court to determine.

5) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.

Opinion of Advocate general

Judgment of the Court

C-807/21,  Deutsche Wohnen SE v. Staatsanwaltschaft Berlin (5 December 2023)

1.      Article 58(2)(i) and Article 83(1) to (6) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as precluding national legislation under which an administrative fine may be imposed on a legal person in its capacity as controller in respect of an infringement referred to in Article 83(4) to (6) only in so far as that infringement has previously been attributed to an identified natural person.

2.      Article 83 of Regulation 2016/679

must be interpreted as meaning that an administrative fine may be imposed pursuant to that provision only where it is established that the controller, which is both a legal person and an undertaking, intentionally or negligently committed an infringement referred to in Article 83(4) to (6) thereof.

Decision of the Court

Opinion of the advocate general

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 58 Next Article arrow_forward
Regulation
1e 2e

Art. 58

1.   Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2.   Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3.   Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6.   Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.
1st proposal close

Art. 53 

1.           Each supervisory authority shall have the power:

(a)     to notify the controller or the processor of an alleged breach of the provisions governing the processing of personal data, and, where appropriate, order the controller or the processor to remedy that breach, in a specific manner, in order to improve the protection of the data subject;

(b)     to order the controller or the processor to comply with the data subject's requests to exercise the rights provided by this Regulation;

(c)     to order the controller and the processor, and, where applicable, the representative to provide any information relevant for the performance of its duties;

(d)     to ensure the compliance with prior authorisations and prior consultations referred to in Article 34;

(e)     to warn or admonish the controller or the processor;

(f)      to order the rectification, erasure or destruction of all data when they have been processed in breach of the provisions of this Regulation and the notification of such actions to third parties to whom the data have been disclosed;

(g)     to impose a temporary or definitive ban on processing;

(h)     to suspend data flows to a recipient in a third country or to an international organisation;

(i)      to issue opinions on any issue related to the protection of personal data;

(j)      to inform the national parliament, the government or other political institutions as well as the public on any issue related to the protection of personal data.

2.           Each supervisory authority shall have the investigative power to obtain from the controller or the processor:

(a)     access to all personal data and to all information necessary for the performance of its duties;

(b)     access to any of its premises, including to any data processing equipment and means, where there are reasonable grounds for presuming that an activity in violation of this Regulation is being carried out there.

The powers referred to in point (b) shall be exercised in conformity with Union law and Member State law.

3.           Each supervisory authority shall have the power to bring violations of this Regulation to the attention of the judicial authorities and to engage in legal proceedings, in particular pursuant to Article 74(4) and Article 75(2).

4.           Each supervisory authority shall have the power to sanction administrative offences, in particular those referred to in Article 79(4), (5) and (6).
2nd proposal close

Art. 53

 1. Each Member State shall provide by law that its supervisory authority shall have at least the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller’s representative to provide any information it requires for the performance of its tasks; (aa) to carry out investigations in the form of data protection audits;

(ab) to carry out a review on certifications issued pursuant to Article 39(4);

(b) (…)

(c) (…)

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(da) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(db) to obtain access to any premises of the controller and the processor , including to any data processing equipment and means, in conformity with Union law or Member State procedural law.

1a. (…).

1b. Each Member State shall provide by law that its supervisory authority shall have the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

 (b) to issue reprimands to a controller or processor where processing operations have infringed provisions of this Regulation;

(c) (…);

(ca) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; in particular by ordering the rectification, restriction or erasure of data pursuant to Articles 16, 17 and 17a and the notification of such actions to recipients to whom the data have been disclosed pursuant to Articles 17(2a) and 17b;

(e) to impose a temporary or definitive limitation on processing (…);

(f) to order the suspension of data flows to a recipient in a third country or to an international organisation;

(g) to impose an administrative fine pursuant to Articles 79 and 79a, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.

1c. Each Member State shall provide by law that its supervisory authority shall have the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 34,

(aa) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with national law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(ab) to authorise processing referred to in Article 34(7a), if the law of the Member State requires such prior authorisation;

(ac) to issue an opinion and approve draft codes of conduct pursuant to Article 38(2);

(ad) to accredit certification bodies under the terms of Article 39a; (ae) to issue certifications and approve criteria of certification in accordance with Article 39(2a); (b) to adopt standard data protection clauses referred to in point (c) of Article 42(2);

(c) to authorise contractual clauses referred to in point (a) of Article 42 (2a);

(ca) to authorise administrative agreements referred to in point (d) of Article 42 (2a);

(d) to approve binding corporate rules pursuant to Article 43. 2. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union.

3. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and (…), where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

4. (…)

5. (…)
Directive close

Art. 28

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Each authority shall in particular be endowed with:

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.
Poland
compare_arrows
visibility Old law

Entered into force on May 25, 2018:

The Act of May 10, 2018 on Personal Data Protection

 

Art. 84. 1.  The Controller has the right to

  1. enter, from 6 a.m. to 10 p.m any premises, site, land, or other facilities;
  2. consult any documents and data directly related to the subject of the inspection;
  3. perform an inspection of any devices, data carriers, and computer systems used for data processing;
  4. demand written or oral explanations, and to summon and question any person within the scope necessary to determine the facts of the case;
  5. commission expertise and opinions to be prepared.

2. The Data Subject unit is obliged to enable the Controller and persons working with the Controller  to perform the inspection functions, and in particular is authorized to consult any file or carrier referred to in provision 1 point 3 in which personal data are stored and make a copy.

3. The Data Subject shall confirm compliance of any certified copy with the original documents referred to in provision 2.  If he refuses to do so the Controller shall take a note of that in the inspection protocol.

4. Where appropriate, the course of the inspection or its parts can be recorded with the use of sound and/or image-recording equipment, the Data Subject shall be informed about this procedure prior to it taking place. Within the meaning of 2005 Act.

 

Art. 85. 1. The President of the Office or the Controller can turn to the chief of police for help, if it proves necessary.

2. Police can assist in the inspection after receiving a written request at least 7 days before the inspection takes place.

3. In cases of urgency, especially when the Controller encounters resistance that either makes the inspection more difficult or impossible, police can assist in a response to an oral request from the President of the Office or the Controller, upon presentation of a document of personal authorisation and service identity card.

4. The President of the Office shall provide a written confirmation of the request made, referred to in provision 3 ,  no later than 3 days from the time the inspection ends.

5. Police assistance in the inspection procedures aims at ensuring the safety of the controller as well as at accessing and maintating the order at the location of the inspection.

6.  Police shall ensure the safety of others present at the inspection, especially those who are only guests at the scene.

7. All costs bared by the police enforcement for help provided shall be accounted for in accordance with the flat-rate income of 1,5%, of the average monthly business salary without extra payments, from fourth quarter of a previous year, announced by the head of the Main Statistics Office based on art 7 provision 1 of the 1998 Act on student loans debts.

 

Art. 86. 1.The Controller is allowed to interrogate the Data Subject’s workers as witnesses.

2.The Data Subject’s worker shall be understood as any person hired by the Data Subject on the basis of either employment relationship or a contract.

3. Art 83 of the 1960 Act- Civil Code, shall be used for the interrogation.

Art. 87. 1.The factual situation shall be determined by the Controller based on the evidence collected throughout the inspection, mainly from the documents, objects,  visual inspections as well as oral or written testimonies gathered.

Art. 88. 1. The operation of the inspection shall be represented in the inspection protocol.

2. The protocol shall include:

  1. name and surname as well as the address of the Data Subject;
  2. name and surname of the person representing the Data Subject and of the authority representing the Data Subject;
  3. name and surname, job title, the company identity card of the Controller and in the case of the Controller mentioned in art 79 provision 1 point 2 name and surname and an ID number;
  4. the date of the initiation and termination of the proceedings;
  5. scope of the inspection;
  6. a description of the factual state established during the inspection as well as other information crucial for the assessing the compliance with the personal data protection laws;
  7. specification of the attachments;
  8. a note on all erasures, changes and additions made in the protocol;
  9. a letter of rights for the Data Subject on his rights regarding the reporting of objections and the right to refuse to sign the inspection protocol;
  10. date and time of when both the controller and the data subject signed the inspection protocol.

3. The inspection protocol shall be signed by the Controller and passed on to the Data Subject for the purposes of signing it.

4. The Data Subject has 7 days to refuse signing of the protocol or to report objections to its contents in a written form.

5. In the case that the objections are submitted by the Data Subject, the Controller shall analyse them and take up complementary inspection measures or if he finds the objections justified, introduce changes to the protocol in the form of an Annex to the protocol.

6. If the Controller does not consider the objections submitted, partially or at all, he shall communicate that to the Data Subject.

7. Not supplying the Controller with the signed protocol and not reporting objections  by the time referred to in provision 4 shall be read as a refusal to sign the inspection protocol.

8.  The Controller shall include information on the refusal to sign in the protocol, in the case referred to in provision 7, such information shall be included after the time referred to in provision 4 has passed.

9. The inspection protocol shall be done in an electronic form or on paper in two copies. The protocol shall be delivered by the Controller to the Data Subject.

 

Art 89. 1. The inspection shall last no longer than 30 days from the date of presenting the authorisation to conduct the inspection along with a document of personal authorisation and service identity card, to the Data Subject or a person named in the documents. This does not include the time limits set for the submission of objections or the delivery of a signed protocol.

2. The inspection deadline is the day the Data Subject signs the protocol or the day the inspector includes a note in the protocol referred to in art88 provision 8.

 

Art. 90. 1. If based on the information gathered during the inspection the President of the Office decides that a violation of personal data protection laws could have taken place, he shall initiate proceedings referred to in art 60,  immediately.

 

Art 91. The provisions of art 63-65 shall apply by analogy.
Old law close

In force until May 25, 2018:

The Act on Personal Data Protection (please see Art. 55)
arrow_back Previous Article • Article 58 Next Article arrow_forward
close

2016 - www.itiplaw.eu.